[PATCH v2] fbdev: core: Clamp total_size to smem_len in read/write functions
From: Mingyu Wang <hidden>
Date: 2026-07-21 07:21:15
Also in:
dri-devel, lkml
Subsystem:
framebuffer core, framebuffer layer, the rest · Maintainers:
Simona Vetter, Helge Deller, Linus Torvalds
Some legacy fbdev drivers may incorrectly set info->screen_size to a value larger than the actual mapped framebuffer size (info->fix.smem_len) during mode switches. This could allow out-of-bounds I/O and system memory accesses in fb_io_read(), fb_io_write(), fb_sys_read(), and fb_sys_write(). Prevent this by clamping total_size to smem_len when smem_len is non-zero. Virtual framebuffers (smem_len == 0) are unaffected. This is a hardening measure; no specific crash is fixed by this patch. Signed-off-by: Mingyu Wang <redacted> --- v2: - Apply the clamp to fb_sys_read() and fb_sys_write() as well to prevent similar OOB accesses in system memory framebuffers (Reported by Sashiko). - Update commit message to clearly state this is a hardening measure. --- drivers/video/fbdev/core/fb_io_fops.c | 16 ++++++++++++++++ drivers/video/fbdev/core/fb_sys_fops.c | 16 ++++++++++++++++ 2 files changed, 32 insertions(+)
diff --git a/drivers/video/fbdev/core/fb_io_fops.c b/drivers/video/fbdev/core/fb_io_fops.c
index 6ab60fcd0050..335f16d2cc23 100644
--- a/drivers/video/fbdev/core/fb_io_fops.c
+++ b/drivers/video/fbdev/core/fb_io_fops.c@@ -24,6 +24,14 @@ ssize_t fb_io_read(struct fb_info *info, char __user *buf, size_t count, loff_t if (total_size == 0) total_size = info->fix.smem_len; + /* + * Security Hardening: Defend against buggy legacy drivers that may + * calculate a malformed screen_size. Clamp total_size to the actual + * hardware mapped memory limit (smem_len) to prevent OOB access. + */ + if (info->fix.smem_len && total_size > info->fix.smem_len) + total_size = info->fix.smem_len; + if (p >= total_size) return 0;
@@ -88,6 +96,14 @@ ssize_t fb_io_write(struct fb_info *info, const char __user *buf, size_t count, if (total_size == 0) total_size = info->fix.smem_len; + /* + * Security Hardening: Defend against buggy legacy drivers that may + * calculate a malformed screen_size. Clamp total_size to the actual + * hardware mapped memory limit (smem_len) to prevent OOB access. + */ + if (info->fix.smem_len && total_size > info->fix.smem_len) + total_size = info->fix.smem_len; + if (p > total_size) return -EFBIG;
diff --git a/drivers/video/fbdev/core/fb_sys_fops.c b/drivers/video/fbdev/core/fb_sys_fops.c
index be96b3b3942e..e97cf02f7c70 100644
--- a/drivers/video/fbdev/core/fb_sys_fops.c
+++ b/drivers/video/fbdev/core/fb_sys_fops.c@@ -35,6 +35,14 @@ ssize_t fb_sys_read(struct fb_info *info, char __user *buf, size_t count, if (total_size == 0) total_size = info->fix.smem_len; + /* + * Security Hardening: Defend against buggy legacy drivers that may + * calculate a malformed screen_size. Clamp total_size to the actual + * hardware mapped memory limit (smem_len) to prevent OOB access. + */ + if (info->fix.smem_len && total_size > info->fix.smem_len) + total_size = info->fix.smem_len; + if (p >= total_size) return 0;
@@ -80,6 +88,14 @@ ssize_t fb_sys_write(struct fb_info *info, const char __user *buf, if (total_size == 0) total_size = info->fix.smem_len; + /* + * Security Hardening: Defend against buggy legacy drivers that may + * calculate a malformed screen_size. Clamp total_size to the actual + * hardware mapped memory limit (smem_len) to prevent OOB access. + */ + if (info->fix.smem_len && total_size > info->fix.smem_len) + total_size = info->fix.smem_len; + if (p > total_size) return -EFBIG;
--
2.34.1