Fix out-of-bounds reads of the rotated font buffer when the console font changes on a rotated console (fbcon=rotate:N). KDFONTOP installs the new geometry and vc_resize() redraws before par->rotated.buf is updated, so the old buffer is indexed with the new cell size.
Patch 1 keys the rotated font cache on the font geometry. Patch 2 rebuilds it on font changes, restoring the old buffer if the change fails. Patch 3 retries a failed allocation. Changes since v3: roll back via the saved buffer instead of re-running rotate_font(), abort the font change on rebuild failure, and guard the rotated state with CONFIG_FRAMEBUFFER_CONSOLE_ROTATION. v1: https://lore.kernel.org/all/[email protected]/ Yao Yiqi (3): fbcon: Include font geometry in the rotated font cache fbcon: Rebuild rotated font buffer on font change fbcon: Retry rotated font allocation after failure drivers/video/fbdev/core/fbcon.c | 50 +++++++++++++++++++++++++++++++++ drivers/video/fbdev/core/fbcon.h | 9 ++++--- drivers/video/fbdev/core/fbcon_rotate.c | 10 +++++++- 3 files changed, 65 insertions(+), 4 deletions(-) -- 2.56.0
