[PATCH] staging: fbtft: fix len<=0 buffer overflow in define_fbtft_write_reg()

[PATCH] staging: fbtft: fix len<=0 buffer overflow in define_fbtft_write_reg()

[Anshika Jain]

If len is 0 or negative when a define_fbtft_write_reg()-generated
function is called, len-- underflows to -1, causing the subsequent
while (i--) loop to run approximately 2^31 times and write far past
the end of buf.

This is a latent bug: nothing in the current code prevents two
adjacent negative values in an init_sequence from producing len=0,
and there is no guarantee future or out-of-tree panel definitions
won't do so.

Add an early return for len <= 0, matching the existing guard already
present in the sibling function fbtft_write_reg8_bus9().

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260830161529.14500-1-anshikajain196872@gmail.com?part=1

Signed-off-by: Anshika Jain <anshikajain196872@gmail.com>
---
 drivers/staging/fbtft/fbtft-bus.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/fbtft/fbtft-bus.c b/drivers/staging/fbtft/fbtft-bus.c
index e03aa251c..7d7135571 100644
--- a/drivers/staging/fbtft/fbtft-bus.c
+++ b/drivers/staging/fbtft/fbtft-bus.c
@@ -20,6 +20,9 @@ void func(struct fbtft_par *par, int len, ...)                                \
 	int offset = 0;                                                       \
 	buffer_type *buf = (buffer_type *)par->buf;                           \
 									      \
+	if (len <= 0)                                                         \
+		return;                                                       \
+									      \
 	if (unlikely(par->debug & DEBUG_WRITE_REGISTER)) {                    \
 		va_start(args, len);                                          \
 		for (i = 0; i < len; i++) {                                   \
-- 
2.34.1

Re: [PATCH] staging: fbtft: fix len<=0 buffer overflow in define_fbtft_write_reg()

[Greg Kroah-Hartman]

On Wed, Sep 02, 2026 at 10:20:26AM +0530, Anshika Jain wrote:
> If len is 0 or negative when a define_fbtft_write_reg()-generated
> function is called, len-- underflows to -1, causing the subsequent
> while (i--) loop to run approximately 2^31 times and write far past
> the end of buf.
> 
> This is a latent bug: nothing in the current code prevents two
> adjacent negative values in an init_sequence from producing len=0,
> and there is no guarantee future or out-of-tree panel definitions
> won't do so.
> 
> Add an early return for len <= 0, matching the existing guard already
> present in the sibling function fbtft_write_reg8_bus9().
> 
> Reported-by: sashiko-bot <sashiko-bot@kernel.org>
> Link: https://sashiko.dev/#/patchset/20260830161529.14500-1-anshikajain196872@gmail.com?part=1
> 
> Signed-off-by: Anshika Jain <anshikajain196872@gmail.com>
> ---
>  drivers/staging/fbtft/fbtft-bus.c | 3 +++
>  1 file changed, 3 insertions(+)

Did you forget an assisted-by: tag that helped you write this patch and
changelog?

thanks,

greg k-h

Re: [PATCH] staging: fbtft: fix len<=0 buffer overflow in define_fbtft_write_reg()

[Nam Cao]

Anshika Jain <anshikajain196872@gmail.com> writes:
> This is a latent bug: nothing in the current code prevents
> two adjacent negative values in an init_sequence from producing len=0,

Can you elaborate what you mean by "two adjacent negative values in an
init_sequence from producing len=0"? How is it possible that negative
values in the init sequence causing len to be zero?

> and there is no guarantee future or out-of-tree panel definitions
> won't do so.

Basic testing of future drivers would prevent such bug. It is not on any
rarely-executed code path.

Nam

Re: [PATCH] staging: fbtft: fix len<=0 buffer overflow in define_fbtft_write_reg()

[Nam Cao]

No html email please, the mailing lists will not get them.

Anshika Jain <anshikajain196872@gmail.com> writes:
> I'd like to keep this as a small safety check for the future, not as a fix
> for a bug happening today. If you think that's not worth adding, I'm fine
> dropping the patch.

As mentioned, such bug would show up immediately in testing. So I vote
dropping it.

Nam

Re: [PATCH] staging: fbtft: fix len<=0 buffer overflow in define_fbtft_write_reg()

[Greg Kroah-Hartman]

On Thu, Sep 03, 2026 at 10:24:36AM +0200, Nam Cao wrote:
> No html email please, the mailing lists will not get them.
> 
> Anshika Jain <anshikajain196872@gmail.com> writes:
> > I'd like to keep this as a small safety check for the future, not as a fix
> > for a bug happening today. If you think that's not worth adding, I'm fine
> > dropping the patch.
> 
> As mentioned, such bug would show up immediately in testing. So I vote
> dropping it.

Agreed, I've now dropped it from my review queue.

thanks,

greg k-h