From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oi1-f197.google.com (mail-oi1-f197.google.com [209.85.167.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 92FCC23D2A1 for ; Sat, 22 Aug 2026 10:40:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.197 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787395217; cv=none; b=e2EZRKTSecH+qc5JoaZg8iXc01AO18SmFyP0faeppUxIAqXZ5ydlpaS1k6vFrQZDDeUfQ6OQIW2QuAfiVI2OaQyKfhB41qA8bjYNPVVsVk8lDl3Nr4pKyiOl5BPjytC8HFOSSqhn4So9vxmyrV4VFBfKFAJCfXfZJBaRyQvzP1k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787395217; c=relaxed/simple; bh=NtFkHfHGLjWgGAKsTn/dAtbewVdTHg7cRHCTSbLsvwM=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=Ms7ygV5xkxdpzUT8mLKMCa63IJbmYZbF80kgrylXGW+HWXWiOppWHmOyhT6mpZvnCjM34gcciitpiE6LfqgQmXydL2P0wBwXqvFr24PjoMLWPpKLB7OQlTXl3Aby7AQI8NleKQWhZWjsOckAY5mE5UYLB/GmK9ffS6y0/3wVL1U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.167.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oi1-f197.google.com with SMTP id 5614622812f47-4b28d8d1b76so1887258b6e.3 for ; Sat, 22 Aug 2026 03:40:15 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787395214; x=1788000014; h=content-type:to:from:subject:message-id:in-reply-to:date :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=y9i8z/TpQgwsXKHBd58BFoeY9pvp+yDvLyS4i4p7+ig=; b=YwWRfAIUmA7GI1Hd3mq72sypaGJjS1eWPb5quBbrrTqM0k5827Hzz2SnnB65FlvwK8 xgJqvugYEJC1ydPBnmNuuL4kMAty0o0yWGKRcUV8qjLJ3aeiUimAv/4cFCoJOmJQyXLl 8168HRXblCk1ebt6CY+Qmmk2eHDCuJT1VHE6GzkwEulazsW6JE8qc0aVfa+bmhBV7DCp 231r0QKF+j7Ic3pV4yvDhqoXalp04LH6CLZ70r7SGRLruRMeqTW7mhssCgg37zO1jI+V SEoB6qY7bi3XI3CAmiVo0DlXvDUQhl5ebqG2lFaM0KnDOMvnaQsWhI3J9vyWJt/vPG5e 0zfA== X-Gm-Message-State: AFuF++lOLM1Pee81zaHMlmeATUV6Ocu5tFoyK4+0cCqpraLFp/0B1pVf X+es1Xon0v3pijBF5Mp/a93KYmAf522Ub8Y7tSyi4zAmeTIvYwZp2BZznPE2RI1H2cb0uuwcLuc gkgg4oQqRI4bcGBJQlcTwhKaXn+pbAzPmH8X76ASej5rikTuYYWqqk3+yMWE= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6808:1b10:b0:4a4:adaf:5570 with SMTP id 5614622812f47-4b2ef1db61dmr12559829b6e.4.1787395214543; Sat, 22 Aug 2026 03:40:14 -0700 (PDT) Date: Sat, 22 Aug 2026 03:40:14 -0700 In-Reply-To: <67bd6bef.050a0220.bbfd1.009d.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6a897c8e.dbb3a75c.13dd47.002f.GAE@google.com> Subject: Forwarded: [PATCH] fbcon: Fix KASAN slab-out-of-bounds Read in fbcon_prepare_logo From: syzbot To: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="UTF-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org. *** Subject: [PATCH] fbcon: Fix KASAN slab-out-of-bounds Read in fbcon_prepare_logo Author: deller@kernel.org #syz test Ensure the logo will not exceed the screen size, which then should fix a reported KASAN: slab-out-of-bounds Read in fbcon_prepare_logo. Reported-by: syzbot+0c815b25cdb3678e7083@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=0c815b25cdb3678e7083 Signed-off-by: Helge Deller diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 23b3c536d53d..01715873ea49 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -660,6 +660,13 @@ static void fbcon_prepare_logo(struct vc_data *vc, struct fb_info *info, erase &= ~0x400; logo_height = fb_prepare_logo(info, par->rotate); logo_lines = DIV_ROUND_UP(logo_height, vc->vc_font.height); + logo_lines = min(logo_lines, rows); + logo_lines = min(logo_lines, new_rows - 1); + if (logo_lines <= 0) { + logo_lines = 0; + logo_shown = FBCON_LOGO_DONTSHOW; + return; + } q = (unsigned short *) (vc->vc_origin + vc->vc_size_row * rows); step = logo_lines * cols;