Repository navigation
fbcon: Fullscreen logo loader fixes - #7686
Merged
pelwell merged 3 commits intoOct 18, 2026
Merged
Conversation
fb_set_logo_from_file() returns void and leaves the caller's struct fb_image untouched when the logo file is missing or can't be parsed. fb_show_logo_line() then reads image.data[0] and draws from uninitialised stack memory, which oopses while the framebuffer is registered and panics the boot. A TGA header with a width or height of 0 does the same, because kmalloc_array() returns ZERO_SIZE_PTR, which passes the NULL check. When the file does load, the pixel buffer is freed before fb_set_logo_from_file() returns, so the logo is drawn from freed memory. With init_on_free=1 it comes out black. Return an error from fb_set_logo_from_file() and skip drawing when it fails, reject a zero width or height, and free the pixel buffer once the logo has been drawn. Fixes: 19e0758 ("Fullscreen Splash Images") Link: raspberrypi#7086 Signed-off-by: Awss Al-Mubarak <awss@awssalmubarak.com>
popcornmix
approved these changes
Oct 18, 2026
pelwell
reviewed
Oct 18, 2026
|
|
||
| if (fullscreen_logo_enabled) { | ||
| palette = kzalloc(256 * 4, GFP_KERNEL); | ||
| if (palette == NULL) |
Contributor
There was a problem hiding this comment.
!palette is conventional in the kernel
Contributor
Author
There was a problem hiding this comment.
I changed it to !palette.
fb_set_logo_from_file() allocates a palette for the fullscreen logo, copies the console colours into it and installs it as info->pseudo_palette for good. The driver's own palette is never put back and the new one is never freed, so it leaks once the framebuffer is unregistered, for example when simplefb is unbound. The copy also reads 32 entries from the driver's pseudo palette, which has 16 in simplefb. Allocate the palette in fb_show_logo_line(), install it only while the logo is drawn, then restore the driver's palette and free it, as the built-in logo path already does. The logo only uses entries from 32 up, so the console colours no longer need copying. Fixes: 19e0758 ("Fullscreen Splash Images") Signed-off-by: Awss Al-Mubarak <awss@awssalmubarak.com>
The colour table in fb_set_logo_from_file() holds 224 colours. Past that, new colours aren't stored, but current_rows is still incremented for every pixel whose colour isn't in the table. Later searches then read past the end of the table on the stack, and fb_set_logo_RGB_palette() writes current_rows entries into a palette that only has room for 224. KASAN reports both for a logo with 225 colours, and with 300 colours the search runs off the stack. Only count the colours that are stored, and print the overflow message when a colour had to be clipped. Clipped colours still map to the first entry. The message no longer appears for a logo with exactly 224 colours. Fixes: 19e0758 ("Fullscreen Splash Images") Signed-off-by: Awss Al-Mubarak <awss@awssalmubarak.com>
awss1i
force-pushed
the
fbcon-fullscreen-logo-load
branch
from
October 18, 2026 14:28
77d3ced to
841bda7
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
With the fullscreen splash enabled, a missing or unsupported logo file panics the boot, because fb_show_logo_line() draws from an uninitialised fb_image. A good file is drawn from freed memory, its palette is never restored or freed, and a logo with more than 224 colours overruns the colour table and the palette.
These commits make the loader report failure so nothing is drawn, free the image after drawing, restore the driver's palette and stop counting colours past 224.
I tested a bcm2711_defconfig kernel in QEMU with simplefb, KASAN and kmemleak, comparing the framebuffer with the TGA pixel by pixel. Missing, 0x0 and unsupported files now boot, 300 colours no longer trips KASAN, and good logos are drawn exactly, including with init_on_free=1.
@flyeriNsomniac traced the crash and the use-after-free in the issue.
Closes #7086