diff options
| author | Helge Deller <deller@gmx.de> | 2026-08-21 10:01:22 +0200 |
|---|---|---|
| committer | Helge Deller <deller@gmx.de> | 2026-08-22 09:33:45 +0200 |
| commit | 3c0ebc4c07ff1147724d8f370203e62390ae7ee7 (patch) | |
| tree | eb5063b55bb27a95fd5f18022ed21732ab751040 | |
| parent | 26260251022fbc2f248a3d747a9b2b961b18d2d8 (diff) | |
| download | linux-3c0ebc4c07ff1147724d8f370203e62390ae7ee7.tar.gz linux-3c0ebc4c07ff1147724d8f370203e62390ae7ee7.zip | |
vt: hide cursor prior to font changes to avoid out-of-bound reads
KASAN reports slab-out-of-bounds errors:
BUG: KASAN: slab-out-of-bounds in soft_cursor+0x3eb/0xb70 drivers/video/fbdev/core/softcursor.c:70
When changing the size of a sceen font, the amount of columns and rows
on a screen may change and thus the current position of the cursor and
the selection may suddenly lay outside of the current screen limits.
Clear the selection and hide the cursor before any font changes to avoid
such possible out of bounds accesses.
Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr>
Signed-off-by: Helge Deller <deller@gmx.de>
Link: https://lore.kernel.org/all/20260819163440.3702924-1-jjy600901@snu.ac.kr/
| -rw-r--r-- | drivers/tty/vt/vt.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 8f467b22b799..57edf37495a8 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -4986,8 +4986,8 @@ static int con_font_set(struct vc_data *vc, const struct console_font_op *op) if (!vc->vc_sw->con_font_set) return -ENOSYS; - if (vc_is_sel(vc)) - clear_selection(); + /* hide selection and cursor prior font changes */ + hide_cursor(vc); return vc->vc_sw->con_font_set(vc, &font, vpitch, op->flags); } @@ -5011,8 +5011,9 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op) if (!vc->vc_sw->con_font_default) return -ENOSYS; - if (vc_is_sel(vc)) - clear_selection(); + /* hide selection and cursor prior font changes */ + hide_cursor(vc); + int ret = vc->vc_sw->con_font_default(vc, &font, s); if (ret) return ret; |