Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs
From: chenjun (AM)
Date: Fri Feb 27 2026 - 20:53:53 EST
在 2026/2/27 23:56, Thomas Zimmermann 写道:
> Hi,
>
> thanks for the patch.
>
> Am 27.02.26 um 15:43 schrieb Chen Jun:
>> When a font is set on an invisible console, the screen will not update.
>> However, the fontbuffer is not updated to match the new font dimensions.
>
> I looked through vc_resize() but cannot quite find the logic that calls
> fbcon_rotate_font(). Can you please point to correct place?
>
> Best regards
> Thomas
>
Hi, fbcon_rouate_font is called in fbcon_switch
[ 64.669554] CPU: 3 UID: 0 PID: 978 Comm: a.out Not tainted
7.0.0-rc1-00021-gd9d32e5bd5a4-dirty #10 PREEMPT(lazy)
[ 64.669576] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/4
[ 64.669584] Call Trace:
[ 64.669589] <TASK>
[ 64.669595] dump_stack_lvl+0x53/0x70
[ 64.669615] fbcon_rotate_font+0x2d6/0xe90
[ 64.669636] ? kfree+0x159/0x3b0
[ 64.669650] ? ud_cursor+0x830/0x1d80
[ 64.669661] ? __kmalloc_noprof+0x198/0x4a0
[ 64.669674] fbcon_switch+0x67b/0x10f0
[ 64.669689] ? __pfx_fbcon_switch+0x10/0x10
[ 64.669708] ? con_is_visible+0xb0/0x130
[ 64.669723] redraw_screen+0x258/0x690
[ 64.669736] ? mutex_unlock+0x7d/0xd0
[ 64.669751] ? __pfx_redraw_screen+0x10/0x10
[ 64.669764] ? tty_get_pgrp+0x73/0xb0
[ 64.669784] vc_do_resize+0x9a5/0xec0
[ 64.669803] ? __pfx_vc_do_resize+0x10/0x10
[ 64.669815] ? kernel_fpu_begin_mask+0x1c5/0x210
[ 64.669832] ? __pfx_kernel_fpu_begin_mask+0x10/0x10
[ 64.669843] ? fbcon_set_font+0x2cb/0x8c0
[ 64.669853] ? __kasan_kmalloc_large+0x81/0xa0
[ 64.669863] ? __kmalloc_large_node_noprof+0x18/0xb0
[ 64.669874] fbcon_do_set_font+0x390/0xa70
[ 64.669890] ? __pfx_fbcon_set_font+0x10/0x10
[ 64.669900] con_font_op+0x7d5/0xc30
[ 64.669910] ? arch_stack_walk+0x9f/0xf0
[ 64.669924] ? __pfx_con_font_op+0x10/0x10
[ 64.669940] vt_ioctl+0x8ee/0x2480
[ 64.669953] ? __pfx_vt_ioctl+0x10/0x10
[ 64.669964] ? __x64_sys_open+0x79/0xc0
[ 64.669976] ? do_syscall_64+0xfa/0x570
[ 64.669986] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 64.669996] ? __pfx_path_openat+0x10/0x10
[ 64.670006] ? __pfx_avc_has_extended_perms+0x10/0x10
[ 64.670022] ? _raw_spin_lock+0x7f/0xd0
[ 64.670040] ? do_file_open+0x22f/0x2b0
[ 64.670048] ? pte_offset_map_lock+0xe2/0x1e0
[ 64.670070] ? __pfx_do_file_open+0x10/0x10
[ 64.670082] tty_ioctl+0x3e7/0x1190
[ 64.670098] ? __pfx_tty_ioctl+0x10/0x10
[ 64.670109] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 64.670124] ? ioctl_has_perm.constprop.74+0x2e1/0x4f0
[ 64.670137] ? __pfx_ioctl_has_perm.constprop.74+0x10/0x10
[ 64.670148] ? __pfx_do_sys_openat2+0x10/0x10
[ 64.670191] __x64_sys_ioctl+0x130/0x1a0
[ 64.670204] do_syscall_64+0xfa/0x570
[ 64.670214] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 64.670223] RIP: 0033:0x7ff56cb0c577
[ 64.670233] Code: b3 66 90 48 8b 05 11 89 2c 00 64 c7 00 26 00 00 00
48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 8
[ 64.670242] RSP: 002b:00007fff94ab6a48 EFLAGS: 00000206 ORIG_RAX:
0000000000000010
[ 64.670256] RAX: ffffffffffffffda RBX: 0000000000000000 RCX:
00007ff56cb0c577
[ 64.670263] RDX: 00007fff94ab6a60 RSI: 0000000000004b72 RDI:
0000000000000003
[ 64.670269] RBP: 00007fff94ab6af0 R08: 000055bf68e008d0 R09:
00007ff56cdec090
[ 64.670275] R10: 0000000000000000 R11: 0000000000000206 R12:
000055bf68e00630
[ 64.670281] R13: 00007fff94ab6be0 R14: 0000000000000000 R15:
0000000000000000
[ 64.670293] </TASK>
>>
>> This inconsistency leads to out-of-bounds memory access when writing to
>> the tty bound to fbcon, as demonstrated by the following KASAN report:
>>
>> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
>> Read of size 1 at addr ffff8881195a2280 by task a.out/971
>> Call Trace:
>> <TASK>
>> fb_pad_aligned_buffer+0xdf/0x140
>> ud_putcs+0x88a/0xde0
>> fbcon_putcs+0x319/0x430
>> do_update_region+0x23c/0x3b0
>> do_con_write+0x225c/0x67f0
>> con_write+0xe/0x30
>> n_tty_write+0x4b5/0xff0
>> file_tty_write.isra.41+0x46c/0x880
>> vfs_write+0x868/0xd60
>> ksys_write+0xf2/0x1d0
>> do_syscall_64+0xfa/0x570
>>
>> Fix this by calling fbcon_rotate_font() if vc is invisible in
>> fbcon_do_set_font().
>>
>> Signed-off-by: Chen Jun <chenjun102@xxxxxxxxxx>
>> ---
>> drivers/video/fbdev/core/fbcon.c | 5 +++++
>> 1 file changed, 5 insertions(+)
>>
>> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
>> index 666261ae59d8..d76100188bee 100644
>> --- a/drivers/video/fbdev/core/fbcon.c
>> +++ b/drivers/video/fbdev/core/fbcon.c
>> @@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
>> rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
>> cols /= w;
>> rows /= h;
>> + if (!con_is_visible(vc)) {
>> + ret = fbcon_rotate_font(info, vc);
>> + if (ret)
>> + goto err_out;
>> + }
>> ret = vc_resize(vc, cols, rows);
>> if (ret)
>> goto err_out;
>