[PATCH v4 0/3] fbcon: fix rotated font buffer handling on font change

[Yao Yiqi]

Fix out-of-bounds reads of the rotated font buffer when the console
font changes on a rotated console (fbcon=rotate:N). KDFONTOP installs
the new geometry and vc_resize() redraws before par->rotated.buf is
updated, so the old buffer is indexed with the new cell size.

Patch 1 keys the rotated font cache on the font geometry. Patch 2
rebuilds it on font changes, restoring the old buffer if the change
fails. Patch 3 retries a failed allocation.

Changes since v3: roll back via the saved buffer instead of re-running
rotate_font(), abort the font change on rebuild failure, and guard the
rotated state with CONFIG_FRAMEBUFFER_CONSOLE_ROTATION.

v1: https://lore.kernel.org/all/20261014085102.497789-1-yaoyiqi3@xxxxxxxxxx/

Yao Yiqi (3):
  fbcon: Include font geometry in the rotated font cache
  fbcon: Rebuild rotated font buffer on font change
  fbcon: Retry rotated font allocation after failure

 drivers/video/fbdev/core/fbcon.c        | 50 +++++++++++++++++++++++++++++++++
 drivers/video/fbdev/core/fbcon.h        |  9 ++++---
 drivers/video/fbdev/core/fbcon_rotate.c | 10 +++++++-
 3 files changed, 65 insertions(+), 4 deletions(-)

-- 
2.56.0