Re: [PATCH stable] fbdev: Fix out-of-bounds issue in sys_fillrect()

[Helge Deller <deller@gmx.de>]

On 12/1/25 10:25, Gu Bowen wrote:
> Hi,
> 
> On 11/15/2025 3:21 AM, Helge Deller wrote:
>> 
>> That patch does not apply to git head. Can you try to reproduce
>> with git head?
>> 
> 
> fbdev has already been refactored by commit eabb03293087 ("fbdev:
> Refactoring the fbcon packed pixel drawing routines") on v6.15-rc1,
> so this issue no longer exists in the mainline version. Similar
> question has occurred in the past:
> 
> https://syzkaller.appspot.com/bug?extid=66bde8e1e4161d4b2cca
> 
> After the refactoring patch was merged, this issue did not reappear,
> but it still exists in the stable version.
Backporting commit eabb03293087 to 6.6 seems unrealistic.
So, maybe adding your patch to stable might make sense.

+	if (dst_offset < 0 || dst_offset >= p->fix.smem_len) {
+		pr_err("dst offset out of bound: dst_offset(%ld)", dst_offset);
+		return;

I don't like the pr_err() in here. I do understand that you want to print
that something wrong happened, but we are inside the console printing code.
I think we should just return in this case.

With that change we might ask Greg if he accepts this small patch for stable-6.6...

Helge