Commit e4ef723d authored by Thomas Zimmermann's avatar Thomas Zimmermann Committed by Helge Deller
Browse files

fbcon: Avoid OOB font access if console rotation fails 



Clear the font buffer if the reallocation during console rotation fails
in fbcon_rotate_font(). The putcs implementations for the rotated buffer
will return early in this case. See [1] for an example.

Currently, fbcon_rotate_font() keeps the old buffer, which is too small
for the rotated font. Printing to the rotated console with a high-enough
character code will overflow the font buffer.

v2:
- fix typos in commit message

Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
Fixes: 6cc50e1c ("[PATCH] fbcon: Console Rotation - Add support to rotate font bitmap")
Cc: stable@vger.kernel.org # v2.6.15+
Link: https://elixir.bootlin.com/linux/v6.19/source/drivers/video/fbdev/core/fbcon_ccw.c#L144

 # [1]
Signed-off-by: default avatarHelge Deller <deller@gmx.de>
parent a9cdba5c

drivers/video/fbdev/core/fbcon_rotate.c

+4 −1
Original line number Diff line number Diff line
@@ -46,6 +46,10 @@ int fbcon_rotate_font(struct fb_info *info, struct vc_data *vc) 
		info->fbops->fb_sync(info);



	if (par->fd_size < d_cellsize * len) {

		kfree(par->fontbuffer);

		par->fontbuffer = NULL;

		par->fd_size = 0;



		dst = kmalloc_array(len, d_cellsize, GFP_KERNEL);



		if (dst == NULL) {
@@ -54,7 +58,6 @@ int fbcon_rotate_font(struct fb_info *info, struct vc_data *vc) 
		}



		par->fd_size = d_cellsize * len;

		kfree(par->fontbuffer);

		par->fontbuffer = dst;

	}