Re: [PATCH v2] fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds

[Thomas Zimmermann]

Hi

Am 04.10.25 um 02:43 schrieb Helge Deller:
> On 10/3/25 09:32, Albin Babu Varghese wrote:
> > Add bounds checking to prevent writes past framebuffer boundaries when
> > rendering text near screen edges. Return early if the Y position is 
> > off-screen
> > and clip image height to screen boundary. Break from the rendering 
> > loop if the
> > X position is off-screen. When clipping image width to fit the 
> > screen, update
> > the character count to match the clipped width to prevent buffer size
> > mismatches.
> >
> > Without the character count update, bit_putcs_aligned and 
> > bit_putcs_unaligned
> > receive mismatched parameters where the buffer is allocated for the 
> > clipped
> > width but cnt reflects the original larger count, causing 
> > out-of-bounds writes.
> >
> > Reported-by: syzbot+48b0652a95834717f190@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190
> > Suggested-by: Helge Deller <deller@xxxxxx>
> > Tested-by: syzbot+48b0652a95834717f190@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Signed-off-by: Albin Babu Varghese <albinbabuvarghese20@xxxxxxxxx>
> > ---
> > Changes in v2:
> > - Partially render when height exceeding screen boundaries instead of 
> > skipping
> > - Update character count when width is clipped to prevent buffer 
> > mismatch
> >
> > Link to v1:
> > https://lore.kernel.org/all/20250927075010.119671-1-albinbabuvarghese20@xxxxxxxxx/ 
> >
> > ---
> >   drivers/video/fbdev/core/bitblit.c | 20 ++++++++++++++++++++
> >   1 file changed, 20 insertions(+)
>
> applied.

This patch mangles fbcon output on fbdev HW drivers. It's reproducible 
on matroxfb and sisfb. Reverting the change restores these driver's 
functionality.

Fbcon from within DRM's fbdev emulation works.

Best regards
Thomas


> Thanks!
> Helge

--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com
GF: Stefan Gaiser, Jochen Jaser, Abhinav Puri, (HRB 36809, AG Nürnberg)