From nobody Fri Apr 10 21:55:14 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C636DC32773 for ; Thu, 18 Aug 2022 18:14:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345325AbiHRSOa (ORCPT ); Thu, 18 Aug 2022 14:14:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49918 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241491AbiHRSO1 (ORCPT ); Thu, 18 Aug 2022 14:14:27 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EF076B9FBC for ; Thu, 18 Aug 2022 11:14:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1660846465; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=W0yvrJCNySNCn52+IL1OETOtNI6hUhlyn5gBnr+tlWk=; b=ARbqba80eB7qM1voAbLfp5f2MUFtRbTzyBLJ/iDW7jpDgvr16TFy60VZdoi5Le1MgFRiQx ki6QFKmft03RXqQRP3BVa7Qni79JLCS/GHNLN64m5oXvA6JINEVFU09ZJikxFI5fg3F9nx TmBLBoyQOAqFjMV1c/mNF2nbHbMq3xw= Received: from mail-pj1-f72.google.com (mail-pj1-f72.google.com [209.85.216.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_128_GCM_SHA256) id us-mta-633-wTWxvxHwMdmY-rvIUJ7Y_g-1; Thu, 18 Aug 2022 14:14:23 -0400 X-MC-Unique: wTWxvxHwMdmY-rvIUJ7Y_g-1 Received: by mail-pj1-f72.google.com with SMTP id s5-20020a17090a2f0500b001fab8938907so1356531pjd.7 for ; Thu, 18 Aug 2022 11:14:23 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc; bh=W0yvrJCNySNCn52+IL1OETOtNI6hUhlyn5gBnr+tlWk=; b=ecqgEEEqG4BW94JVdAyHZo16vQxoR+kYHys0ZL9wTT2CWW2dGmwLzrZqJ5CH1JRwIe Pb8ml2SOTouOoCcYq5Ytzr+Z3xycuqPRLycEtpv5AWzgoJBwVisLrhvHcqe9QxIh+xhv L5qECd89N4G77q+ci2tIDqM+nX/4tF9sSUyNOefTZyauUPGOJJm3RgCGlhiRG51gmy5R mNXuhC+NlCWsRNNsotdfFrmlwalmd+MQgd+sDeyEG3+elmg1mSZ1BFMg67oBsl4bzADb 1ztAun6Pqx5UpfZVnDZJcNvMFN+sCR4+r9QmAyoFSRL8qo7H5CsfQIEeqZPHfpE58sDs LsTQ== X-Gm-Message-State: ACgBeo2toOhh7ht0i1D5qjPfXSGqYLD1GXv1oAug/QU7gRJPEfNu2Ewl jMDidZScYIdhC1jpS/Pl+Et3B7+87S0bFFrRdwW4+zxE9IUlOh76A3puSETru26fxx2H3e0SOjW Sn0t4chkMUWF3+fC4rSCYPEUR X-Received: by 2002:a17:90b:1c82:b0:1ee:eb41:b141 with SMTP id oo2-20020a17090b1c8200b001eeeb41b141mr4285207pjb.143.1660846462853; Thu, 18 Aug 2022 11:14:22 -0700 (PDT) X-Google-Smtp-Source: AA6agR6QokUB9XAiZHout1FdGj0TFG42x0+7uXqK5dl1kBebaN2yKIVrrTUm09/AgqN1PfwicrccCw== X-Received: by 2002:a17:90b:1c82:b0:1ee:eb41:b141 with SMTP id oo2-20020a17090b1c8200b001eeeb41b141mr4285195pjb.143.1660846462606; Thu, 18 Aug 2022 11:14:22 -0700 (PDT) Received: from xps13.. ([240d:1a:c0d:9f00:4f2f:926a:23dd:8588]) by smtp.gmail.com with ESMTPSA id c16-20020a056a00009000b0052dce4edceesm1960592pfj.169.2022.08.18.11.14.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 18 Aug 2022 11:14:22 -0700 (PDT) From: Shigeru Yoshida To: deller@gmx.de Cc: linux-fbdev@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Shigeru Yoshida , syzbot+a168dbeaaa7778273c1b@syzkaller.appspotmail.com Subject: [PATCH] fbcon: Properly revert changes when vc_resize() failed Date: Fri, 19 Aug 2022 03:13:36 +0900 Message-Id: <20220818181336.3504010-1-syoshida@redhat.com> X-Mailer: git-send-email 2.37.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" fbcon_do_set_font() calls vc_resize() when font size is changed. However, if if vc_resize() failed, current implementation doesn't revert changes for font size, and this causes inconsistent state. syzbot reported unable to handle page fault due to this issue [1]. syzbot's repro uses fault injection which cause failure for memory allocation, so vc_resize() failed. This patch fixes this issue by properly revert changes for font related date when vc_resize() failed. Link: https://syzkaller.appspot.com/bug?id=3D3443d3a1fa6d964dd7310a0cb1696d= 165a3e07c4 [1] Reported-by: syzbot+a168dbeaaa7778273c1b@syzkaller.appspotmail.com Signed-off-by: Shigeru Yoshida --- drivers/video/fbdev/core/fbcon.c | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fb= con.c index cf9ac4da0a82..825b012debe7 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -2401,15 +2401,21 @@ static int fbcon_do_set_font(struct vc_data *vc, in= t w, int h, int charcount, struct fb_info *info =3D fbcon_info_from_console(vc->vc_num); struct fbcon_ops *ops =3D info->fbcon_par; struct fbcon_display *p =3D &fb_display[vc->vc_num]; - int resize; + int resize, ret, old_userfont, old_width, old_height, old_charcount; char *old_data =3D NULL; =20 resize =3D (w !=3D vc->vc_font.width) || (h !=3D vc->vc_font.height); if (p->userfont) old_data =3D vc->vc_font.data; vc->vc_font.data =3D (void *)(p->fontdata =3D data); + old_userfont =3D p->userfont; if ((p->userfont =3D userfont)) REFCOUNT(data)++; + + old_width =3D vc->vc_font.width; + old_height =3D vc->vc_font.height; + old_charcount =3D vc->vc_font.charcount; + vc->vc_font.width =3D w; vc->vc_font.height =3D h; vc->vc_font.charcount =3D charcount; @@ -2425,7 +2431,9 @@ static int fbcon_do_set_font(struct vc_data *vc, int = w, int h, int charcount, rows =3D FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres); cols /=3D w; rows /=3D h; - vc_resize(vc, cols, rows); + ret =3D vc_resize(vc, cols, rows); + if (ret) + goto err_out; } else if (con_is_visible(vc) && vc->vc_mode =3D=3D KD_TEXT) { fbcon_clear_margins(vc, 0); @@ -2435,6 +2443,21 @@ static int fbcon_do_set_font(struct vc_data *vc, int= w, int h, int charcount, if (old_data && (--REFCOUNT(old_data) =3D=3D 0)) kfree(old_data - FONT_EXTRA_WORDS * sizeof(int)); return 0; + +err_out: + p->fontdata =3D old_data; + vc->vc_font.data =3D (void *)old_data; + + if (userfont) { + p->userfont =3D old_userfont; + REFCOUNT(data)--; + } + + vc->vc_font.width =3D old_width; + vc->vc_font.height =3D old_height; + vc->vc_font.charcount =3D old_charcount; + + return ret; } =20 /* --=20 2.37.1