Commit 523b84dc authored by Yongzhen Zhang's avatar Yongzhen Zhang Committed by Helge Deller
Browse files

fbdev: fix potential buffer overflow in do_register_framebuffer() 



The current implementation may lead to buffer overflow when:
1.  Unregistration creates NULL gaps in registered_fb[]
2.  All array slots become occupied despite num_registered_fb < FB_MAX
3.  The registration loop exceeds array bounds

Add boundary check to prevent registered_fb[FB_MAX] access.

Signed-off-by: default avatarYongzhen Zhang <zhangyongzhen@kylinos.cn>
Signed-off-by: default avatarHelge Deller <deller@gmx.de>
parent ecdd7df9

drivers/video/fbdev/core/fbmem.c

+3 −0
Original line number Diff line number Diff line
@@ -449,6 +449,9 @@ static int do_register_framebuffer(struct fb_info *fb_info) 
		if (!registered_fb[i])

			break;



	if (i >= FB_MAX)

		return -ENXIO;



	if (!fb_info->modelist.prev || !fb_info->modelist.next)

		INIT_LIST_HEAD(&fb_info->modelist);