Re: [PATCH v2,stable/linux-6.6.y] fbdev: Fix out-of-bounds issue in sys_fillrect()

[Gu Bowen <gubowen5@huawei.com>]

Hi Greg,

On 12/17/2025 5:34 PM, Greg Kroah-Hartman wrote:
> On Wed, Dec 17, 2025 at 05:45:30PM +0800, Gu Bowen wrote:
>> This issue has already been fixed by commit eabb03293087 ("fbdev:
>> Refactoring the fbcon packed pixel drawing routines") on v6.15-rc1, but it
>> still exists in the stable version.
> 
> Why not take the refactoring changes instead?  That is almost always the
> proper thing to do, one-off changes are almost always wrong and cause
> extra work in the long-term.
> 
> Please try backporting those changes instead please.
> 
> thanks,
> 
> greg k-h

As you've suggested, I understand the preference to keep stable branches 
aligned with upstream when possible. However, I find that the 
refactoring touches many areas of the codebase that have diverged 
between mainline and stable-6.6, resulting in extensive merge conflicts. 
In addition, I cannot be certain that backporting 3000+ lines of 
refactoring code to a stable branch might introduce unknown risks.

Given the current situation, I have another simpler patch solution that 
is easy to maintain, and perhaps it could be merged into the stable branch:

void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
  ...
  while (height--) {
  	dst += dst_idx >> (ffs(bits) - 1);
+	long dst_offset;
+	dst_offset = (unsigned long)dst - (unsigned long)p->screen_base;
+	if (dst_offset < 0 || dst_offset >= p->fix.smem_len)
+		return;
  	dst_idx &= (bits - 1);
  	fill_op32(p, dst, dst_idx, pat, width*bpp, bits);
  ...


BR,
Guber