Fix out-of-bounds reads of the rotated font buffer when the console font changes on a rotated console (fbcon=rotate:N). KDFONTOP installs the new geometry and vc_resize() redraws before par->rotated.buf is updated, so the old buffer is indexed with the new cell size.
Patch 1 keys the rotated font cache on the font geometry. Patch 2 rebuilds it on font changes, saving and restoring the whole cache if the change fails. Patch 3 retries a failed allocation. Changes since v4: save, clear and restore the entire par->rotated state instead of only the buffer; restoring just the buffer left the cache key describing the rejected font, which could make a later switch skip the rebuild and index the smaller buffer with the larger font's geometry (found by the Sashiko review). v4: https://lore.kernel.org/all/[email protected]/ v1: https://lore.kernel.org/all/[email protected]/ Yao Yiqi (3): fbcon: Include font geometry in the rotated font cache fbcon: Rebuild rotated font buffer on font change fbcon: Retry rotated font allocation after failure drivers/video/fbdev/core/fbcon.c | 46 ++++++++++++++++++++++++++ drivers/video/fbdev/core/fbcon.h | 19 ++++++---- drivers/video/fbdev/core/fbcon_rotate.c | 10 ++++++- 3 files changed, 68 insertions(+), 7 deletions(-) -- 2.56.0
