linux-kernel - Re: [PATCH] fbdev: Fix vmalloc out-of-bounds write in fast

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <69c344cd-acf4-4363-b4a5-d07226fff609@gmx.de>
Date: Sat, 2 Aug 2025 21:30:39 +0200
From: Helge Deller <deller@....de>
To: Sravan Kumar Gundu <sravankumarlpu@...il.com>, daniel@...ll.ch
Cc: skhan@...uxfoundation.com, linux-fbdev@...r.kernel.org,
 dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
 linux-kernel-mentees@...ts.linuxfoundation.org,
 syzbot+c4b7aa0513823e2ea880@...kaller.appspotmail.com
Subject: Re: [PATCH] fbdev: Fix vmalloc out-of-bounds write in fast_imageblit

On 7/31/25 22:36, Sravan Kumar Gundu wrote:
> This issue triggers when a userspace program does an ioctl
> FBIOPUT_CON2FBMAP by passing console number and frame buffer number.
> Ideally this maps console to frame buffer and updates the screen if
> console is visible.
> 
> As part of mapping it has to do resize of console according to frame
> buffer info. if this resize fails and returns from vc_do_resize() and
> continues further. At this point console and new frame buffer are mapped
> and sets display vars. Despite failure still it continue to proceed
> updating the screen at later stages where vc_data is related to previous
> frame buffer and frame buffer info and display vars are mapped to new
> frame buffer and eventully leading to out-of-bounds write in
> fast_imageblit(). This bheviour is excepted only when fg_console is
> equal to requested console which is a visible console and updates screen
> with invalid struct references in fbcon_putcs().
> 
> Reported-and-tested-by: syzbot+c4b7aa0513823e2ea880@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=c4b7aa0513823e2ea880
> Signed-off-by: Sravan Kumar Gundu <sravankumarlpu@...il.com>
> ---
>   drivers/video/fbdev/core/fbcon.c | 9 +++++----
>   1 file changed, 5 insertions(+), 4 deletions(-)

applied to fbdev git tree.

Thanks!
Helge