)]}'
{
  "commit": "01d1204582f16e8b7bfce29648e5cf77a585d962",
  "tree": "6207f28912dfda76907c05259cbf5da186096911",
  "parents": [
    "e220f288b76b734e749c0035cc79a98b920a24d5"
  ],
  "author": {
    "name": "Wang Haoran",
    "email": "haoranwangsec@gmail.com",
    "time": "Fri Oct 23 15:56:11 2026 +0800"
  },
  "committer": {
    "name": "Helge Deller",
    "email": "deller@gmx.de",
    "time": "Sun Oct 25 08:57:27 2026 +0100"
  },
  "message": "fbdev: atmel_lcdfb: fix list_first_entry() on possibly empty modelist in probe\n\nlist_first_entry() does not return NULL on an empty list; it returns a\nbogus pointer computed by container_of() from the list head.\natmel_lcdfb_probe() initializes info-\u003emodelist with INIT_LIST_HEAD()\nand later takes its first entry with list_first_entry(), assuming\natmel_lcdfb_of_init() populated it. However, atmel_lcdfb_of_init()\ndrops the return value of fb_add_videomode() — unlike every other\nfallible call in the same function — so if fb_add_videomode() fails\n(its internal kmalloc can return -ENOMEM under memory pressure or\nfault injection), the list stays empty while of_init() reports\nsuccess. The probe path then dereferences the bogus pointer in\nfb_videomode_to_var(\u0026info-\u003evar, \u0026modelist-\u003emode). Because the bogus\npointer lands inside the contiguous fb_info allocation, this may not\nfault immediately; instead it silently reads adjacent memory as a\nstruct fb_videomode and programs garbage timing parameters into the\nLCD controller. This was found by code audit; we do not have Atmel\nhardware to reproduce it.\n\nFix this on two levels: check the return value of fb_add_videomode()\nin atmel_lcdfb_of_init() so the failure is propagated (root cause),\nand use list_first_entry_or_null() in atmel_lcdfb_probe() with a NULL\ncheck that fails probe gracefully with -EINVAL (defense in depth),\nconsistent with the surrounding error handling which bails out to\nstop_clk.\n\nReported-by: Wang Haoran \u003chaoranwangsec@gmail.com\u003e\nReported-by: Li Ximo \u003clixicaicai@gmail.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Wang Haoran \u003chaoranwangsec@gmail.com\u003e\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "9a0cc09004b70b301f70ee621c53e09f25eaee10",
      "old_mode": 33188,
      "old_path": "drivers/video/fbdev/atmel_lcdfb.c",
      "new_id": "bed11a652d14d0fcd4fe023fcc4bf0c858e7c9a0",
      "new_mode": 33188,
      "new_path": "drivers/video/fbdev/atmel_lcdfb.c"
    }
  ]
}