From: Yao Yiqi <[email protected]>
Sorry for the late update. I was overwhelmed by the AI reviews. This is
not the driver that I am very familiar with, so it spends me a *lot* of
time.
This series fixes out-of-bounds reads of the rotated font buffer on
consoles that use fbcon's software rotation (fbcon=rotate:N).
Changing the console font through KDFONTOP installs the new font
geometry and then calls vc_resize(), whose redraw indexes
par->rotated.buf with the new cell size while the buffer is still
sized and laid out for the old font. KASAN reports, for example:
BUG: KASAN: slab-out-of-bounds in soft_cursor
Read of size 64 at addr ...
memcpy
soft_cursor
cw_cursor
fbcon_cursor
hide_cursor
redraw_screen
vc_do_resize
fbcon_do_set_font
fbcon_set_font
con_font_op
vt_ioctl
Patch 2 adds the missing rebuild for the font-change path, and
compensates in the error path of fbcon_do_set_font(): if vc_resize()
fails, the font state is rolled back, and the rotated cache has to be
rebuilt for the restored font as well. The rebuild itself cannot be
undone, because font_data_rotate() has already reused or freed the
old buffer.
The cache key in fbcon_rotate_font() compared only the fontdata
pointer and the rotation. Raw font data does not store geometry, and
fbcon_set_font() deduplicates uploads by byte equality, so re-uploading
the same bytes with different dimensions keeps the pointer unchanged
while the geometry changes; the early-out then skips the rebuild and
the stale buffer is overrun during the resize redraw. Patch 1 adds the
font geometry to the cache key. Patch 3 makes a failed buffer
allocation retried on the next call, instead of blanking the console
until a font or rotation with a different key is installed.
The unrotated-rendering fallback that fbcon_init(), fbcon_switch() and
fbcon_modechanged() attempt when rotate_font() fails is ineffective:
set_blitting_type() immediately re-derives par->rotate from
par->p->con_rotate and reinstalls the rotated bitops. This is a
pre-existing issue that is independent of the font-change path, so it
is deliberately not addressed here and will be sent separately.
Changes since v1 [1]:
- new patch 1 ("Include font geometry in the rotated font cache") in
response to the review, which noted that the early-out relies on the
fontdata pointer alone
- patch 2 (was patch 1): also rebuild in the error path of
fbcon_do_set_font(), so a failed vc_resize() no longer leaves the
cache describing the rejected font while the console renders with
the restored one; and select the console's blitting state with
set_blitting_type() before rebuilding, like the other rotate_font()
callers, instead of writing par->p directly
- patch 3 (was patch 2): unchanged in essence; the retry now covers
the geometry-aware key of patch 1
[1] https://lore.kernel.org/all/[email protected]/
Yao Yiqi (3):
fbcon: Include font geometry in the rotated font cache
fbcon: Rebuild rotated font buffer on font change
fbcon: Retry rotated font allocation after failure
drivers/video/fbdev/core/fbcon.c | 19 +++++++++++++++++++
drivers/video/fbdev/core/fbcon.h | 9 ++++++---
drivers/video/fbdev/core/fbcon_rotate.c | 10 +++++++++-
3 files changed, 34 insertions(+), 4 deletions(-)
--
2.56.0
