Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] fbcon: hardware tileblitting desync on set_font error path --
commit 4bfab26c62faf08e2aeace132c9263da4258cec4 Author: Yao Yiqi <[email protected]> fbcon: Rebuild rotated font buffer on font change Rebuilds the rotated font buffer for the visible console when the font is changed, preventing an out-of-bounds read if the new font size differs. Selects the console blitting state via set_blitting_type() before rotation, and rebuilds the rotated font again on the error path if vc_resize() fails. > diff --git a/drivers/video/fbdev/core/fbcon.c > b/drivers/video/fbdev/core/fbcon.c > index 01715873ea49b..1a2fe9fc1dc2a 100644 > --- a/drivers/video/fbdev/core/fbcon.c > +++ b/drivers/video/fbdev/core/fbcon.c [ ... ] > @@ -2466,6 +2477,14 @@ static int fbcon_do_set_font(struct vc_data *vc, int > w, int h, int charcount, > else if (!old_hi_font_mask && vc->vc_hi_font_mask) > set_vc_hi_font(vc, false); > > + /* > + * The rotated font buffer was rebuilt for the new font before > + * vc_resize() was attempted. Call rotate_font() again to > + * overwrite par->rotated with the restored font's state. > + */ > + if (con_is_visible(vc) && par->bitops->rotate_font) > + par->bitops->rotate_font(info, vc); > + [Severity: Medium] When vc_resize() fails, this error path successfully restores the software font state and rotated buffer, but does this leave the hardware tileblitting engine out of sync? Earlier in fbcon_do_set_font(), set_blitting_type() is called to configure the hardware with the new font's dimensions. Since set_blitting_type() isn't called again here to revert the hardware state, it seems the tile engine could remain programmed with the rejected font dimensions while the software console reverts to the old font. Could this lead to screen corruption or hardware bounds mismatches? > font_data_put(data); > > return ret; -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=2
