Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs

["chenjun (AM)" <chenjun102@huawei.com>]

在 2026/2/27 23:56, Thomas Zimmermann 写道:
> Hi,
> 
> thanks for the patch.
> 
> Am 27.02.26 um 15:43 schrieb Chen Jun:
>> When a font is set on an invisible console, the screen will not update.
>> However, the fontbuffer is not updated to match the new font dimensions.
> 
> I looked through vc_resize() but cannot quite find the logic that calls
> fbcon_rotate_font(). Can you please point to correct place?
> 
> Best regards
> Thomas
> 

Hi, fbcon_rouate_font is called in fbcon_switch

[   64.669554] CPU: 3 UID: 0 PID: 978 Comm: a.out Not tainted 
7.0.0-rc1-00021-gd9d32e5bd5a4-dirty #10 PREEMPT(lazy)
[   64.669576] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), 
BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/4
[   64.669584] Call Trace: 

[   64.669589]  <TASK> 

[   64.669595]  dump_stack_lvl+0x53/0x70 

[   64.669615]  fbcon_rotate_font+0x2d6/0xe90 

[   64.669636]  ? kfree+0x159/0x3b0 

[   64.669650]  ? ud_cursor+0x830/0x1d80 

[   64.669661]  ? __kmalloc_noprof+0x198/0x4a0 

[   64.669674]  fbcon_switch+0x67b/0x10f0 

[   64.669689]  ? __pfx_fbcon_switch+0x10/0x10 

[   64.669708]  ? con_is_visible+0xb0/0x130 

[   64.669723]  redraw_screen+0x258/0x690 

[   64.669736]  ? mutex_unlock+0x7d/0xd0 

[   64.669751]  ? __pfx_redraw_screen+0x10/0x10 

[   64.669764]  ? tty_get_pgrp+0x73/0xb0 

[   64.669784]  vc_do_resize+0x9a5/0xec0 

[   64.669803]  ? __pfx_vc_do_resize+0x10/0x10 

[   64.669815]  ? kernel_fpu_begin_mask+0x1c5/0x210 

[   64.669832]  ? __pfx_kernel_fpu_begin_mask+0x10/0x10 

[   64.669843]  ? fbcon_set_font+0x2cb/0x8c0 

[   64.669853]  ? __kasan_kmalloc_large+0x81/0xa0 

[   64.669863]  ? __kmalloc_large_node_noprof+0x18/0xb0 

[   64.669874]  fbcon_do_set_font+0x390/0xa70 

[   64.669890]  ? __pfx_fbcon_set_font+0x10/0x10 

[   64.669900]  con_font_op+0x7d5/0xc30 

[   64.669910]  ? arch_stack_walk+0x9f/0xf0 

[   64.669924]  ? __pfx_con_font_op+0x10/0x10 

[   64.669940]  vt_ioctl+0x8ee/0x2480 

[   64.669953]  ? __pfx_vt_ioctl+0x10/0x10 

[   64.669964]  ? __x64_sys_open+0x79/0xc0 

[   64.669976]  ? do_syscall_64+0xfa/0x570 

[   64.669986]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f 

[   64.669996]  ? __pfx_path_openat+0x10/0x10 

[   64.670006]  ? __pfx_avc_has_extended_perms+0x10/0x10 

[   64.670022]  ? _raw_spin_lock+0x7f/0xd0 

[   64.670040]  ? do_file_open+0x22f/0x2b0 

[   64.670048]  ? pte_offset_map_lock+0xe2/0x1e0 

[   64.670070]  ? __pfx_do_file_open+0x10/0x10 

[   64.670082]  tty_ioctl+0x3e7/0x1190 

[   64.670098]  ? __pfx_tty_ioctl+0x10/0x10 

[   64.670109]  ? __pfx_do_vfs_ioctl+0x10/0x10 

[   64.670124]  ? ioctl_has_perm.constprop.74+0x2e1/0x4f0 

[   64.670137]  ? __pfx_ioctl_has_perm.constprop.74+0x10/0x10 

[   64.670148]  ? __pfx_do_sys_openat2+0x10/0x10 

[   64.670191]  __x64_sys_ioctl+0x130/0x1a0 

[   64.670204]  do_syscall_64+0xfa/0x570 

[   64.670214]  entry_SYSCALL_64_after_hwframe+0x77/0x7f 

[   64.670223] RIP: 0033:0x7ff56cb0c577 

[   64.670233] Code: b3 66 90 48 8b 05 11 89 2c 00 64 c7 00 26 00 00 00 
48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 8
[   64.670242] RSP: 002b:00007fff94ab6a48 EFLAGS: 00000206 ORIG_RAX: 
0000000000000010
[   64.670256] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 
00007ff56cb0c577
[   64.670263] RDX: 00007fff94ab6a60 RSI: 0000000000004b72 RDI: 
0000000000000003
[   64.670269] RBP: 00007fff94ab6af0 R08: 000055bf68e008d0 R09: 
00007ff56cdec090
[   64.670275] R10: 0000000000000000 R11: 0000000000000206 R12: 
000055bf68e00630
[   64.670281] R13: 00007fff94ab6be0 R14: 0000000000000000 R15: 
0000000000000000
[   64.670293]  </TASK> 


>>
>> This inconsistency leads to out-of-bounds memory access when writing to
>> the tty bound to fbcon, as demonstrated by the following KASAN report:
>>
>> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
>> Read of size 1 at addr ffff8881195a2280 by task a.out/971
>> Call Trace:
>>    <TASK>
>>    fb_pad_aligned_buffer+0xdf/0x140
>>    ud_putcs+0x88a/0xde0
>>    fbcon_putcs+0x319/0x430
>>    do_update_region+0x23c/0x3b0
>>    do_con_write+0x225c/0x67f0
>>    con_write+0xe/0x30
>>    n_tty_write+0x4b5/0xff0
>>    file_tty_write.isra.41+0x46c/0x880
>>    vfs_write+0x868/0xd60
>>    ksys_write+0xf2/0x1d0
>>    do_syscall_64+0xfa/0x570
>>
>> Fix this by calling fbcon_rotate_font() if vc is invisible in
>> fbcon_do_set_font().
>>
>> Signed-off-by: Chen Jun <chenjun102@huawei.com>
>> ---
>>    drivers/video/fbdev/core/fbcon.c | 5 +++++
>>    1 file changed, 5 insertions(+)
>>
>> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
>> index 666261ae59d8..d76100188bee 100644
>> --- a/drivers/video/fbdev/core/fbcon.c
>> +++ b/drivers/video/fbdev/core/fbcon.c
>> @@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
>>    		rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
>>    		cols /= w;
>>    		rows /= h;
>> +		if (!con_is_visible(vc)) {
>> +			ret = fbcon_rotate_font(info, vc);
>> +			if (ret)
>> +				goto err_out;
>> +		}
>>    		ret = vc_resize(vc, cols, rows);
>>    		if (ret)
>>    			goto err_out;
>