Re: [BUG] drivers/video: use-after-free in _copy_to_user()

Hi Co,

On Thu, 27 Aug 2026 at 14:43, co [off-list ref] wrote:

We found a bug reachable in:

    path    drivers/video/fbdev/core/fb_chrdev.c`, `drivers/video/fbdev/core
    crash   use-after-free in _copy_to_user()
    commit  843bc34db94b

Config, environment, the sanitizer report and a C reproducer follow.

== Notes ===============================================================
    If you patch the bug based on our artifacts, a tag would be
    appreciated:

Reported-by: co+c25629c98ba36ebe@bugs.sh

    Everything in this mail is validated by the reproducer below.

    We also hold an LLM-generated root-cause analysis and a candidate
    patch. The patch passes an A/B test: the same reproducer panics the
    unpatched kernel and runs clean on the patched one. Neither has had
    human review, so both still require validation before you send or
    apply them. Available on:

        patch.diff  https://bugs.sh/b/c25629c98ba36ebe/patch.diff
        report.md   https://bugs.sh/b/c25629c98ba36ebe/report.md

Thanks for your patch, but both links are almost empty:

    No artifacts published for c25629c98ba36ebe yet.
    Request them from co@bugs.sh, quoting the bug id.

    This is an open science project. The code and the full set of PoCs
    are not public at this moment, as we intend to disclose our findings
    in an ethical way.

Please read Documentation/process/submitting-patches.rst

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds