github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
da1ea35fea
linux/drivers/video/fbdev
History
Rik van Riel e033cbf397 fbdev: bitblit: bound-check glyph index in bit_cursor() 
bit_cursor() fetches the glyph under the cursor with

	c = scr_readw(vc_pos);
	src = vc_font.data + ((c & charmask) * w * height);

where charmask is 0x1ff when vc_hi_font_mask is set. The screen buffer
value comes directly from scr_readw() and may be larger than the current
font's glyph count.

Syzkaller triggers this via vcs_write(). The Call Trace shows
vcs_write() in vc_screen.c writing an arbitrary 16-bit value with
writev() to /dev/vcsa, which vcs_write_buf() in vc_screen.c stores via
vcs_scr_writew() without checking charcount. The stored value is later
read in bit_cursor() in bitblit.c.

When the font is changed from a font with 512 glyphs to a font with
256 glyphs, the screen buffer can retain characters with the high
bit set from the previous mode, which could also produce the same
out-of-bounds access.

  BUG: KASAN: global-out-of-bounds in soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70
  Read of size 16 at addr ffff800086c57970

  Call Trace:
   soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70
   bit_cursor+0xa90/0x1108 drivers/video/fbdev/core/bitblit.c:365
   fbcon_cursor+0x344/0x498 drivers/video/fbdev/core/fbcon.c:1427
   hide_cursor+0xdc/0x2d0 drivers/tty/vt/vt.c:883
   update_region+0x100/0x18c drivers/tty/vt/vt.c:669
   vcs_write+0x8ec/0xaf0 drivers/tty/vt/vc_screen.c:685

bit_putcs_aligned() and bit_putcs_unaligned() already clamp the glyph
index to vc_font.charcount. Apply the same clamp in bit_cursor() after
extracting the attribute and masking, before indexing fontdata.

The fix completes the bounds checking started in commit 18c4ef4e76
("fbdev: bitblit: bound-check glyph index in bit_putcs*"), which missed
the cursor path.

This change should be safe because the clamp reuses the existing
contract from fbcon: charcount is maintained under console_lock in
con_font_set() and fbcon_font_set(), and hi_font_mask is cleared when
switching from 512 to 256 glyphs. When stale screen data with high bits
remains after a font switch, or when vcs_write() stores an arbitrary
value, clamping the index to 0 prevents the out-of-bounds read without
changing cursor semantics — the same fallback bit_putcs uses.

Reported-by: syzbot+61b1db46218109869c14@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=61b1db46218109869c14
Link: https://lore.kernel.org/all/6a75205c.01d0871a.3a0d52.0032.GAE@google.com/
Fixes: 18c4ef4e76 ("fbdev: bitblit: bound-check glyph index in bit_putcs*")
Cc: stable@vger.kernel.org
Assisted-by: Hermes:muse-spark-1.2 syzkaller
Signed-off-by: Rik van Riel <riel@surriel.com>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-08-08 08:08:58 +02:00
..
aty fbdev: radeon: fix potential memory leak in radeonfb_pci_register() 2026-06-07 18:25:42 +02:00
core fbdev: bitblit: bound-check glyph index in bit_cursor() 2026-08-08 08:08:58 +02:00
geode fbdev: Consistently define pci_device_ids using named initializers 2026-06-07 18:25:41 +02:00
i810 fbdev: i810: use appopriate log interface dev_info 2025-12-02 20:15:51 +01:00
kyro fbdev: Consistently define pci_device_ids using named initializers 2026-06-07 18:25:41 +02:00
matrox fbdev: Consistently define pci_device_ids using named initializers 2026-06-07 18:25:41 +02:00
mb862xx fbdev: mb862xxfb: Use int type to store negative error codes 2025-09-30 23:21:34 +02:00
mmp fbdev: mmpfb: Use strscpy() to copy device name 2026-06-09 16:00:11 +02:00
nvidia fbdev: nvidia: fix potential memory leak in nvidiafb_probe() 2026-06-07 18:25:42 +02:00
omap fbdev: omapfb: Add missing error check for clk_get() 2026-03-10 18:40:21 +01:00
omap2 Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
riva fbdev: rivafb: Use strscpy() to copy device name 2026-06-09 16:00:11 +02:00
savage fbdev: Consistently define pci_device_ids using named initializers 2026-06-07 18:25:41 +02:00
sis fbdev: sisfb: Replace strlen() strcpy() pair with strscpy() 2026-06-09 16:00:11 +02:00
via fbdev: viafb: return an error when DMA copy times out 2026-06-25 18:36:53 +02:00
68328fb.c fbdev/68328fb: Initialize fb_ops to fbdev I/O-memory helpers 2023-10-19 12:54:16 +02:00
acornfb.c fbdev/acornfb: Fix name of fb_ops initializer macro 2023-11-29 12:20:08 +01:00
acornfb.h
amifb.c fbdev: Switch back to struct platform_driver::remove() 2024-10-08 21:47:18 +02:00
arcfb.c fbdev: Switch back to struct platform_driver::remove() 2024-10-08 21:47:18 +02:00
arkfb.c fbdev: Consistently define pci_device_ids using named initializers 2026-06-07 18:25:41 +02:00
asiliantfb.c fbdev/asiliantfb: Use fbdev I/O helpers 2023-08-04 15:54:34 +02:00
atafb_iplan2p2.c
atafb_iplan2p4.c
atafb_iplan2p8.c
atafb_mfb.c
atafb_utils.h
atafb.c fbdev/atafb: Initialize fb_ops to fbdev I/O-memory helpers 2023-10-19 12:54:38 +02:00
atafb.h
atmel_lcdfb.c fbdev: atmel_lcdfb: Use strscpy() to copy device name 2026-06-09 16:00:11 +02:00
au1100fb.c fbdev: au1100fb: Fix build on MIPS64 2026-03-05 17:35:12 +01:00
au1200fb.c fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe() 2026-02-14 11:09:47 +01:00
au1200fb.h
broadsheetfb.c fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() 2026-06-07 18:25:42 +02:00
bt431.h
bt455.h
bw2.c fbdev: Constify struct sbus_mmap_map 2024-10-15 10:07:32 +02:00
c2p_core.h
c2p_iplan2.c fbdev/c2p: Include <linux/export.h> 2025-06-16 09:06:58 +02:00
c2p_planar.c fbdev/c2p: Include <linux/export.h> 2025-06-16 09:06:58 +02:00
c2p.h
carminefb_regs.h
carminefb.c fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() 2026-06-07 18:25:42 +02:00
carminefb.h fbdev: carminefb: Fix spelling mistake of CARMINE_TOTAL_DIPLAY_MEM 2025-05-31 10:24:01 +02:00
cg3.c fbdev: Constify struct sbus_mmap_map 2024-10-15 10:07:32 +02:00
cg6.c fbdev: Constify struct sbus_mmap_map 2024-10-15 10:07:32 +02:00
cg14.c fbdev: Constify struct sbus_mmap_map 2024-10-15 10:07:32 +02:00
chipsfb.c fbdev: chipsfb: add missing MODULE_DESCRIPTION() macro 2026-06-09 16:00:10 +02:00
cirrusfb.c fbdev: Consistently define pci_device_ids using named initializers 2026-06-07 18:25:41 +02:00
clps711x-fb.c fbdev: clps711x-fb: Request memory region for MMIO 2026-04-22 16:46:40 +02:00
cobalt_lcdfb.c fbdev: cobalt_lcdfb: Request memory region 2026-04-22 16:46:40 +02:00
controlfb.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
controlfb.h
cyber2000fb.c fbdev: cyber2000fb: Use strscpy() to copy device name 2026-06-09 16:00:11 +02:00
cyber2000fb.h fbdev/cyber2000fb: Unexport symbols 2025-06-16 09:07:03 +02:00
dnfb.c fbdev/dnfb: Initialize fb_ops to fbdev I/O-memory helpers 2023-10-19 12:55:07 +02:00
edid.h
efifb.c fbdev: efifb: fix memory leak in efifb_probe() 2026-06-07 18:25:42 +02:00
ep93xx-fb.c fbdev: Switch back to struct platform_driver::remove() 2024-10-08 21:47:18 +02:00
ffb.c fbdev: ffb: fix corrupted video output on Sun FFB1 2026-02-14 11:09:47 +01:00
fm2fb.c fbdev/fm2fb: Use fbdev I/O helpers 2023-08-04 15:54:35 +02:00
fsl-diu-fb.c fbdev: fsl-diu-fb: add missing device_remove_file() 2025-03-26 22:39:21 +01:00
g364fb.c fbdev/g364fb: fix build failure with mips 2023-09-02 08:18:40 -07:00
gbefb.c fbdev: gbefb: fix to use physical address instead of dma address 2025-11-15 13:46:45 +01:00
goldfishfb.c fbdev: goldfishfb: fail pan display on base-update timeout 2026-06-25 18:29:14 +02:00
grvga.c fbdev: grvga: Fix CLUT register address offset in comment 2026-06-09 16:00:10 +02:00
gxt4500.c fbdev: gxt4500fb: Use dev_err instead of printk 2025-11-15 13:46:45 +01:00
hecubafb.c fbdev: hecubafb: fix potential memory leak in hecubafb_probe() 2026-06-07 18:25:42 +02:00
hitfb.c fbdev: Switch back to struct platform_driver::remove() 2024-10-08 21:47:18 +02:00
hpfb.c fbdev: hpfb: Fix an error handling path in hpfb_dio_probe() 2024-08-30 18:42:38 +02:00
i740_reg.h
i740fb.c fbdev: i740fb: fix potential memory leak in i740fb_probe() 2026-06-07 18:25:42 +02:00
imsttfb.c fbdev: imsttfb: convert comma to semicolon 2024-09-02 13:54:26 +02:00
imxfb.c fbdev: imxfb: Use of_device_get_match_data() 2026-06-07 18:25:42 +02:00
Kconfig fbdev: remove Hercules monochrome ISA graphics adapter driver 2026-05-20 20:23:32 +02:00
leo.c fbdev: Constify struct sbus_mmap_map 2024-10-15 10:07:32 +02:00
macfb.c fbdev: macfb: Replace deprecated strcpy with strscpy 2026-03-09 13:06:48 +01:00
macmodes.c fbdev: Include <linux/export.h> 2025-06-16 09:06:19 +02:00
macmodes.h
Makefile fbdev: remove Hercules monochrome ISA graphics adapter driver 2026-05-20 20:23:32 +02:00
maxinefb.c fbdev/maxinefb: Use fbdev I/O helpers 2023-08-04 15:54:36 +02:00
metronomefb.c fbdev: metronomefb: fix potential memory leak in metronomefb_probe() 2026-06-07 18:25:42 +02:00
n411.c
neofb.c fbdev: Consistently define pci_device_ids using named initializers 2026-06-07 18:25:41 +02:00
ocfb.c fbdev: Switch back to struct platform_driver::remove() 2024-10-08 21:47:18 +02:00
offb.c fbdev: offb: fix PCI device reference leak on probe failure 2026-04-22 15:45:38 +02:00
p9100.c fbdev: Constify struct sbus_mmap_map 2024-10-15 10:07:32 +02:00
platinumfb.c fbdev: Switch back to struct platform_driver::remove() 2024-10-08 21:47:18 +02:00
platinumfb.h
pm2fb.c fbdev: pm2fb: unwind WC setup on probe failure 2026-06-25 14:05:05 +02:00
pm3fb.c fbdev: Consistently define pci_device_ids using named initializers 2026-06-07 18:25:41 +02:00
pmag-aa-fb.c fbdev/pmag-aa-fb: Use fbdev I/O helpers 2023-08-04 15:54:37 +02:00
pmag-ba-fb.c fbdev/pmag-ba-fb: Use fbdev I/O helpers 2023-08-04 15:54:37 +02:00
pmagb-b-fb.c fbdev/pmagb-b-fb: Use fbdev I/O helpers 2023-08-04 15:54:37 +02:00
ps3fb.c fbdev: Wrap user-invoked calls to fb_set_var() in helper 2026-06-09 16:00:10 +02:00
pvr2fb.c fbdev: Consistently define pci_device_ids using named initializers 2026-06-07 18:25:41 +02:00
pxa3xx-gcu.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
pxa3xx-gcu.h
pxa3xx-regs.h
pxa168fb.c fbdev: pxa168fb: use devm_ioremap_resource() for MMIO 2026-06-09 16:00:10 +02:00
pxa168fb.h
pxafb.c fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing 2025-12-02 19:49:10 +01:00
pxafb.h
q40fb.c fbdev/q40fb: Use fbdev I/O helpers 2023-08-04 15:54:38 +02:00
s1d13xxxfb.c fbdev: Switch back to struct platform_driver::remove() 2024-10-08 21:47:18 +02:00
s3c-fb.c fbdev: Switch back to struct platform_driver::remove() 2024-10-08 21:47:18 +02:00
s3fb.c fbdev: s3fb: Use strscpy() to copy strings into arrays 2026-06-09 16:06:07 +02:00
sa1100fb.c fbdev: Push pgprot_decrypted() into mmap implementations 2023-11-29 12:20:44 +01:00
sa1100fb.h
sbuslib.c fbdev: Include <linux/export.h> 2025-06-16 09:06:19 +02:00
sbuslib.h fbdev: Constify struct sbus_mmap_map 2024-10-15 10:07:32 +02:00
sh_mobile_lcdcfb.c fbdev: Wrap user-invoked calls to fb_set_var() in helper 2026-06-09 16:00:10 +02:00
sh_mobile_lcdcfb.h
sh7760fb.c fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() 2024-11-14 15:26:27 +01:00
simplefb.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
skeletonfb.c fbdev: Remove FBINFO_DEFAULT from framebuffer_alloc()'ed structs 2023-07-24 16:50:38 +02:00
sm501fb.c fbdev: sm501fb: Fix buffer errors in OF binding code 2026-06-09 16:00:17 +02:00
sm712.h fbdev: sm712: Fix operator precedence in big_swap macro 2026-06-09 16:00:10 +02:00
sm712fb.c fbdev/sm712fb: Use correct initializer macros for struct fb_ops 2023-11-29 12:20:10 +01:00
smscufx.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
ssd1307fb.c fbdev: matroxfb/ssd1307fb: Use named initializers for struct i2c_device_id 2026-06-07 18:25:41 +02:00
sstfb.c fbdev: sstfb: Make CONFIG_FB_DEVICE optional 2024-10-15 10:07:31 +02:00
stifb.c fbdev: stifb: Fix crash in stifb_blank() 2024-01-23 09:13:24 +01:00
sunxvr500.c fbdev/sunxvr500: Initialize fb_ops to fbdev I/O-memory helpers 2023-10-19 12:56:55 +02:00
sunxvr1000.c Linux 6.5-rc7 2023-08-24 07:26:06 +10:00
sunxvr2500.c fbdev: sunxvr2500: replace printk with device-aware logging functions 2026-06-09 16:00:10 +02:00
tcx.c fbdev: tcx.c fix mem_map to correct smem_start offset 2025-12-02 19:44:05 +01:00
tdfxfb.c fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() 2026-06-07 18:25:42 +02:00
tgafb.c vt: remove superfluous CONFIG_HW_CONSOLE 2024-01-27 19:03:51 -08:00
tridentfb.c fbdev: tridentfb: fix potential memory leak in trident_pci_probe() 2026-06-07 18:25:42 +02:00
udlfb.c fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free 2026-05-04 10:35:55 +02:00
uvesafb.c fbdev: uvesafb: fix potential memory leak in uvesafb_probe() 2026-06-07 18:25:42 +02:00
valkyriefb.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
valkyriefb.h
vesafb.c fbdev: vesafb: fix memory leak in vesafb_probe() 2026-06-07 18:25:42 +02:00
vfb.c fbdev: Switch back to struct platform_driver::remove() 2024-10-08 21:47:18 +02:00
vga16fb.c fbdev: vga16fb: Drop unused assignment of platform_device_id driver data 2026-06-23 09:58:58 +02:00
vt8500lcdfb.c fbdev: vt8500lcdfb: fix missing dma_free_coherent() 2026-02-14 11:09:46 +01:00
vt8500lcdfb.h
vt8623fb.c fbdev: Consistently define pci_device_ids using named initializers 2026-06-07 18:25:41 +02:00
wm8505fb_regs.h
wm8505fb.c fbdev: Switch back to struct platform_driver::remove() 2024-10-08 21:47:18 +02:00
wmt_ge_rops.c fbdev: wmt_ge_rops: use devm_platform_ioremap_resource() 2026-03-09 13:06:48 +01:00
wmt_ge_rops.h
xen-fbfront.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
xilinxfb.c fbdev: Switch back to struct platform_driver::remove() 2024-10-08 21:47:18 +02:00