The root cause of this KASAN slab-out-of-bounds read is that fbcon fails to reallocate the rotated font buffer (par->rotated.buf) when the font character count changes but the font dimensions (width and height) remain the same. When a user changes the font via ioctl(KDFONTOP), fbcon_do_set_font() is called. If the user first sets a 256-character font, enables rotation, and then sets a 512-character font with the exact same width and height, resize evaluates to false. The function then directly calls update_screen(vc). Notice that fbcon_do_set_font() never calls par->bitops->rotate_font() to update the rotated font buffer for the new font. As a result, par->rotated.buf remains sized for the old 256-character font. When update_screen(vc) is called, it eventually reaches cw_putcs_aligned(), which attempts to read the glyphs from the rotated buffer. Since vc->vc_font.charcount is now 512, vc->vc_hi_font_mask is set, making charmask equal to 0x1ff (511). If the text buffer contains a character with an index >= 256, src will point out of bounds of the old par->rotated.buf (which only holds 256 glyphs). The subsequent read in __fb_pad_aligned_buffer() triggers the KASAN slab-out-of-bounds crash. BUG: KASAN: slab-out-of-bounds in __fb_pad_aligned_buffer include/linux/fb.h:646 [inline] BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0x583/0x5f0 drivers/video/fbdev/core/fbmem.c:96 Read of size 1 at addr ffff888127cc5200 by task syz-executor109/5910 Call Trace: __fb_pad_aligned_buffer include/linux/fb.h:646 [inline] fb_pad_aligned_buffer+0x583/0x5f0 drivers/video/fbdev/core/fbmem.c:96 cw_putcs_aligned drivers/video/fbdev/core/fbcon_cw.c:105 [inline] cw_putcs+0x14fa/0x18e0 drivers/video/fbdev/core/fbcon_cw.c:159 fbcon_putcs+0x3c5/0x5a0 drivers/video/fbdev/core/fbcon.c:1392 con_putc drivers/tty/vt/vt.c:330 [inline] hide_softcursor drivers/tty/vt/vt.c:872 [inline] hide_cursor+0x358/0x490 drivers/tty/vt/vt.c:884 redraw_screen+0x1f2/0x1020 drivers/tty/vt/vt.c:985 fbcon_do_set_font+0xd30/0x1930 drivers/video/fbdev/core/fbcon.c:2441 fbcon_set_font+0x6f5/0x970 drivers/video/fbdev/core/fbcon.c:2518 con_font_set drivers/tty/vt/vt.c:4992 [inline] con_font_op+0xc37/0xfe0 drivers/tty/vt/vt.c:5032 vt_k_ioctl drivers/tty/vt/vt_ioctl.c:474 [inline] vt_ioctl+0x1ba8/0x20e0 drivers/tty/vt/vt_ioctl.c:745 To fix this, fbcon_do_set_font() must call par->bitops->rotate_font() to update the rotated font buffer before calling vc_resize() or update_screen(). If vc_resize() fails and the old font is restored in the error path, rotate_font() must be called again to restore the rotated buffer. This pattern of updating the rotated font buffer was previously established in fbcon_modechanged() by commit ef7656e85f1a ("fbdev: Fix out-of-bounds access when rotating console after font resize"). The fix applies this exact idiom to fbcon_do_set_font(). By placing it before vc_resize() and update_screen(), we ensure the buffer is correctly sized before any rendering occurs. Checking con_is_visible(vc) is also correct here, as hidden consoles will have their rotation state updated later via fbcon_switch() when they become visible. Furthermore, by calling rotate_font() again in the err_out path, we ensure that if vc_resize() fails, the rotated buffer is restored to match the old vc->vc_font. Without this, restoring a 512-character font to a 256-character font on failure would leave the rotated buffer sized for 512 characters, which wastes memory; or worse, restoring a 256-character font to a 512-character font would leave the buffer too small, causing an out-of-bounds read later. Fixes: e4fc27618b75 ("[PATCH] fbcon: Console Rotation - Prepare fbcon for console rotation") Assisted-by: Gemini:gemini-3.6-flash Gemini:gemini-3.1-pro-preview syzbot Reported-by: syzbot+bf4020519fbd94b2355d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=bf4020519fbd94b2355d Link: https://syzkaller.appspot.com/ai_job?id=59f0d7d9-607c-4497-b2e2-0b16693f9502 To: "Helge Deller" To: To: To: "Simona Vetter" To: "Thomas Zimmermann" To: "Antonino A. Daplas" Cc: --- diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 23b3c536d..c74a4905b 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -2425,6 +2425,13 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount, else if (!vc->vc_hi_font_mask && charcount == 512) set_vc_hi_font(vc, true); + if (con_is_visible(vc)) { + if (par->bitops->rotate_font && par->bitops->rotate_font(info, vc)) { + par->rotate = FB_ROTATE_UR; + set_blitting_type(vc, info); + } + } + if (resize) { int cols, rows; @@ -2459,6 +2466,13 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount, else if (!old_hi_font_mask && vc->vc_hi_font_mask) set_vc_hi_font(vc, false); + if (con_is_visible(vc)) { + if (par->bitops->rotate_font && par->bitops->rotate_font(info, vc)) { + par->rotate = FB_ROTATE_UR; + set_blitting_type(vc, info); + } + } + font_data_put(data); return ret; base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f -- This is an AI-generated patch subject to moderation. Reply with '#syz upstream' to Sign-off the patch as a human author and send it to the upstream kernel mailing lists. Reply with '#syz reject' to reject it ('#syz unreject' to undo). See https://goo.gle/syzbot-ai-patches for information about AI-generated patches. You can comment on the patch as usual, syzbot will try to address the comments and send a new version of the patch if necessary. syzbot engineers can be reached at syzkaller@googlegroups.com.