Re: [PATCH] fbdev: Fix vmalloc out-of-bounds write in fast_imageblit

[Helge Deller <deller@gmx.de>]

On 7/31/25 22:36, Sravan Kumar Gundu wrote:
> This issue triggers when a userspace program does an ioctl
> FBIOPUT_CON2FBMAP by passing console number and frame buffer number.
> Ideally this maps console to frame buffer and updates the screen if
> console is visible.
> 
> As part of mapping it has to do resize of console according to frame
> buffer info. if this resize fails and returns from vc_do_resize() and
> continues further. At this point console and new frame buffer are mapped
> and sets display vars. Despite failure still it continue to proceed
> updating the screen at later stages where vc_data is related to previous
> frame buffer and frame buffer info and display vars are mapped to new
> frame buffer and eventully leading to out-of-bounds write in
> fast_imageblit(). This bheviour is excepted only when fg_console is
> equal to requested console which is a visible console and updates screen
> with invalid struct references in fbcon_putcs().
> 
> Reported-and-tested-by: syzbot+c4b7aa0513823e2ea880@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=c4b7aa0513823e2ea880
> Signed-off-by: Sravan Kumar Gundu <sravankumarlpu@gmail.com>
> ---
>   drivers/video/fbdev/core/fbcon.c | 9 +++++----
>   1 file changed, 5 insertions(+), 4 deletions(-)

applied to fbdev git tree.

Thanks!
Helge