Skip to content

Fix framebuffer pseudo palette setup#56

Open
Shaoen-Lin wants to merge 1 commit into
sysprog21:masterfrom
Shaoen-Lin:fix-fb-pseudo-palette
Open

Fix framebuffer pseudo palette setup#56
Shaoen-Lin wants to merge 1 commit into
sysprog21:masterfrom
Shaoen-Lin:fix-fb-pseudo-palette

Conversation

@Shaoen-Lin

@Shaoen-Lin Shaoen-Lin commented Jun 27, 2026

Copy link
Copy Markdown
Contributor

Function vcam_fb_setcolreg() writes TRUECOLOR entries through info->pseudo_palette, but vcamfb_init() initializes that pointer to NULL. A colormap update can therefore dereference a NULL pseudo_palette.

Add a 16-entry pseudo palette to the framebuffer private data and point info->pseudo_palette to it during initialization.

vcam_fb_setcolreg() writes TRUECOLOR entries through
info->pseudo_palette, but vcamfb_init() initializes that pointer to NULL.
A colormap update can therefore dereference a NULL pseudo_palette.

Add a 16-entry pseudo palette to the framebuffer private data and point
info->pseudo_palette to it during initialization.

Signed-off-by: Shaoen-Lin <shaoen.lin92@gmail.com>

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 1 file

Re-trigger cubic

@Shaoen-Lin

Copy link
Copy Markdown
Contributor Author

Test case to reproduce:

This test verifies that FBIOPUTCMAP reaches vcam_fb_setcolreg().
Before the fix, info->pseudo_palette was NULL, so updating the
colormap triggered a NULL pointer dereference.

sudo insmod ./vcam.ko
sudo /tmp/fb-putcmap /dev/fb1
echo $?
sudo rmmod vcam

Output before fix:

BUG: kernel NULL pointer dereference, address: 0000000000000000
Oops: Oops: 0002 [#1] PREEMPT SMP NOPTI
RIP: 0010:vcam_fb_setcolreg+0xc3/0xe0 [vcam]

Output after fix:

0

Checked dmesg; no BUG, Oops, NULL pointer dereference, KASAN report,
or general protection fault was reported after the patched test.

Also ran the coding style check:

sh .ci/check-format.sh
echo $?

Output:

0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant