]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
staging: sm750fb: fix off-by-one in lynxfb_ops_setcolreg
authorAhmet Sezgin Duran <ahmet@sezginduran.net>
Wed, 8 Apr 2026 18:12:10 +0000 (18:12 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 27 Apr 2026 11:01:51 +0000 (05:01 -0600)
commit1121e3084095d162eb68bde350016e8257a37eb5
treeed1e728a16ed809c7839c2676c3fdce126c33a05
parent94c938a0c158635a26212f2dbf6887d969e9b19e
staging: sm750fb: fix off-by-one in lynxfb_ops_setcolreg

The bounds check used regno > 256 instead of regno >= 256,
allowing regno == 256. Valid indices are 0–255, resulting
in an out-of-bounds write.

Also remove the regno < 256 check in the truecolor path,
as it is always true with the corrected guard.

Signed-off-by: Ahmet Sezgin Duran <ahmet@sezginduran.net>
Link: https://patch.msgid.link/20260408181210.9672-1-ahmet@sezginduran.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/sm750fb/sm750.c