github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 04:34:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

vt: hide cursor prior to font changes to avoid out-of-bound reads

Browse Source 
KASAN reports slab-out-of-bounds errors:
BUG: KASAN: slab-out-of-bounds in soft_cursor+0x3eb/0xb70 drivers/video/fbdev/core/softcursor.c:70

When changing the size of a sceen font, the amount of columns and rows
on a screen may change and thus the current position of the cursor and
the selection may suddenly lay outside of the current screen limits.

Clear the selection and hide the cursor before any font changes to avoid
such possible out of bounds accesses.

Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr>
Signed-off-by: Helge Deller <deller@gmx.de>
Link: https://lore.kernel.org/all/20260819163440.3702924-1-jjy600901@snu.ac.kr/
This commit is contained in:
Helge Deller 2026-08-21 10:01:22 +02:00
parent 2626025102
commit 3c0ebc4c07
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/tty/vt/vt.c
View File

@ -4986,8 +4986,8 @@ static int con_font_set(struct vc_data *vc, const struct console_font_op *op)
if (!vc->vc_sw->con_font_set)
return -ENOSYS;
if (vc_is_sel(vc))
clear_selection();
/* hide selection and cursor prior font changes */
hide_cursor(vc);
return vc->vc_sw->con_font_set(vc, &font, vpitch, op->flags);
}
@ -5011,8 +5011,9 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op)
if (!vc->vc_sw->con_font_default)
return -ENOSYS;
if (vc_is_sel(vc))
clear_selection();
/* hide selection and cursor prior font changes */
hide_cursor(vc);
int ret = vc->vc_sw->con_font_default(vc, &font, s);
if (ret)
return ret;