Re: [PATCH] staging: fbtft: fix len<=0 buffer overflow in define_fbtft_write_reg()

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Wed, Sep 02, 2026 at 10:20:26AM +0530, Anshika Jain wrote:
> If len is 0 or negative when a define_fbtft_write_reg()-generated
> function is called, len-- underflows to -1, causing the subsequent
> while (i--) loop to run approximately 2^31 times and write far past
> the end of buf.
> 
> This is a latent bug: nothing in the current code prevents two
> adjacent negative values in an init_sequence from producing len=0,
> and there is no guarantee future or out-of-tree panel definitions
> won't do so.
> 
> Add an early return for len <= 0, matching the existing guard already
> present in the sibling function fbtft_write_reg8_bus9().
> 
> Reported-by: sashiko-bot <sashiko-bot@kernel.org>
> Link: https://sashiko.dev/#/patchset/20260830161529.14500-1-anshikajain196872@gmail.com?part=1
> 
> Signed-off-by: Anshika Jain <anshikajain196872@gmail.com>
> ---
>  drivers/staging/fbtft/fbtft-bus.c | 3 +++
>  1 file changed, 3 insertions(+)

Did you forget an assisted-by: tag that helped you write this patch and
changelog?

thanks,

greg k-h