From 70ab733348c7a6f243fca7592ba3fa69e02e1a30 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 29 Sep 2025 15:10:47 +0200 Subject: [PATCH] 5.10-stable patches added patches: fbcon-fix-integer-overflow-in-fbcon_do_set_font.patch fbcon-fix-oob-access-in-font-allocation.patch --- ...nteger-overflow-in-fbcon_do_set_font.patch | 71 +++++++++++++++++++ ...on-fix-oob-access-in-font-allocation.patch | 67 +++++++++++++++++ queue-5.10/series | 2 + 3 files changed, 140 insertions(+) create mode 100644 queue-5.10/fbcon-fix-integer-overflow-in-fbcon_do_set_font.patch create mode 100644 queue-5.10/fbcon-fix-oob-access-in-font-allocation.patch diff --git a/queue-5.10/fbcon-fix-integer-overflow-in-fbcon_do_set_font.patch b/queue-5.10/fbcon-fix-integer-overflow-in-fbcon_do_set_font.patch new file mode 100644 index 0000000000..bb6c21e39c --- /dev/null +++ b/queue-5.10/fbcon-fix-integer-overflow-in-fbcon_do_set_font.patch @@ -0,0 +1,71 @@ +From 1a194e6c8e1ee745e914b0b7f50fa86c89ed13fe Mon Sep 17 00:00:00 2001 +From: Samasth Norway Ananda +Date: Fri, 12 Sep 2025 10:00:23 -0700 +Subject: fbcon: fix integer overflow in fbcon_do_set_font +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Samasth Norway Ananda + +commit 1a194e6c8e1ee745e914b0b7f50fa86c89ed13fe upstream. + +Fix integer overflow vulnerabilities in fbcon_do_set_font() where font +size calculations could overflow when handling user-controlled font +parameters. + +The vulnerabilities occur when: +1. CALC_FONTSZ(h, pitch, charcount) performs h * pith * charcount + multiplication with user-controlled values that can overflow. +2. FONT_EXTRA_WORDS * sizeof(int) + size addition can also overflow +3. This results in smaller allocations than expected, leading to buffer + overflows during font data copying. + +Add explicit overflow checking using check_mul_overflow() and +check_add_overflow() kernel helpers to safety validate all size +calculations before allocation. + +Signed-off-by: Samasth Norway Ananda +Reviewed-by: Thomas Zimmermann +Fixes: 39b3cffb8cf3 ("fbcon: prevent user font height or width change from causing potential out-of-bounds access") +Cc: George Kennedy +Cc: stable +Cc: syzbot+38a3699c7eaf165b97a6@syzkaller.appspotmail.com +Cc: Greg Kroah-Hartman +Cc: Simona Vetter +Cc: Helge Deller +Cc: Thomas Zimmermann +Cc: "Ville Syrjälä" +Cc: Sam Ravnborg +Cc: Qianqiang Liu +Cc: Shixiong Ou +Cc: Kees Cook +Cc: # v5.9+ +Signed-off-by: Thomas Zimmermann +Link: https://lore.kernel.org/r/20250912170023.3931881-1-samasth.norway.ananda@oracle.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/core/fbcon.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -2527,9 +2527,16 @@ static int fbcon_set_font(struct vc_data + if (fbcon_invalid_charcount(info, charcount)) + return -EINVAL; + +- size = CALC_FONTSZ(h, pitch, charcount); ++ /* Check for integer overflow in font size calculation */ ++ if (check_mul_overflow(h, pitch, &size) || ++ check_mul_overflow(size, charcount, &size)) ++ return -EINVAL; ++ ++ /* Check for overflow in allocation size calculation */ ++ if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &size)) ++ return -EINVAL; + +- new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER); ++ new_data = kmalloc(size, GFP_USER); + + if (!new_data) + return -ENOMEM; diff --git a/queue-5.10/fbcon-fix-oob-access-in-font-allocation.patch b/queue-5.10/fbcon-fix-oob-access-in-font-allocation.patch new file mode 100644 index 0000000000..c9addce6b8 --- /dev/null +++ b/queue-5.10/fbcon-fix-oob-access-in-font-allocation.patch @@ -0,0 +1,67 @@ +From 9b2f5ef00e852f8e8902a4d4f73aeedc60220c12 Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Mon, 22 Sep 2025 15:45:54 +0200 +Subject: fbcon: Fix OOB access in font allocation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Zimmermann + +commit 9b2f5ef00e852f8e8902a4d4f73aeedc60220c12 upstream. + +Commit 1a194e6c8e1e ("fbcon: fix integer overflow in fbcon_do_set_font") +introduced an out-of-bounds access by storing data and allocation sizes +in the same variable. Restore the old size calculation and use the new +variable 'alloc_size' for the allocation. + +Signed-off-by: Thomas Zimmermann +Fixes: 1a194e6c8e1e ("fbcon: fix integer overflow in fbcon_do_set_font") +Reported-by: Jani Nikula +Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15020 +Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6201 +Cc: Samasth Norway Ananda +Cc: Thomas Zimmermann +Cc: George Kennedy +Cc: Greg Kroah-Hartman +Cc: Simona Vetter +Cc: Helge Deller +Cc: "Ville Syrjälä" +Cc: Sam Ravnborg +Cc: Qianqiang Liu +Cc: Shixiong Ou +Cc: Kees Cook +Cc: # v5.9+ +Cc: Zsolt Kajtar +Reviewed-by: Lucas De Marchi +Reviewed-by: Qianqiang Liu +Link: https://lore.kernel.org/r/20250922134619.257684-1-tzimmermann@suse.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/core/fbcon.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -2500,7 +2500,7 @@ static int fbcon_set_font(struct vc_data + unsigned charcount = font->charcount; + int w = font->width; + int h = font->height; +- int size; ++ int size, alloc_size; + int i, csum; + u8 *new_data, *data = font->data; + int pitch = PITCH(font->width); +@@ -2533,10 +2533,10 @@ static int fbcon_set_font(struct vc_data + return -EINVAL; + + /* Check for overflow in allocation size calculation */ +- if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &size)) ++ if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &alloc_size)) + return -EINVAL; + +- new_data = kmalloc(size, GFP_USER); ++ new_data = kmalloc(alloc_size, GFP_USER); + + if (!new_data) + return -ENOMEM; diff --git a/queue-5.10/series b/queue-5.10/series index 951367b52a..a9b0fa7716 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -112,3 +112,5 @@ i40e-fix-input-validation-logic-for-action_meta.patch i40e-add-max-boundary-check-for-vf-filters.patch i40e-add-mask-to-apply-valid-bits-for-itr_idx.patch tracing-dynevent-add-a-missing-lockdown-check-on-dynevent.patch +fbcon-fix-integer-overflow-in-fbcon_do_set_font.patch +fbcon-fix-oob-access-in-font-allocation.patch -- 2.47.3