KASAN reports vmalloc-out-of-bounds writes in sys_imageblit during console resize operations. The crash happens when bit_putcs renders characters outside the allocated framebuffer region.
Call trace: vc_do_resize -> clear_selection -> invert_screen -> do_update_region -> fbcon_putcs -> bit_putcs -> sys_imageblit The console resize changes dimensions but bit_putcs doesn't validate that the character positions fit within the framebuffer before rendering. This causes writes past the allocated buffer in fb_imageblit functions. Fix by checking bounds before rendering: - Return if dy + height > yres (would write past bottom) - Break if dx + width > xres (would write past right edge) Reported-by: [email protected] Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190 Tested-by: [email protected] Signed-off-by: Albin Babu Varghese <[email protected]> --- drivers/video/fbdev/core/bitblit.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c index f9475c14f733..4c732284384a 100644 --- a/drivers/video/fbdev/core/bitblit.c +++ b/drivers/video/fbdev/core/bitblit.c @@ -160,6 +160,9 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, image.height = vc->vc_font.height; image.depth = 1; + if (image.dy + image.height > info->var.yres) + return; + if (attribute) { buf = kmalloc(cellsize, GFP_ATOMIC); if (!buf) @@ -173,6 +176,10 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, cnt = count; image.width = vc->vc_font.width * cnt; + + if (image.dx + image.width > info->var.xres) + break; + pitch = DIV_ROUND_UP(image.width, 8) + scan_align; pitch &= ~scan_align; size = pitch * image.height + buf_align; -- 2.51.0
