diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index f5178eefec641525513591506e1daf3ba7f36e58..ec3c71edf72ef70e31b6ed8333faf04aba3276b8 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2647,9 +2647,9 @@ static void fbcon_modechanged(struct fb_info *info)
 		return;
 
 	p = &fb_display[vc->vc_num];
-	set_blitting_type(vc, info);
 
 	if (con_is_visible(vc)) {
+		set_blitting_type(vc, info);
 		var_to_display(p, &info->var, info);
 		cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
 		rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
diff --git a/drivers/video/fbdev/core/sysfillrect.c b/drivers/video/fbdev/core/sysfillrect.c
index 33ee3d34f9d24004c85002ff9be86cbc25d62eef..7b4103c3288ee464911e48808e0c8f533699ae75 100644
--- a/drivers/video/fbdev/core/sysfillrect.c
+++ b/drivers/video/fbdev/core/sysfillrect.c
@@ -248,6 +248,7 @@ void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
 	u32 bpp = p->var.bits_per_pixel;
 	unsigned long *dst;
 	int dst_idx, left;
+	long dst_offset;
 
 	if (p->state != FBINFO_STATE_RUNNING)
 		return;
@@ -287,6 +288,11 @@ void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
 		}
 		while (height--) {
 			dst += dst_idx >> (ffs(bits) - 1);
+			dst_offset = (long)dst - (long)p->screen_base;
+			if (dst_offset < 0 || dst_offset >= p->fix.smem_len) {
+				pr_err("dst offset out of bound: dst_offset(%ld)", dst_offset);
+				return;
+			}
 			dst_idx &= (bits - 1);
 			fill_op32(p, dst, dst_idx, pat, width*bpp, bits);
 			dst_idx += p->fix.line_length*8;