linux-kernel - Re: [PATCH] fbdev: Add bounds checking in bit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <c008abe6-d16e-4063-a81b-dc52cf71d5a8@gmx.de>
Date: Thu, 2 Oct 2025 12:11:15 +0200
From: Helge Deller <deller@....de>
To: Albin Babu Varghese <albinbabuvarghese20@...il.com>
Cc: Simona Vetter <simona@...ll.ch>,
 syzbot+48b0652a95834717f190@...kaller.appspotmail.com,
 linux-fbdev@...r.kernel.org, dri-devel@...ts.freedesktop.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH] fbdev: Add bounds checking in bit_putcs to fix
 vmalloc-out-of-bounds

On 10/2/25 10:52, Albin Babu Varghese wrote:
> Hi Helge, I tested your suggestions and they seem to work well.
> 
>> Do you know if this affects the selection?
>> If so, would modifying (reducing/shortening) the selection maybe fix it?
> 
> The syzkaller reproducer uses really weird values where xs > xe and ys > ye
> (xs=0xa00, xe=0x101, ys=0xc7e, ye=0x100) and set_selection() already swaps them
> if needed and clamps the values.

Ok.
  
> I added debug prints to check what's happening and the clamping in
> set_selection() is working and the values coming through are within bounds. But
> the crash still happens when you remap the framebuffer because of a slight
> overflow.
> 
> I also discovered that when image.width is clipped on the X-axis, the character
> count (cnt) must also be updated to match, otherwise bit_putcs_aligned()
> 	receives mismatched buffer size and character count parameters, causing
> 	out-of-bounds writes.
> 
> So I changed it to something like this:
> 
> +	if (image.dx >= info->var.xres)
> +		break;
> +	if (image.dx + image.width > info->var.xres) {
> +		image.width = info->var.xres - image.dx;
> +		cnt = image.width / vc->vc_font.width;
> +		if (cnt == 0)
> +			break;
> +		image.width = cnt * vc->vc_font.width;
> +	}

Looks good.

> I tested it in syzbot, with the syzkaller reproducer, and also manually in QEMU
> and verified that the buffer switches from tty1 to tty2 work correctly.
> 
> I couldn’t find a dedicated fbdev/fbcon test suite. Beyond kselftests, do you
> recommend anything specific before sending v2?

There is Geert's fbdev test tool (https://git.kernel.org/pub/scm/linux/kernel/git/geert/fbtest.git/),
but it does not involve testing of fbcon.

Helge