On 10/27/26 17:09, Weiming Shi wrote:
FBIOPUT_VSCREENINFO can supply a virtual width large enough to overflow get_line_length()'s int multiplication and bypass the video-memory limit, allowing fbcon to write past the framebuffer. The offset additions can also wrap, while an excessive videomemorysize module parameter can be truncated when PAGE_ALIGN() is assigned to unsigned int.Cap framebuffer geometry at 8192 x 8192 and video memory at 512 MiB, keeping the stride, framebuffer-size, and generic fbdev drawing calculations within their destination types. KASAN reports: BUG: KASAN: vmalloc-out-of-bounds in sys_fillrect drivers/video/fbdev/core/sysfillrect.c:24 Write of size 8 at addr ffa0000001671000 by task poc/198 sys_fillrect drivers/video/fbdev/core/sysfillrect.c:24 bit_clear_margins drivers/video/fbdev/core/bitblit.c:247 fbcon_clear_margins.constprop.0 drivers/video/fbdev/core/fbcon.c:1410 fbcon_switch drivers/video/fbdev/core/fbcon.c:2261 redraw_screen drivers/tty/vt/vt.c:994 fbcon_modechanged drivers/video/fbdev/core/fbcon.c:2693 fbcon_update_vcs drivers/video/fbdev/core/fbcon.c:2732 Cc: [email protected] Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: <[email protected]> Suggested-by: Helge Deller <[email protected]> Assisted-by: LLM Signed-off-by: Weiming Shi <[email protected]> --- Changes in v3: - Clamp visible and virtual resolutions and offsets instead of rejecting oversized requests. - Clamp videomemorysize before PAGE_ALIGN() instead of rejecting it. - Add unsigned suffixes to the limit constants. Changes in v2: - Limit virtual geometry and offsets to 8192 x 8192. This retains 8K mode support while bounding all generic fbdev drawing calculations. - Cap videomemorysize at 512 MiB. - Keep the existing arithmetic types now that all inputs are bounded. drivers/video/fbdev/vfb.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
applied. Thanks! Helge
