Re: [PATCH v2 2/3] fbcon: Rebuild rotated font buffer on font change

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] fbcon: hardware tileblitting desync on set_font error path
--

commit 4bfab26c62faf08e2aeace132c9263da4258cec4
Author: Yao Yiqi <yyaqia@gmail.com>

fbcon: Rebuild rotated font buffer on font change

Rebuilds the rotated font buffer for the visible console when the font is 
changed, preventing an out-of-bounds read if the new font size differs. 
Selects the console blitting state via set_blitting_type() before rotation, 
and rebuilds the rotated font again on the error path if vc_resize() fails.

> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
> index 01715873ea49b..1a2fe9fc1dc2a 100644
> --- a/drivers/video/fbdev/core/fbcon.c
> +++ b/drivers/video/fbdev/core/fbcon.c

[ ... ]

> @@ -2466,6 +2477,14 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
>  	else if (!old_hi_font_mask && vc->vc_hi_font_mask)
>  		set_vc_hi_font(vc, false);
>  
> +	/*
> +	 * The rotated font buffer was rebuilt for the new font before
> +	 * vc_resize() was attempted. Call rotate_font() again to
> +	 * overwrite par->rotated with the restored font's state.
> +	 */
> +	if (con_is_visible(vc) && par->bitops->rotate_font)
> +		par->bitops->rotate_font(info, vc);
> +

[Severity: Medium]
When vc_resize() fails, this error path successfully restores the software
font state and rotated buffer, but does this leave the hardware tileblitting 
engine out of sync?

Earlier in fbcon_do_set_font(), set_blitting_type() is called to configure
the hardware with the new font's dimensions. Since set_blitting_type() isn't 
called again here to revert the hardware state, it seems the tile engine 
could remain programmed with the rejected font dimensions while the software 
console reverts to the old font. Could this lead to screen corruption or 
hardware bounds mismatches?

>  	font_data_put(data);
>  
>  	return ret;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261016034533.445862-1-yaoyiqi3@huawei.com?part=2