]>
Commit | Line | Data |
---|---|---|
04fd09d4 SL |
1 | From 1d48d7dc0b7def07dc307ab4ead7b059a8f5f680 Mon Sep 17 00:00:00 2001 |
2 | From: Manfred Schlaegl <manfred.schlaegl@ginzinger.com> | |
3 | Date: Fri, 8 Feb 2019 19:24:47 +0100 | |
4 | Subject: fbdev: fbmem: fix memory access if logo is bigger than the screen | |
5 | ||
6 | [ Upstream commit a5399db139cb3ad9b8502d8b1bd02da9ce0b9df0 ] | |
7 | ||
8 | There is no clipping on the x or y axis for logos larger that the framebuffer | |
9 | size. Therefore: a logo bigger than screen size leads to invalid memory access: | |
10 | ||
11 | [ 1.254664] Backtrace: | |
12 | [ 1.254728] [<c02714e0>] (cfb_imageblit) from [<c026184c>] (fb_show_logo+0x620/0x684) | |
13 | [ 1.254763] r10:00000003 r9:00027fd8 r8:c6a40000 r7:c6a36e50 r6:00000000 r5:c06b81e4 | |
14 | [ 1.254774] r4:c6a3e800 | |
15 | [ 1.254810] [<c026122c>] (fb_show_logo) from [<c026c1e4>] (fbcon_switch+0x3fc/0x46c) | |
16 | [ 1.254842] r10:c6a3e824 r9:c6a3e800 r8:00000000 r7:c6a0c000 r6:c070b014 r5:c6a3e800 | |
17 | [ 1.254852] r4:c6808c00 | |
18 | [ 1.254889] [<c026bde8>] (fbcon_switch) from [<c029c8f8>] (redraw_screen+0xf0/0x1e8) | |
19 | [ 1.254918] r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:c070d5a0 r5:00000080 | |
20 | [ 1.254928] r4:c6808c00 | |
21 | [ 1.254961] [<c029c808>] (redraw_screen) from [<c029d264>] (do_bind_con_driver+0x194/0x2e4) | |
22 | [ 1.254991] r9:00000000 r8:00000000 r7:00000014 r6:c070d5a0 r5:c070d5a0 r4:c070d5a0 | |
23 | ||
24 | So prevent displaying a logo bigger than screen size and avoid invalid | |
25 | memory access. | |
26 | ||
27 | Signed-off-by: Manfred Schlaegl <manfred.schlaegl@ginzinger.com> | |
28 | Signed-off-by: Martin Kepplinger <martin.kepplinger@ginzinger.com> | |
29 | Cc: Daniel Vetter <daniel.vetter@ffwll.ch> | |
30 | Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> | |
31 | Signed-off-by: Sasha Levin <sashal@kernel.org> | |
32 | --- | |
33 | drivers/video/fbdev/core/fbmem.c | 3 +++ | |
34 | 1 file changed, 3 insertions(+) | |
35 | ||
36 | diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c | |
37 | index 302cce7185e3..83961a22bef1 100644 | |
38 | --- a/drivers/video/fbdev/core/fbmem.c | |
39 | +++ b/drivers/video/fbdev/core/fbmem.c | |
40 | @@ -427,6 +427,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image, | |
41 | { | |
42 | unsigned int x; | |
43 | ||
44 | + if (image->width > info->var.xres || image->height > info->var.yres) | |
45 | + return; | |
46 | + | |
47 | if (rotate == FB_ROTATE_UR) { | |
48 | for (x = 0; | |
49 | x < num && image->dx + image->width <= info->var.xres; | |
50 | -- | |
51 | 2.19.1 | |
52 |