[RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs

[RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs

[Chen Jun]

When a font is set on an invisible console, the screen will not update.
However, the fontbuffer is not updated to match the new font dimensions.

This inconsistency leads to out-of-bounds memory access when writing to
the tty bound to fbcon, as demonstrated by the following KASAN report:

BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
Read of size 1 at addr ffff8881195a2280 by task a.out/971
Call Trace:
 <TASK>
 fb_pad_aligned_buffer+0xdf/0x140
 ud_putcs+0x88a/0xde0
 fbcon_putcs+0x319/0x430
 do_update_region+0x23c/0x3b0
 do_con_write+0x225c/0x67f0
 con_write+0xe/0x30
 n_tty_write+0x4b5/0xff0
 file_tty_write.isra.41+0x46c/0x880
 vfs_write+0x868/0xd60
 ksys_write+0xf2/0x1d0
 do_syscall_64+0xfa/0x570

Fix this by calling fbcon_rotate_font() if vc is invisible in
fbcon_do_set_font().

Signed-off-by: Chen Jun <chenjun102@huawei.com>
---
 drivers/video/fbdev/core/fbcon.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 666261ae59d8..d76100188bee 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
 		rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
 		cols /= w;
 		rows /= h;
+		if (!con_is_visible(vc)) {
+			ret = fbcon_rotate_font(info, vc);
+			if (ret)
+				goto err_out;
+		}
 		ret = vc_resize(vc, cols, rows);
 		if (ret)
 			goto err_out;
-- 
2.22.0

Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs

[chenjun (AM)]

在 2026/2/27 22:50, chenjun (AM) 写道:
> When a font is set on an invisible console, the screen will not update.
> However, the fontbuffer is not updated to match the new font dimensions.
> 
> This inconsistency leads to out-of-bounds memory access when writing to
> the tty bound to fbcon, as demonstrated by the following KASAN report:
> 
> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
> Read of size 1 at addr ffff8881195a2280 by task a.out/971
> Call Trace:
>   <TASK>
>   fb_pad_aligned_buffer+0xdf/0x140
>   ud_putcs+0x88a/0xde0
>   fbcon_putcs+0x319/0x430
>   do_update_region+0x23c/0x3b0
>   do_con_write+0x225c/0x67f0
>   con_write+0xe/0x30
>   n_tty_write+0x4b5/0xff0
>   file_tty_write.isra.41+0x46c/0x880
>   vfs_write+0x868/0xd60
>   ksys_write+0xf2/0x1d0
>   do_syscall_64+0xfa/0x570
> 
> Fix this by calling fbcon_rotate_font() if vc is invisible in
> fbcon_do_set_font().
> 
> Signed-off-by: Chen Jun <chenjun102@huawei.com>
> ---
>   drivers/video/fbdev/core/fbcon.c | 5 +++++
>   1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
> index 666261ae59d8..d76100188bee 100644
> --- a/drivers/video/fbdev/core/fbcon.c
> +++ b/drivers/video/fbdev/core/fbcon.c
> @@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
>   		rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
>   		cols /= w;
>   		rows /= h;
> +		if (!con_is_visible(vc)) {
> +			ret = fbcon_rotate_font(info, vc);
> +			if (ret)
> +				goto err_out;
> +		}
>   		ret = vc_resize(vc, cols, rows);
>   		if (ret)
>   			goto err_out;
> 

There is a poc:
```
#define _GNU_SOURCE

#include <errno.h>
#include <fcntl.h>
#include <stdlib.h>
#include <unistd.h>
#include <stdint.h>
#include <sys/ioctl.h>

#include <linux/capability.h>

char my_font_data[512 * 1 * 32 * 32];

struct console_font_op {
         unsigned int op;
         unsigned int flags;
         unsigned int width, height;
         unsigned int charcount;
         unsigned char *data;
};

void execute_one(void)
{
   int tty = open("/dev/tty2", O_APPEND|O_RDWR, 0);
   char buf[100] = {27, '#', '8', 0xa, 0x5, 0x5, 0x5, 0x5};
   struct console_font_op op = {
         .op = 0,
         .width = 32,
         .height = 32,
         .charcount = 512,
         .data = my_font_data,
   };

   ioctl(tty, 0x4B72, &op);
   write(tty, buf, 100);
}
int main(void)
{
   execute_one();
   return 0;
}
```
echo 2 > /sys/class/graphics/fbcon/rotate_all
./poc

Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs

[Thomas Zimmermann]

Hi,

thanks for the patch.

Am 27.02.26 um 15:43 schrieb Chen Jun:
> When a font is set on an invisible console, the screen will not update.
> However, the fontbuffer is not updated to match the new font dimensions.

I looked through vc_resize() but cannot quite find the logic that calls 
fbcon_rotate_font(). Can you please point to correct place?

Best regards
Thomas

>
> This inconsistency leads to out-of-bounds memory access when writing to
> the tty bound to fbcon, as demonstrated by the following KASAN report:
>
> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
> Read of size 1 at addr ffff8881195a2280 by task a.out/971
> Call Trace:
>   <TASK>
>   fb_pad_aligned_buffer+0xdf/0x140
>   ud_putcs+0x88a/0xde0
>   fbcon_putcs+0x319/0x430
>   do_update_region+0x23c/0x3b0
>   do_con_write+0x225c/0x67f0
>   con_write+0xe/0x30
>   n_tty_write+0x4b5/0xff0
>   file_tty_write.isra.41+0x46c/0x880
>   vfs_write+0x868/0xd60
>   ksys_write+0xf2/0x1d0
>   do_syscall_64+0xfa/0x570
>
> Fix this by calling fbcon_rotate_font() if vc is invisible in
> fbcon_do_set_font().
>
> Signed-off-by: Chen Jun <chenjun102@huawei.com>
> ---
>   drivers/video/fbdev/core/fbcon.c | 5 +++++
>   1 file changed, 5 insertions(+)
>
> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
> index 666261ae59d8..d76100188bee 100644
> --- a/drivers/video/fbdev/core/fbcon.c
> +++ b/drivers/video/fbdev/core/fbcon.c
> @@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
>   		rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
>   		cols /= w;
>   		rows /= h;
> +		if (!con_is_visible(vc)) {
> +			ret = fbcon_rotate_font(info, vc);
> +			if (ret)
> +				goto err_out;
> +		}
>   		ret = vc_resize(vc, cols, rows);
>   		if (ret)
>   			goto err_out;

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)

Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs

[chenjun (AM)]

在 2026/2/27 23:56, Thomas Zimmermann 写道:
> Hi,
> 
> thanks for the patch.
> 
> Am 27.02.26 um 15:43 schrieb Chen Jun:
>> When a font is set on an invisible console, the screen will not update.
>> However, the fontbuffer is not updated to match the new font dimensions.
> 
> I looked through vc_resize() but cannot quite find the logic that calls
> fbcon_rotate_font(). Can you please point to correct place?
> 
> Best regards
> Thomas
> 

Hi, fbcon_rouate_font is called in fbcon_switch

[   64.669554] CPU: 3 UID: 0 PID: 978 Comm: a.out Not tainted 
7.0.0-rc1-00021-gd9d32e5bd5a4-dirty #10 PREEMPT(lazy)
[   64.669576] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), 
BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/4
[   64.669584] Call Trace: 

[   64.669589]  <TASK> 

[   64.669595]  dump_stack_lvl+0x53/0x70 

[   64.669615]  fbcon_rotate_font+0x2d6/0xe90 

[   64.669636]  ? kfree+0x159/0x3b0 

[   64.669650]  ? ud_cursor+0x830/0x1d80 

[   64.669661]  ? __kmalloc_noprof+0x198/0x4a0 

[   64.669674]  fbcon_switch+0x67b/0x10f0 

[   64.669689]  ? __pfx_fbcon_switch+0x10/0x10 

[   64.669708]  ? con_is_visible+0xb0/0x130 

[   64.669723]  redraw_screen+0x258/0x690 

[   64.669736]  ? mutex_unlock+0x7d/0xd0 

[   64.669751]  ? __pfx_redraw_screen+0x10/0x10 

[   64.669764]  ? tty_get_pgrp+0x73/0xb0 

[   64.669784]  vc_do_resize+0x9a5/0xec0 

[   64.669803]  ? __pfx_vc_do_resize+0x10/0x10 

[   64.669815]  ? kernel_fpu_begin_mask+0x1c5/0x210 

[   64.669832]  ? __pfx_kernel_fpu_begin_mask+0x10/0x10 

[   64.669843]  ? fbcon_set_font+0x2cb/0x8c0 

[   64.669853]  ? __kasan_kmalloc_large+0x81/0xa0 

[   64.669863]  ? __kmalloc_large_node_noprof+0x18/0xb0 

[   64.669874]  fbcon_do_set_font+0x390/0xa70 

[   64.669890]  ? __pfx_fbcon_set_font+0x10/0x10 

[   64.669900]  con_font_op+0x7d5/0xc30 

[   64.669910]  ? arch_stack_walk+0x9f/0xf0 

[   64.669924]  ? __pfx_con_font_op+0x10/0x10 

[   64.669940]  vt_ioctl+0x8ee/0x2480 

[   64.669953]  ? __pfx_vt_ioctl+0x10/0x10 

[   64.669964]  ? __x64_sys_open+0x79/0xc0 

[   64.669976]  ? do_syscall_64+0xfa/0x570 

[   64.669986]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f 

[   64.669996]  ? __pfx_path_openat+0x10/0x10 

[   64.670006]  ? __pfx_avc_has_extended_perms+0x10/0x10 

[   64.670022]  ? _raw_spin_lock+0x7f/0xd0 

[   64.670040]  ? do_file_open+0x22f/0x2b0 

[   64.670048]  ? pte_offset_map_lock+0xe2/0x1e0 

[   64.670070]  ? __pfx_do_file_open+0x10/0x10 

[   64.670082]  tty_ioctl+0x3e7/0x1190 

[   64.670098]  ? __pfx_tty_ioctl+0x10/0x10 

[   64.670109]  ? __pfx_do_vfs_ioctl+0x10/0x10 

[   64.670124]  ? ioctl_has_perm.constprop.74+0x2e1/0x4f0 

[   64.670137]  ? __pfx_ioctl_has_perm.constprop.74+0x10/0x10 

[   64.670148]  ? __pfx_do_sys_openat2+0x10/0x10 

[   64.670191]  __x64_sys_ioctl+0x130/0x1a0 

[   64.670204]  do_syscall_64+0xfa/0x570 

[   64.670214]  entry_SYSCALL_64_after_hwframe+0x77/0x7f 

[   64.670223] RIP: 0033:0x7ff56cb0c577 

[   64.670233] Code: b3 66 90 48 8b 05 11 89 2c 00 64 c7 00 26 00 00 00 
48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 8
[   64.670242] RSP: 002b:00007fff94ab6a48 EFLAGS: 00000206 ORIG_RAX: 
0000000000000010
[   64.670256] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 
00007ff56cb0c577
[   64.670263] RDX: 00007fff94ab6a60 RSI: 0000000000004b72 RDI: 
0000000000000003
[   64.670269] RBP: 00007fff94ab6af0 R08: 000055bf68e008d0 R09: 
00007ff56cdec090
[   64.670275] R10: 0000000000000000 R11: 0000000000000206 R12: 
000055bf68e00630
[   64.670281] R13: 00007fff94ab6be0 R14: 0000000000000000 R15: 
0000000000000000
[   64.670293]  </TASK> 


>>
>> This inconsistency leads to out-of-bounds memory access when writing to
>> the tty bound to fbcon, as demonstrated by the following KASAN report:
>>
>> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
>> Read of size 1 at addr ffff8881195a2280 by task a.out/971
>> Call Trace:
>>    <TASK>
>>    fb_pad_aligned_buffer+0xdf/0x140
>>    ud_putcs+0x88a/0xde0
>>    fbcon_putcs+0x319/0x430
>>    do_update_region+0x23c/0x3b0
>>    do_con_write+0x225c/0x67f0
>>    con_write+0xe/0x30
>>    n_tty_write+0x4b5/0xff0
>>    file_tty_write.isra.41+0x46c/0x880
>>    vfs_write+0x868/0xd60
>>    ksys_write+0xf2/0x1d0
>>    do_syscall_64+0xfa/0x570
>>
>> Fix this by calling fbcon_rotate_font() if vc is invisible in
>> fbcon_do_set_font().
>>
>> Signed-off-by: Chen Jun <chenjun102@huawei.com>
>> ---
>>    drivers/video/fbdev/core/fbcon.c | 5 +++++
>>    1 file changed, 5 insertions(+)
>>
>> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
>> index 666261ae59d8..d76100188bee 100644
>> --- a/drivers/video/fbdev/core/fbcon.c
>> +++ b/drivers/video/fbdev/core/fbcon.c
>> @@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
>>    		rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
>>    		cols /= w;
>>    		rows /= h;
>> +		if (!con_is_visible(vc)) {
>> +			ret = fbcon_rotate_font(info, vc);
>> +			if (ret)
>> +				goto err_out;
>> +		}
>>    		ret = vc_resize(vc, cols, rows);
>>    		if (ret)
>>    			goto err_out;
> 

Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs

[Thomas Zimmermann]

Hi

Am 28.02.26 um 02:53 schrieb chenjun (AM):
> 在 2026/2/27 23:56, Thomas Zimmermann 写道:
>> Hi,
>>
>> thanks for the patch.
>>
>> Am 27.02.26 um 15:43 schrieb Chen Jun:
>>> When a font is set on an invisible console, the screen will not update.
>>> However, the fontbuffer is not updated to match the new font dimensions.
>> I looked through vc_resize() but cannot quite find the logic that calls
>> fbcon_rotate_font(). Can you please point to correct place?
>>
>> Best regards
>> Thomas
>>
> Hi, fbcon_rouate_font is called in fbcon_switch
>
> [   64.669554] CPU: 3 UID: 0 PID: 978 Comm: a.out Not tainted
> 7.0.0-rc1-00021-gd9d32e5bd5a4-dirty #10 PREEMPT(lazy)
> [   64.669576] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
> BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/4
> [   64.669584] Call Trace:
>
> [   64.669589]  <TASK>
>
> [   64.669595]  dump_stack_lvl+0x53/0x70
>
> [   64.669615]  fbcon_rotate_font+0x2d6/0xe90
>
> [   64.669636]  ? kfree+0x159/0x3b0
>
> [   64.669650]  ? ud_cursor+0x830/0x1d80
>
> [   64.669661]  ? __kmalloc_noprof+0x198/0x4a0
>
> [   64.669674]  fbcon_switch+0x67b/0x10f0
>
> [   64.669689]  ? __pfx_fbcon_switch+0x10/0x10
>
> [   64.669708]  ? con_is_visible+0xb0/0x130
>
> [   64.669723]  redraw_screen+0x258/0x690

Thanks. Somehow I made a wrong turn in redraw_screen()

Best regards
Thomas

>
> [   64.669736]  ? mutex_unlock+0x7d/0xd0
>
> [   64.669751]  ? __pfx_redraw_screen+0x10/0x10
>
> [   64.669764]  ? tty_get_pgrp+0x73/0xb0
>
> [   64.669784]  vc_do_resize+0x9a5/0xec0
>
> [   64.669803]  ? __pfx_vc_do_resize+0x10/0x10
>
> [   64.669815]  ? kernel_fpu_begin_mask+0x1c5/0x210
>
> [   64.669832]  ? __pfx_kernel_fpu_begin_mask+0x10/0x10
>
> [   64.669843]  ? fbcon_set_font+0x2cb/0x8c0
>
> [   64.669853]  ? __kasan_kmalloc_large+0x81/0xa0
>
> [   64.669863]  ? __kmalloc_large_node_noprof+0x18/0xb0
>
> [   64.669874]  fbcon_do_set_font+0x390/0xa70
>
> [   64.669890]  ? __pfx_fbcon_set_font+0x10/0x10
>
> [   64.669900]  con_font_op+0x7d5/0xc30
>
> [   64.669910]  ? arch_stack_walk+0x9f/0xf0
>
> [   64.669924]  ? __pfx_con_font_op+0x10/0x10
>
> [   64.669940]  vt_ioctl+0x8ee/0x2480
>
> [   64.669953]  ? __pfx_vt_ioctl+0x10/0x10
>
> [   64.669964]  ? __x64_sys_open+0x79/0xc0
>
> [   64.669976]  ? do_syscall_64+0xfa/0x570
>
> [   64.669986]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> [   64.669996]  ? __pfx_path_openat+0x10/0x10
>
> [   64.670006]  ? __pfx_avc_has_extended_perms+0x10/0x10
>
> [   64.670022]  ? _raw_spin_lock+0x7f/0xd0
>
> [   64.670040]  ? do_file_open+0x22f/0x2b0
>
> [   64.670048]  ? pte_offset_map_lock+0xe2/0x1e0
>
> [   64.670070]  ? __pfx_do_file_open+0x10/0x10
>
> [   64.670082]  tty_ioctl+0x3e7/0x1190
>
> [   64.670098]  ? __pfx_tty_ioctl+0x10/0x10
>
> [   64.670109]  ? __pfx_do_vfs_ioctl+0x10/0x10
>
> [   64.670124]  ? ioctl_has_perm.constprop.74+0x2e1/0x4f0
>
> [   64.670137]  ? __pfx_ioctl_has_perm.constprop.74+0x10/0x10
>
> [   64.670148]  ? __pfx_do_sys_openat2+0x10/0x10
>
> [   64.670191]  __x64_sys_ioctl+0x130/0x1a0
>
> [   64.670204]  do_syscall_64+0xfa/0x570
>
> [   64.670214]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> [   64.670223] RIP: 0033:0x7ff56cb0c577
>
> [   64.670233] Code: b3 66 90 48 8b 05 11 89 2c 00 64 c7 00 26 00 00 00
> 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 8
> [   64.670242] RSP: 002b:00007fff94ab6a48 EFLAGS: 00000206 ORIG_RAX:
> 0000000000000010
> [   64.670256] RAX: ffffffffffffffda RBX: 0000000000000000 RCX:
> 00007ff56cb0c577
> [   64.670263] RDX: 00007fff94ab6a60 RSI: 0000000000004b72 RDI:
> 0000000000000003
> [   64.670269] RBP: 00007fff94ab6af0 R08: 000055bf68e008d0 R09:
> 00007ff56cdec090
> [   64.670275] R10: 0000000000000000 R11: 0000000000000206 R12:
> 000055bf68e00630
> [   64.670281] R13: 00007fff94ab6be0 R14: 0000000000000000 R15:
> 0000000000000000
> [   64.670293]  </TASK>
>
>
>>> This inconsistency leads to out-of-bounds memory access when writing to
>>> the tty bound to fbcon, as demonstrated by the following KASAN report:
>>>
>>> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
>>> Read of size 1 at addr ffff8881195a2280 by task a.out/971
>>> Call Trace:
>>>     <TASK>
>>>     fb_pad_aligned_buffer+0xdf/0x140
>>>     ud_putcs+0x88a/0xde0
>>>     fbcon_putcs+0x319/0x430
>>>     do_update_region+0x23c/0x3b0
>>>     do_con_write+0x225c/0x67f0
>>>     con_write+0xe/0x30
>>>     n_tty_write+0x4b5/0xff0
>>>     file_tty_write.isra.41+0x46c/0x880
>>>     vfs_write+0x868/0xd60
>>>     ksys_write+0xf2/0x1d0
>>>     do_syscall_64+0xfa/0x570
>>>
>>> Fix this by calling fbcon_rotate_font() if vc is invisible in
>>> fbcon_do_set_font().
>>>
>>> Signed-off-by: Chen Jun <chenjun102@huawei.com>
>>> ---
>>>     drivers/video/fbdev/core/fbcon.c | 5 +++++
>>>     1 file changed, 5 insertions(+)
>>>
>>> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
>>> index 666261ae59d8..d76100188bee 100644
>>> --- a/drivers/video/fbdev/core/fbcon.c
>>> +++ b/drivers/video/fbdev/core/fbcon.c
>>> @@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
>>>     		rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
>>>     		cols /= w;
>>>     		rows /= h;
>>> +		if (!con_is_visible(vc)) {
>>> +			ret = fbcon_rotate_font(info, vc);
>>> +			if (ret)
>>> +				goto err_out;
>>> +		}
>>>     		ret = vc_resize(vc, cols, rows);
>>>     		if (ret)
>>>     			goto err_out;
>

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)

Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs

[Thomas Zimmermann]

Am 27.02.26 um 15:43 schrieb Chen Jun:
> When a font is set on an invisible console, the screen will not update.
> However, the fontbuffer is not updated to match the new font dimensions.
>
> This inconsistency leads to out-of-bounds memory access when writing to
> the tty bound to fbcon, as demonstrated by the following KASAN report:
>
> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
> Read of size 1 at addr ffff8881195a2280 by task a.out/971
> Call Trace:
>   <TASK>
>   fb_pad_aligned_buffer+0xdf/0x140
>   ud_putcs+0x88a/0xde0
>   fbcon_putcs+0x319/0x430
>   do_update_region+0x23c/0x3b0
>   do_con_write+0x225c/0x67f0
>   con_write+0xe/0x30
>   n_tty_write+0x4b5/0xff0
>   file_tty_write.isra.41+0x46c/0x880
>   vfs_write+0x868/0xd60
>   ksys_write+0xf2/0x1d0
>   do_syscall_64+0xfa/0x570
>
> Fix this by calling fbcon_rotate_font() if vc is invisible in
> fbcon_do_set_font().
>
> Signed-off-by: Chen Jun <chenjun102@huawei.com>

Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>

> ---
>   drivers/video/fbdev/core/fbcon.c | 5 +++++
>   1 file changed, 5 insertions(+)
>
> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
> index 666261ae59d8..d76100188bee 100644
> --- a/drivers/video/fbdev/core/fbcon.c
> +++ b/drivers/video/fbdev/core/fbcon.c
> @@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
>   		rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
>   		cols /= w;
>   		rows /= h;
> +		if (!con_is_visible(vc)) {
> +			ret = fbcon_rotate_font(info, vc);
> +			if (ret)
> +				goto err_out;
> +		}
>   		ret = vc_resize(vc, cols, rows);
>   		if (ret)
>   			goto err_out;

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)

Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs

[chenjun (AM)]

在 2026/3/2 18:19, Thomas Zimmermann 写道:
> 
> 
> Am 27.02.26 um 15:43 schrieb Chen Jun:
>> When a font is set on an invisible console, the screen will not update.
>> However, the fontbuffer is not updated to match the new font dimensions.
>>
>> This inconsistency leads to out-of-bounds memory access when writing to
>> the tty bound to fbcon, as demonstrated by the following KASAN report:
>>
>> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
>> Read of size 1 at addr ffff8881195a2280 by task a.out/971
>> Call Trace:
>>    <TASK>
>>    fb_pad_aligned_buffer+0xdf/0x140
>>    ud_putcs+0x88a/0xde0
>>    fbcon_putcs+0x319/0x430
>>    do_update_region+0x23c/0x3b0
>>    do_con_write+0x225c/0x67f0
>>    con_write+0xe/0x30
>>    n_tty_write+0x4b5/0xff0
>>    file_tty_write.isra.41+0x46c/0x880
>>    vfs_write+0x868/0xd60
>>    ksys_write+0xf2/0x1d0
>>    do_syscall_64+0xfa/0x570
>>
>> Fix this by calling fbcon_rotate_font() if vc is invisible in
>> fbcon_do_set_font().
>>
>> Signed-off-by: Chen Jun <chenjun102@huawei.com>
> 
> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>

Hi Thomas,

Thanks for your review.

I'm not familiar with the fbcon module. Is there a better way to fix this?

>> ---
>>    drivers/video/fbdev/core/fbcon.c | 5 +++++
>>    1 file changed, 5 insertions(+)
>>
>> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
>> index 666261ae59d8..d76100188bee 100644
>> --- a/drivers/video/fbdev/core/fbcon.c
>> +++ b/drivers/video/fbdev/core/fbcon.c
>> @@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
>>    		rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
>>    		cols /= w;
>>    		rows /= h;
>> +		if (!con_is_visible(vc)) {
>> +			ret = fbcon_rotate_font(info, vc);
>> +			if (ret)
>> +				goto err_out;
>> +		}
>>    		ret = vc_resize(vc, cols, rows);
>>    		if (ret)
>>    			goto err_out;
> 

Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs

[Thomas Zimmermann]

Hi

Am 02.03.26 um 12:24 schrieb chenjun (AM):
> 在 2026/3/2 18:19, Thomas Zimmermann 写道:
>>
>> Am 27.02.26 um 15:43 schrieb Chen Jun:
>>> When a font is set on an invisible console, the screen will not update.
>>> However, the fontbuffer is not updated to match the new font dimensions.
>>>
>>> This inconsistency leads to out-of-bounds memory access when writing to
>>> the tty bound to fbcon, as demonstrated by the following KASAN report:
>>>
>>> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
>>> Read of size 1 at addr ffff8881195a2280 by task a.out/971
>>> Call Trace:
>>>     <TASK>
>>>     fb_pad_aligned_buffer+0xdf/0x140
>>>     ud_putcs+0x88a/0xde0
>>>     fbcon_putcs+0x319/0x430
>>>     do_update_region+0x23c/0x3b0
>>>     do_con_write+0x225c/0x67f0
>>>     con_write+0xe/0x30
>>>     n_tty_write+0x4b5/0xff0
>>>     file_tty_write.isra.41+0x46c/0x880
>>>     vfs_write+0x868/0xd60
>>>     ksys_write+0xf2/0x1d0
>>>     do_syscall_64+0xfa/0x570
>>>
>>> Fix this by calling fbcon_rotate_font() if vc is invisible in
>>> fbcon_do_set_font().
>>>
>>> Signed-off-by: Chen Jun <chenjun102@huawei.com>
>> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
> Hi Thomas,
>
> Thanks for your review.
>
> I'm not familiar with the fbcon module. Is there a better way to fix this?

Not really, I think. The whole module first needs a redesign to be 
easier to understand.

Best regards
Thomas

>
>>> ---
>>>     drivers/video/fbdev/core/fbcon.c | 5 +++++
>>>     1 file changed, 5 insertions(+)
>>>
>>> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
>>> index 666261ae59d8..d76100188bee 100644
>>> --- a/drivers/video/fbdev/core/fbcon.c
>>> +++ b/drivers/video/fbdev/core/fbcon.c
>>> @@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
>>>     		rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
>>>     		cols /= w;
>>>     		rows /= h;
>>> +		if (!con_is_visible(vc)) {
>>> +			ret = fbcon_rotate_font(info, vc);
>>> +			if (ret)
>>> +				goto err_out;
>>> +		}
>>>     		ret = vc_resize(vc, cols, rows);
>>>     		if (ret)
>>>     			goto err_out;
>

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)

Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs

[chenjun (AM)]

在 2026/3/2 19:34, Thomas Zimmermann 写道:
> Hi
> 
> Am 02.03.26 um 12:24 schrieb chenjun (AM):
>> 在 2026/3/2 18:19, Thomas Zimmermann 写道:
>>>
>>> Am 27.02.26 um 15:43 schrieb Chen Jun:
>>>> When a font is set on an invisible console, the screen will not update.
>>>> However, the fontbuffer is not updated to match the new font dimensions.
>>>>
>>>> This inconsistency leads to out-of-bounds memory access when writing to
>>>> the tty bound to fbcon, as demonstrated by the following KASAN report:
>>>>
>>>> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
>>>> Read of size 1 at addr ffff8881195a2280 by task a.out/971
>>>> Call Trace:
>>>>      <TASK>
>>>>      fb_pad_aligned_buffer+0xdf/0x140
>>>>      ud_putcs+0x88a/0xde0
>>>>      fbcon_putcs+0x319/0x430
>>>>      do_update_region+0x23c/0x3b0
>>>>      do_con_write+0x225c/0x67f0
>>>>      con_write+0xe/0x30
>>>>      n_tty_write+0x4b5/0xff0
>>>>      file_tty_write.isra.41+0x46c/0x880
>>>>      vfs_write+0x868/0xd60
>>>>      ksys_write+0xf2/0x1d0
>>>>      do_syscall_64+0xfa/0x570
>>>>
>>>> Fix this by calling fbcon_rotate_font() if vc is invisible in
>>>> fbcon_do_set_font().
>>>>
>>>> Signed-off-by: Chen Jun <chenjun102@huawei.com>
>>> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
>> Hi Thomas,
>>
>> Thanks for your review.
>>
>> I'm not familiar with the fbcon module. Is there a better way to fix this?
> 
> Not really, I think. The whole module first needs a redesign to be
> easier to understand.
> 
> Best regards
> Thomas
> 
>>
>>>> ---
>>>>      drivers/video/fbdev/core/fbcon.c | 5 +++++
>>>>      1 file changed, 5 insertions(+)
>>>>
>>>> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
>>>> index 666261ae59d8..d76100188bee 100644
>>>> --- a/drivers/video/fbdev/core/fbcon.c
>>>> +++ b/drivers/video/fbdev/core/fbcon.c
>>>> @@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
>>>>      		rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
>>>>      		cols /= w;
>>>>      		rows /= h;
>>>> +		if (!con_is_visible(vc)) {
>>>> +			ret = fbcon_rotate_font(info, vc);
>>>> +			if (ret)
>>>> +				goto err_out;
>>>> +		}

Hi Thomas and Helge,

I apologize, but after reviewing the code, I believe there is a problem.
The issue is that fbcon_do_set_font() updates members of 
info->fbcon_par, and the info are shared with other vc instances.

Best regards
Chen Jun

>>>>      		ret = vc_resize(vc, cols, rows);
>>>>      		if (ret)
>>>>      			goto err_out;
>>
> 

Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs

[Thomas Zimmermann]

Hi

Am 04.03.26 um 04:47 schrieb chenjun (AM):
> 在 2026/3/2 19:34, Thomas Zimmermann 写道:
>> Hi
>>
>> Am 02.03.26 um 12:24 schrieb chenjun (AM):
>>> 在 2026/3/2 18:19, Thomas Zimmermann 写道:
>>>> Am 27.02.26 um 15:43 schrieb Chen Jun:
>>>>> When a font is set on an invisible console, the screen will not update.
>>>>> However, the fontbuffer is not updated to match the new font dimensions.
>>>>>
>>>>> This inconsistency leads to out-of-bounds memory access when writing to
>>>>> the tty bound to fbcon, as demonstrated by the following KASAN report:
>>>>>
>>>>> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
>>>>> Read of size 1 at addr ffff8881195a2280 by task a.out/971
>>>>> Call Trace:
>>>>>       <TASK>
>>>>>       fb_pad_aligned_buffer+0xdf/0x140
>>>>>       ud_putcs+0x88a/0xde0
>>>>>       fbcon_putcs+0x319/0x430
>>>>>       do_update_region+0x23c/0x3b0
>>>>>       do_con_write+0x225c/0x67f0
>>>>>       con_write+0xe/0x30
>>>>>       n_tty_write+0x4b5/0xff0
>>>>>       file_tty_write.isra.41+0x46c/0x880
>>>>>       vfs_write+0x868/0xd60
>>>>>       ksys_write+0xf2/0x1d0
>>>>>       do_syscall_64+0xfa/0x570
>>>>>
>>>>> Fix this by calling fbcon_rotate_font() if vc is invisible in
>>>>> fbcon_do_set_font().
>>>>>
>>>>> Signed-off-by: Chen Jun <chenjun102@huawei.com>
>>>> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
>>> Hi Thomas,
>>>
>>> Thanks for your review.
>>>
>>> I'm not familiar with the fbcon module. Is there a better way to fix this?
>> Not really, I think. The whole module first needs a redesign to be
>> easier to understand.
>>
>> Best regards
>> Thomas
>>
>>>>> ---
>>>>>       drivers/video/fbdev/core/fbcon.c | 5 +++++
>>>>>       1 file changed, 5 insertions(+)
>>>>>
>>>>> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
>>>>> index 666261ae59d8..d76100188bee 100644
>>>>> --- a/drivers/video/fbdev/core/fbcon.c
>>>>> +++ b/drivers/video/fbdev/core/fbcon.c
>>>>> @@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
>>>>>       		rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
>>>>>       		cols /= w;
>>>>>       		rows /= h;
>>>>> +		if (!con_is_visible(vc)) {
>>>>> +			ret = fbcon_rotate_font(info, vc);
>>>>> +			if (ret)
>>>>> +				goto err_out;
>>>>> +		}
> Hi Thomas and Helge,
>
> I apologize, but after reviewing the code, I believe there is a problem.
> The issue is that fbcon_do_set_font() updates members of
> info->fbcon_par, and the info are shared with other vc instances.

Than let's drop the patch for now.

My best idea to fix this is to move the rotated font out of fbcon_par. 
The unrotated font data is stored at [1]. The struct fbcon_display 
stores a vc's display settings. It might be possible to move the rotated 
data there as well. Tracked correctly, each vc would have its own 
rotated font. BUT this might also have other side effects.

Best regards
Thomas

[1] 
https://elixir.bootlin.com/linux/v6.19.3/source/drivers/video/fbdev/core/fbcon.h#L28

>
> Best regards
> Chen Jun
>
>>>>>       		ret = vc_resize(vc, cols, rows);
>>>>>       		if (ret)
>>>>>       			goto err_out;
>

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)

Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs

[Helge Deller]

On 3/4/26 10:57, Thomas Zimmermann wrote:
> Hi
> 
> Am 04.03.26 um 04:47 schrieb chenjun (AM):
>> 在 2026/3/2 19:34, Thomas Zimmermann 写道:
>>> Hi
>>>
>>> Am 02.03.26 um 12:24 schrieb chenjun (AM):
>>>> 在 2026/3/2 18:19, Thomas Zimmermann 写道:
>>>>> Am 27.02.26 um 15:43 schrieb Chen Jun:
>>>>>> When a font is set on an invisible console, the screen will not update.
>>>>>> However, the fontbuffer is not updated to match the new font dimensions.
>>>>>>
>>>>>> This inconsistency leads to out-of-bounds memory access when writing to
>>>>>> the tty bound to fbcon, as demonstrated by the following KASAN report:
>>>>>>
>>>>>> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
>>>>>> Read of size 1 at addr ffff8881195a2280 by task a.out/971
>>>>>> Call Trace:
>>>>>>       <TASK>
>>>>>>       fb_pad_aligned_buffer+0xdf/0x140
>>>>>>       ud_putcs+0x88a/0xde0
>>>>>>       fbcon_putcs+0x319/0x430
>>>>>>       do_update_region+0x23c/0x3b0
>>>>>>       do_con_write+0x225c/0x67f0
>>>>>>       con_write+0xe/0x30
>>>>>>       n_tty_write+0x4b5/0xff0
>>>>>>       file_tty_write.isra.41+0x46c/0x880
>>>>>>       vfs_write+0x868/0xd60
>>>>>>       ksys_write+0xf2/0x1d0
>>>>>>       do_syscall_64+0xfa/0x570
>>>>>>
>>>>>> Fix this by calling fbcon_rotate_font() if vc is invisible in
>>>>>> fbcon_do_set_font().
>>>>>>
>>>>>> Signed-off-by: Chen Jun <chenjun102@huawei.com>
>>>>> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
>>>> Hi Thomas,
>>>>
>>>> Thanks for your review.
>>>>
>>>> I'm not familiar with the fbcon module. Is there a better way to fix this?
>>> Not really, I think. The whole module first needs a redesign to be
>>> easier to understand.
>>>
>>> Best regards
>>> Thomas
>>>
>>>>>> ---
>>>>>>       drivers/video/fbdev/core/fbcon.c | 5 +++++
>>>>>>       1 file changed, 5 insertions(+)
>>>>>>
>>>>>> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
>>>>>> index 666261ae59d8..d76100188bee 100644
>>>>>> --- a/drivers/video/fbdev/core/fbcon.c
>>>>>> +++ b/drivers/video/fbdev/core/fbcon.c
>>>>>> @@ -2444,6 +2444,11 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
>>>>>>               rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
>>>>>>               cols /= w;
>>>>>>               rows /= h;
>>>>>> +        if (!con_is_visible(vc)) {
>>>>>> +            ret = fbcon_rotate_font(info, vc);
>>>>>> +            if (ret)
>>>>>> +                goto err_out;
>>>>>> +        }
>> Hi Thomas and Helge,
>>
>> I apologize, but after reviewing the code, I believe there is a problem.
>> The issue is that fbcon_do_set_font() updates members of
>> info->fbcon_par, and the info are shared with other vc instances.
> 
> Than let's drop the patch for now.

Patch is now dropped from fbdev git tree.

Helge

Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs

[Helge Deller]

On 2/27/26 15:43, Chen Jun wrote:
> When a font is set on an invisible console, the screen will not update.
> However, the fontbuffer is not updated to match the new font dimensions.
> 
> This inconsistency leads to out-of-bounds memory access when writing to
> the tty bound to fbcon, as demonstrated by the following KASAN report:
> 
> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
> Read of size 1 at addr ffff8881195a2280 by task a.out/971
> Call Trace:
>   <TASK>
>   fb_pad_aligned_buffer+0xdf/0x140
>   ud_putcs+0x88a/0xde0
>   fbcon_putcs+0x319/0x430
>   do_update_region+0x23c/0x3b0
>   do_con_write+0x225c/0x67f0
>   con_write+0xe/0x30
>   n_tty_write+0x4b5/0xff0
>   file_tty_write.isra.41+0x46c/0x880
>   vfs_write+0x868/0xd60
>   ksys_write+0xf2/0x1d0
>   do_syscall_64+0xfa/0x570
> 
> Fix this by calling fbcon_rotate_font() if vc is invisible in
> fbcon_do_set_font().
> 
> Signed-off-by: Chen Jun <chenjun102@huawei.com>
> ---
>   drivers/video/fbdev/core/fbcon.c | 5 +++++
>   1 file changed, 5 insertions(+)

applied to fbdev git tree.

Thanks!
Helge

Re: [RFC PATCH] fbcon: Fix out-of-bounds memory in fbcon_putcs

[Helge Deller]

On 3/3/26 15:15, Helge Deller wrote:
> On 2/27/26 15:43, Chen Jun wrote:
>> When a font is set on an invisible console, the screen will not update.
>> However, the fontbuffer is not updated to match the new font dimensions.
>>
>> This inconsistency leads to out-of-bounds memory access when writing to
>> the tty bound to fbcon, as demonstrated by the following KASAN report:
>>
>> BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0xdf/0x140
>> Read of size 1 at addr ffff8881195a2280 by task a.out/971
>> Call Trace:
>>   <TASK>
>>   fb_pad_aligned_buffer+0xdf/0x140
>>   ud_putcs+0x88a/0xde0
>>   fbcon_putcs+0x319/0x430
>>   do_update_region+0x23c/0x3b0
>>   do_con_write+0x225c/0x67f0
>>   con_write+0xe/0x30
>>   n_tty_write+0x4b5/0xff0
>>   file_tty_write.isra.41+0x46c/0x880
>>   vfs_write+0x868/0xd60
>>   ksys_write+0xf2/0x1d0
>>   do_syscall_64+0xfa/0x570
>>
>> Fix this by calling fbcon_rotate_font() if vc is invisible in
>> fbcon_do_set_font().
>>
>> Signed-off-by: Chen Jun <chenjun102@huawei.com>
>> ---
>>   drivers/video/fbdev/core/fbcon.c | 5 +++++
>>   1 file changed, 5 insertions(+)
> 
> applied to fbdev git tree.

I got a compile error:

hppa-linux-gnu-ld: drivers/video/fbdev/core/fbcon.o: in function `fbcon_do_set_font':
/home/cvs/parisc/git-kernel/linus-linux-2.6/drivers/video/fbdev/core/fbcon.c:2392:(.text+0x1e28): undefined reference to `fbcon_rotate_font'
make[3]: *** [/home/cvs/parisc/git-kernel/linus-linux-2.6/scripts/Makefile.vmlinux:72: vmlinux.unstripped] Error 1

I modified your patch like this:

diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index a58ce1fe320c..1fb28f353168 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2388,7 +2388,7 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount,
                 rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
                 cols /= w;
                 rows /= h;
-               if (!con_is_visible(vc)) {
+               if (IS_ENABLED(CONFIG_FRAMEBUFFER_CONSOLE_ROTATION) && !con_is_visible(vc)) {
                         ret = fbcon_rotate_font(info, vc);

Helge