github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 01:32:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var

Browse Source 
info->var, a framebuffer's current mode, is expected to have a matching
entry in info->modelist. var_to_display() relies on this and treats a
failed fb_match_mode() as "This should not happen". fb_set_var() keeps it
true by adding the mode to the list on every change, and
do_register_framebuffer() does the same at registration.

store_modes() replaces the modelist from userspace. fb_new_modelist()
validates the new modes but does not check that info->var still has a
match. It relies on fbcon_new_modelist() to re-point consoles, but that
only handles consoles mapped to the framebuffer. With fbcon unbound there
are none, so info->var is left describing a mode that is no longer in the
list.

A later console takeover runs var_to_display(), where fb_match_mode()
returns NULL and leaves fb_display[i].mode NULL. fbcon_switch() passes it
to display_to_var(), and fb_videomode_to_var() dereferences the NULL mode.

Keep the current mode in the list in fb_new_modelist(), the same way
fb_set_var() does.

Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Ian Bridges <icb@fastmail.org>
Signed-off-by: Helge Deller <deller@gmx.de>
This commit is contained in:
Ian Bridges 2026-06-24 23:13:12 -05:00 committed by Helge Deller
parent 5fae9a9284
commit 7f08fc10fa
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/video/fbdev/core/fbmem.c
View File

@ -767,6 +767,18 @@ int fb_new_modelist(struct fb_info *info)
if (list_empty(&info->modelist))
return 1;
/*
* The new modelist may not contain the current mode (info->var), and
* fbcon_new_modelist() below only re-points consoles mapped to this
* framebuffer. Add the current mode here so info->var keeps a match
* even when fbcon is unbound.
*/
if (!fb_match_mode(&info->var, &info->modelist)) {
fb_var_to_videomode(&mode, &info->var);
if (fb_add_videomode(&mode, &info->modelist))
return 1;
}
fbcon_new_modelist(info);
return 0;