git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From 39b3cffb8cf3111738ea993e2757ab382253d86a Mon Sep 17 00:00:00 2001
   2 From: George Kennedy <george.kennedy@oracle.com>
   3 Date: Fri, 31 Jul 2020 12:33:11 -0400
   4 Subject: fbcon: prevent user font height or width change from causing potential out-of-bounds access
   5
   6 From: George Kennedy <george.kennedy@oracle.com>
   7
   8 commit 39b3cffb8cf3111738ea993e2757ab382253d86a upstream.
   9
  10 Add a check to fbcon_resize() to ensure that a possible change to user font
  11 height or user font width will not allow a font data out-of-bounds access.
  12 NOTE: must use original charcount in calculation as font charcount can
  13 change and cannot be used to determine the font data allocated size.
  14
  15 Signed-off-by: George Kennedy <george.kennedy@oracle.com>
  16 Cc: stable <stable@vger.kernel.org>
  17 Reported-by: syzbot+38a3699c7eaf165b97a6@syzkaller.appspotmail.com
  18 Link: https://lore.kernel.org/r/1596213192-6635-1-git-send-email-george.kennedy@oracle.com
  19 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  20
  21 ---
  22  drivers/video/console/fbcon.c |   25 +++++++++++++++++++++++--
  23  1 file changed, 23 insertions(+), 2 deletions(-)
  24
  25 --- a/drivers/video/console/fbcon.c
  26 +++ b/drivers/video/console/fbcon.c
  27 @@ -2117,6 +2117,9 @@ static void updatescrollmode(struct disp
  28         }
  29  }
  30
  31 +#define PITCH(w) (((w) + 7) >> 3)
  32 +#define CALC_FONTSZ(h, p, c) ((h) * (p) * (c)) /* size = height * pitch * charcount */
  33 +
  34  static int fbcon_resize(struct vc_data *vc, unsigned int width,
  35                         unsigned int height, unsigned int user)
  36  {
  37 @@ -2126,6 +2129,24 @@ static int fbcon_resize(struct vc_data *
  38         struct fb_var_screeninfo var = info->var;
  39         int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh;
  40
  41 +       if (ops->p && ops->p->userfont && FNTSIZE(vc->vc_font.data)) {
  42 +               int size;
  43 +               int pitch = PITCH(vc->vc_font.width);
  44 +
  45 +               /*
  46 +                * If user font, ensure that a possible change to user font
  47 +                * height or width will not allow a font data out-of-bounds access.
  48 +                * NOTE: must use original charcount in calculation as font
  49 +                * charcount can change and cannot be used to determine the
  50 +                * font data allocated size.
  51 +                */
  52 +               if (pitch <= 0)
  53 +                       return -EINVAL;
  54 +               size = CALC_FONTSZ(vc->vc_font.height, pitch, FNTCHARCNT(vc->vc_font.data));
  55 +               if (size > FNTSIZE(vc->vc_font.data))
  56 +                       return -EINVAL;
  57 +       }
  58 +
  59         virt_w = FBCON_SWAP(ops->rotate, width, height);
  60         virt_h = FBCON_SWAP(ops->rotate, height, width);
  61         virt_fw = FBCON_SWAP(ops->rotate, vc->vc_font.width,
  62 @@ -2587,7 +2608,7 @@ static int fbcon_set_font(struct vc_data
  63         int size;
  64         int i, csum;
  65         u8 *new_data, *data = font->data;
  66 -       int pitch = (font->width+7) >> 3;
  67 +       int pitch = PITCH(font->width);
  68
  69         /* Is there a reason why fbconsole couldn't handle any charcount >256?
  70          * If not this check should be changed to charcount < 256 */
  71 @@ -2603,7 +2624,7 @@ static int fbcon_set_font(struct vc_data
  72         if (fbcon_invalid_charcount(info, charcount))
  73                 return -EINVAL;
  74
  75 -       size = h * pitch * charcount;
  76 +       size = CALC_FONTSZ(h, pitch, charcount);
  77
  78         new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER);
  79