]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
fbdev: fix potential buffer overflow in do_register_framebuffer()
authorYongzhen Zhang <zhangyongzhen@kylinos.cn>
Tue, 1 Jul 2025 09:07:04 +0000 (17:07 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 28 Aug 2025 14:28:25 +0000 (16:28 +0200)
commitcbe740de32bb0fb7a5213731ff5f26ea6718fca3
tree24ec6f499a2c5f56b8ab9ac092921940577f46f9
parent6daa13c20190012eb7cfe4f205ef331b34122e39
fbdev: fix potential buffer overflow in do_register_framebuffer()

[ Upstream commit 523b84dc7ccea9c4d79126d6ed1cf9033cf83b05 ]

The current implementation may lead to buffer overflow when:
1.  Unregistration creates NULL gaps in registered_fb[]
2.  All array slots become occupied despite num_registered_fb < FB_MAX
3.  The registration loop exceeds array bounds

Add boundary check to prevent registered_fb[FB_MAX] access.

Signed-off-by: Yongzhen Zhang <zhangyongzhen@kylinos.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/video/fbdev/core/fbmem.c