Linux kernel source tree
Go to file
Kees Cook cedc1b6339 fbcon: Make sure modelist not set on unregistered console
It looks like attempting to write to the "store_modes" sysfs node will
run afoul of unregistered consoles:

UBSAN: array-index-out-of-bounds in drivers/video/fbdev/core/fbcon.c:122:28
index -1 is out of range for type 'fb_info *[32]'
...
 fbcon_info_from_console+0x192/0x1a0 drivers/video/fbdev/core/fbcon.c:122
 fbcon_new_modelist+0xbf/0x2d0 drivers/video/fbdev/core/fbcon.c:3048
 fb_new_modelist+0x328/0x440 drivers/video/fbdev/core/fbmem.c:673
 store_modes+0x1c9/0x3e0 drivers/video/fbdev/core/fbsysfs.c:113
 dev_attr_store+0x55/0x80 drivers/base/core.c:2439

static struct fb_info *fbcon_registered_fb[FB_MAX];
...
static signed char con2fb_map[MAX_NR_CONSOLES];
...
static struct fb_info *fbcon_info_from_console(int console)
...
        return fbcon_registered_fb[con2fb_map[console]];

If con2fb_map contains a -1 things go wrong here. Instead, return NULL,
as callers of fbcon_info_from_console() are trying to compare against
existing "info" pointers, so error handling should kick in correctly.

Reported-by: syzbot+a7d4444e7b6e743572f7@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/679d0a8f.050a0220.163cdc.000c.GAE@google.com/
Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>
2025-05-31 10:24:02 +02:00
arch EFI updates for v6.16 2025-05-30 12:42:57 -07:00
block cgroup: Changes for v6.16 2025-05-27 20:59:53 -07:00
certs sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 2024-09-20 19:52:48 +03:00
crypto EFI updates for v6.16 2025-05-30 12:42:57 -07:00
Documentation automount wart removal 2025-05-30 15:38:29 -07:00
drivers fbcon: Make sure modelist not set on unregistered console 2025-05-31 10:24:02 +02:00
fs automount wart removal 2025-05-30 15:38:29 -07:00
include fbdev: atyfb: Remove unused PCI vendor ID 2025-05-31 10:24:01 +02:00
init hardening updates for v6.16-rc1 2025-05-28 07:47:10 -07:00
io_uring Networking changes for 6.16. 2025-05-28 15:24:36 -07:00
ipc VFS: rename lookup_one_len family to lookup_noperm and remove permission check 2025-04-08 11:24:36 +02:00
kernel automount wart removal 2025-05-30 15:38:29 -07:00
lib Devicetree updates for v6.16: 2025-05-29 08:22:07 -07:00
LICENSES LICENSES: add 0BSD license text 2024-09-01 20:43:24 -07:00
mm RDMA v6.16 merge window pull request 2025-05-30 10:18:56 -07:00
net bpf-next-6.16 2025-05-28 15:52:42 -07:00
rust Merge branch 'pm-cpufreq' 2025-05-30 20:11:09 +02:00
samples tsm for 6.16 2025-05-29 21:21:11 -07:00
scripts ARM: 2025-05-29 08:10:01 -07:00
security ipe/stable-6.16 PR 20250527 2025-05-29 08:01:53 -07:00
sound sound updates for 6.16-rc1 2025-05-27 15:05:18 -07:00
tools tracing updates for v6.16: 2025-05-29 21:04:36 -07:00
usr usr/include: openrisc: don't HDRTEST bpf_perf_event.h 2025-05-12 15:03:17 +09:00
virt ARM: 2025-04-08 13:47:55 -07:00
.clang-format Linux 6.15-rc5 2025-05-06 16:39:25 +10:00
.clippy.toml rust: clean Rust 1.88.0's warning about clippy::disallowed_macros configuration 2025-05-07 00:11:47 +02:00
.cocciconfig
.editorconfig .editorconfig: remove trim_trailing_whitespace option 2024-06-13 16:47:52 +02:00
.get_maintainer.ignore MAINTAINERS: Retire Ralf Baechle 2024-11-12 15:48:59 +01:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore .gitignore: ignore Python compiled bytecode 2025-04-24 10:12:46 -06:00
.mailmap NFSD 6.16 Release Notes 2025-05-28 12:21:12 -07:00
.pylintrc docs: add a .pylintrc file with sys path for docs scripts 2025-04-09 12:10:33 -06:00
.rustfmt.toml rust: add .rustfmt.toml 2022-09-28 09:02:20 +02:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: update SLAB ALLOCATOR maintainers 2025-04-17 20:10:06 -07:00
Kbuild drm: ensure drm headers are self-contained and pass kernel-doc 2025-02-12 10:44:43 +02:00
Kconfig io_uring: Rename KConfig to Kconfig 2025-02-19 14:53:27 -07:00
MAINTAINERS More power management updates for 6.16-rc1 2025-05-30 11:54:29 -07:00
Makefile A moderately busy cycle for documentation this time around: 2025-05-27 11:22:19 -07:00
README README: Fix spelling 2024-03-18 03:36:32 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.