fbcon: prevent user font height or width change from causing potential out-of-bounds...

commit 39b3cffb8cf3111738ea993e2757ab382253d86a upstream.

Add a check to fbcon_resize() to ensure that a possible change to user font
height or user font width will not allow a font data out-of-bounds access.
NOTE: must use original charcount in calculation as font charcount can
change and cannot be used to determine the font data allocated size.

Signed-off-by: George Kennedy <george.kennedy@oracle.com>
Cc: stable <stable@vger.kernel.org>
Reported-by: syzbot+38a3699c7eaf165b97a6@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/1596213192-6635-1-git-send-email-george.kennedy@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index e2a490c5ae08ffb1a83b06a5850f2cb28aac0e89..fbf10e62bcde955ca829e5ae9df54e84a54f0c35 100644 (file)
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2191,6 +2191,9 @@ static void updatescrollmode(struct fbcon_display *p,
        }
 }
 
+#define PITCH(w) (((w) + 7) >> 3)
+#define CALC_FONTSZ(h, p, c) ((h) * (p) * (c)) /* size = height * pitch * charcount */
+
 static int fbcon_resize(struct vc_data *vc, unsigned int width, 
                        unsigned int height, unsigned int user)
 {
@@ -2200,6 +2203,24 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width,
        struct fb_var_screeninfo var = info->var;
        int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh;
 
+       if (ops->p && ops->p->userfont && FNTSIZE(vc->vc_font.data)) {
+               int size;
+               int pitch = PITCH(vc->vc_font.width);
+
+               /*
+                * If user font, ensure that a possible change to user font
+                * height or width will not allow a font data out-of-bounds access.
+                * NOTE: must use original charcount in calculation as font
+                * charcount can change and cannot be used to determine the
+                * font data allocated size.
+                */
+               if (pitch <= 0)
+                       return -EINVAL;
+               size = CALC_FONTSZ(vc->vc_font.height, pitch, FNTCHARCNT(vc->vc_font.data));
+               if (size > FNTSIZE(vc->vc_font.data))
+                       return -EINVAL;
+       }
+
        virt_w = FBCON_SWAP(ops->rotate, width, height);
        virt_h = FBCON_SWAP(ops->rotate, height, width);
        virt_fw = FBCON_SWAP(ops->rotate, vc->vc_font.width,
@@ -2652,7 +2673,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font,
        int size;
        int i, csum;
        u8 *new_data, *data = font->data;
-       int pitch = (font->width+7) >> 3;
+       int pitch = PITCH(font->width);
 
        /* Is there a reason why fbconsole couldn't handle any charcount >256?
         * If not this check should be changed to charcount < 256 */
@@ -2668,7 +2689,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font,
        if (fbcon_invalid_charcount(info, charcount))
                return -EINVAL;
 
-       size = h * pitch * charcount;
+       size = CALC_FONTSZ(h, pitch, charcount);
 
        new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER);