From 3c0ebc4c07ff1147724d8f370203e62390ae7ee7 Mon Sep 17 00:00:00 2001 From: Helge Deller Date: Fri, 21 Aug 2026 10:01:22 +0200 Subject: [PATCH] vt: hide cursor prior to font changes to avoid out-of-bound reads KASAN reports slab-out-of-bounds errors: BUG: KASAN: slab-out-of-bounds in soft_cursor+0x3eb/0xb70 drivers/video/fbdev/core/softcursor.c:70 When changing the size of a sceen font, the amount of columns and rows on a screen may change and thus the current position of the cursor and the selection may suddenly lay outside of the current screen limits. Clear the selection and hide the cursor before any font changes to avoid such possible out of bounds accesses. Reported-by: Jaeyoung Chung Signed-off-by: Helge Deller Link: https://lore.kernel.org/all/20260819163440.3702924-1-jjy600901@snu.ac.kr/ --- drivers/tty/vt/vt.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 8f467b22b799..57edf37495a8 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -4986,8 +4986,8 @@ static int con_font_set(struct vc_data *vc, const struct console_font_op *op) if (!vc->vc_sw->con_font_set) return -ENOSYS; - if (vc_is_sel(vc)) - clear_selection(); + /* hide selection and cursor prior font changes */ + hide_cursor(vc); return vc->vc_sw->con_font_set(vc, &font, vpitch, op->flags); } @@ -5011,8 +5011,9 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op) if (!vc->vc_sw->con_font_default) return -ENOSYS; - if (vc_is_sel(vc)) - clear_selection(); + /* hide selection and cursor prior font changes */ + hide_cursor(vc); + int ret = vc->vc_sw->con_font_default(vc, &font, s); if (ret) return ret;