linux-stable

mirror of https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux-stable.git synced 2025-11-04 07:44:51 +10:00

Go to file

Sravan Kumar Gundu 27b118aebd fbdev: Fix vmalloc out-of-bounds write in fast_imageblit commit `af0db3c1f8` upstream. This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and updates the screen if console is visible. As part of mapping it has to do resize of console according to frame buffer info. if this resize fails and returns from vc_do_resize() and continues further. At this point console and new frame buffer are mapped and sets display vars. Despite failure still it continue to proceed updating the screen at later stages where vc_data is related to previous frame buffer and frame buffer info and display vars are mapped to new frame buffer and eventully leading to out-of-bounds write in fast_imageblit(). This bheviour is excepted only when fg_console is equal to requested console which is a visible console and updates screen with invalid struct references in fbcon_putcs(). Reported-and-tested-by: syzbot+c4b7aa0513823e2ea880@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c4b7aa0513823e2ea880 Signed-off-by: Sravan Kumar Gundu <sravankumarlpu@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Helge Deller <deller@gmx.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-08-28 16:28:31 +02:00
arch
block	block: avoid possible overflow for chunk_sectors check in blk_stack_limits()	2025-08-28 16:28:30 +02:00
certs
crypto
Documentation
drivers	fbdev: Fix vmalloc out-of-bounds write in fast_imageblit	2025-08-28 16:28:31 +02:00
fs	btrfs: do not allow relocation of partially dropped subvolumes	2025-08-28 16:28:31 +02:00
include
init
io_uring
ipc
kernel
lib
LICENSES
mm
net
rust
samples
scripts	kconfig: lxdialog: fix 'space' to (de)select options	2025-08-28 16:28:29 +02:00
security
sound	ASoC: fsl_sai: replace regmap_write with regmap_update_bits	2025-08-28 16:28:30 +02:00
tools
usr
virt
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
.rustfmt.toml
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile
README

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.