Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs

[Thomas Zimmermann]

Hi

Am 28.02.26 um 02:53 schrieb chenjun (AM):
> 在 2026/2/27 23:56, Thomas Zimmermann 写道:
> > Hi,
> >
> > thanks for the patch.
> >
> > Am 27.02.26 um 15:43 schrieb Chen Jun:
> > > When a font is set on an invisible console, the screen will not update.
> > > However, the fontbuffer is not updated to match the new font dimensions.
> > I looked through vc_resize() but cannot quite find the logic that calls
> > fbcon_rotate_font(). Can you please point to correct place?
> >
> > Best regards
> > Thomas
> Hi, fbcon_rouate_font is called in fbcon_switch
>
> [   64.669554] CPU: 3 UID: 0 PID: 978 Comm: a.out Not tainted
> 7.0.0-rc1-00021-gd9d32e5bd5a4-dirty #10 PREEMPT(lazy)
> [   64.669576] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
> BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/4
> [   64.669584] Call Trace:
>
> [   64.669589]  <TASK>
>
> [   64.669595]  dump_stack_lvl+0x53/0x70
>
> [   64.669615]  fbcon_rotate_font+0x2d6/0xe90
>
> [   64.669636]  ? kfree+0x159/0x3b0
>
> [   64.669650]  ? ud_cursor+0x830/0x1d80
>
> [   64.669661]  ? __kmalloc_noprof+0x198/0x4a0
>
> [   64.669674]  fbcon_switch+0x67b/0x10f0
>
> [   64.669689]  ? __pfx_fbcon_switch+0x10/0x10
>
> [   64.669708]  ? con_is_visible+0xb0/0x130
>
> [   64.669723]  redraw_screen+0x258/0x690

Thanks. Somehow I made a wrong turn in redraw_screen()

Best regards
Thomas

> [   64.669736]  ? mutex_unlock+0x7d/0xd0
>
> [   64.669751]  ? __pfx_redraw_screen+0x10/0x10
>
> [   64.669764]  ? tty_get_pgrp+0x73/0xb0
>
> [   64.669784]  vc_do_resize+0x9a5/0xec0
>
> [   64.669803]  ? __pfx_vc_do_resize+0x10/0x10
>
> [   64.669815]  ? kernel_fpu_begin_mask+0x1c5/0x210
>
> [   64.669832]  ? __pfx_kernel_fpu_begin_mask+0x10/0x10
>
> [   64.669843]  ? fbcon_set_font+0x2cb/0x8c0
>
> [   64.669853]  ? __kasan_kmalloc_large+0x81/0xa0
>
> [   64.669863]  ? __kmalloc_large_node_noprof+0x18/0xb0
>
> [   64.669874]  fbcon_do_set_font+0x390/0xa70
>
> [   64.669890]  ? __pfx_fbcon_set_font+0x10/0x10
>
> [   64.669900]  con_font_op+0x7d5/0xc30
>
> [   64.669910]  ? arch_stack_walk+0x9f/0xf0
>
> [   64.669924]  ? __pfx_con_font_op+0x10/0x10
>
> [   64.669940]  vt_ioctl+0x8ee/0x2480
>
> [   64.669953]  ? __pfx_vt_ioctl+0x10/0x10
>
> [   64.669964]  ? __x64_sys_open+0x79/0xc0
>
> [   64.669976]  ? do_syscall_64+0xfa/0x570
>
> [   64.669986]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> [   64.669996]  ? __pfx_path_openat+0x10/0x10
>
> [   64.670006]  ? __pfx_avc_has_extended_perms+0x10/0x10
>
> [   64.670022]  ? _raw_spin_lock+0x7f/0xd0
>
> [   64.670040]  ? do_file_open+0x22f/0x2b0
>
> [   64.670048]  ? pte_offset_map_lock+0xe2/0x1e0
>
> [   64.670070]  ? __pfx_do_file_open+0x10/0x10
>
> [   64.670082]  tty_ioctl+0x3e7/0x1190
>
> [   64.670098]  ? __pfx_tty_ioctl+0x10/0x10
>
> [   64.670109]  ? __pfx_do_vfs_ioctl+0x10/0x10
>
> [   64.670124]  ? ioctl_has_perm.constprop.74+0x2e1/0x4f0
>
> [   64.670137]  ? __pfx_ioctl_has_perm.constprop.74+0x10/0x10
>
> [   64.670148]  ? __pfx_do_sys_openat2+0x10/0x10
>
> [   64.670191]  __x64_sys_ioctl+0x130/0x1a0
>
> [   64.670204]  do_syscall_64+0xfa/0x570
>
> [   64.670214]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> [   64.670223] RIP: 0033:0x7ff56cb0c577
>
> [   64.670233] Code: b3 66 90 48 8b 05 11 89 2c 00 64 c7 00 26 00 00 00
> 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 8
> [   64.670242] RSP: 002b:00007fff94ab6a48 EFLAGS: 00000206 ORIG_RAX:
> 0000000000000010
> [   64.670256] RAX: ffffffffffffffda RBX: 0000000000000000 RCX:
> 00007ff56cb0c577
> [   64.670263] RDX: 00007fff94ab6a60 RSI: 0000000000004b72 RDI:
> 0000000000000003
> [   64.670269] RBP: 00007fff94ab6af0 R08: 000055bf68e008d0 R09:
> 00007ff56cdec090
> [   64.670275] R10: 0000000000000000 R11: 0000000000000206 R12:
> 000055bf68e00630
> [   64.670281] R13: 00007fff94ab6be0 R14: 0000000000000000 R15:
> 0000000000000000
> [   64.670293]  </TASK>
>
>
> > > This inconsistency leads to out-of-bounds memory access when writing to
> > > the tty bound to fbcon, as demonstrated by the following KASAN report:
> > >
> > > BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
> > > Read of size 1 at addr ffff8881195a2280 by task a.out/971
> > > Call Trace:
> > >     <TASK>
> > >     fb_pad_aligned_buffer+0xdf/0x140
> > >     ud_putcs+0x88a/0xde0
> > >     fbcon_putcs+0x319/0x430
> > >     do_update_region+0x23c/0x3b0
> > >     do_con_write+0x225c/0x67f0
> > >     con_write+0xe/0x30
> > >     n_tty_write+0x4b5/0xff0
> > >     file_tty_write.isra.41+0x46c/0x880
> > >     vfs_write+0x868/0xd60
> > >     ksys_write+0xf2/0x1d0
> > >     do_syscall_64+0xfa/0x570
> > >
> > > Fix this by calling fbcon_rotate_font() if vc is invisible in
> > > fbcon_do_set_font().
> > >
> > > Signed-off-by: Chen Jun <chenjun102@xxxxxxxxxx>
> > > ---
> > >     drivers/video/fbdev/core/fbcon.c | 5 +++++
> > >     1 file changed, 5 insertions(+)
> > >
> > > diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
> > > index 666261ae59d8..d76100188bee 100644
> > > --- a/drivers/video/fbdev/core/fbcon.c
> > > +++ b/drivers/video/fbdev/core/fbcon.c
> > > @@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
> > >     		rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
> > >     		cols /= w;
> > >     		rows /= h;
> > > +		if (!con_is_visible(vc)) {
> > > +			ret = fbcon_rotate_font(info, vc);
> > > +			if (ret)
> > > +				goto err_out;
> > > +		}
> > >     		ret = vc_resize(vc, cols, rows);
> > >     		if (ret)
> > >     			goto err_out;

--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)