releases/4.19.34/fbdev-fbmem-fix-memory-access-if-logo-is-bigger-than.patch

   1 From 2d670b8ddd4fe8c4ded729e09c8b63dfeb6a947d Mon Sep 17 00:00:00 2001
   2 From: Manfred Schlaegl <manfred.schlaegl@ginzinger.com>
   3 Date: Fri, 8 Feb 2019 19:24:47 +0100
   4 Subject: fbdev: fbmem: fix memory access if logo is bigger than the screen
   5
   6 [ Upstream commit a5399db139cb3ad9b8502d8b1bd02da9ce0b9df0 ]
   7
   8 There is no clipping on the x or y axis for logos larger that the framebuffer
   9 size. Therefore: a logo bigger than screen size leads to invalid memory access:
  10
  11 [    1.254664] Backtrace:
  12 [    1.254728] [<c02714e0>] (cfb_imageblit) from [<c026184c>] (fb_show_logo+0x620/0x684)
  13 [    1.254763]  r10:00000003 r9:00027fd8 r8:c6a40000 r7:c6a36e50 r6:00000000 r5:c06b81e4
  14 [    1.254774]  r4:c6a3e800
  15 [    1.254810] [<c026122c>] (fb_show_logo) from [<c026c1e4>] (fbcon_switch+0x3fc/0x46c)
  16 [    1.254842]  r10:c6a3e824 r9:c6a3e800 r8:00000000 r7:c6a0c000 r6:c070b014 r5:c6a3e800
  17 [    1.254852]  r4:c6808c00
  18 [    1.254889] [<c026bde8>] (fbcon_switch) from [<c029c8f8>] (redraw_screen+0xf0/0x1e8)
  19 [    1.254918]  r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:c070d5a0 r5:00000080
  20 [    1.254928]  r4:c6808c00
  21 [    1.254961] [<c029c808>] (redraw_screen) from [<c029d264>] (do_bind_con_driver+0x194/0x2e4)
  22 [    1.254991]  r9:00000000 r8:00000000 r7:00000014 r6:c070d5a0 r5:c070d5a0 r4:c070d5a0
  23
  24 So prevent displaying a logo bigger than screen size and avoid invalid
  25 memory access.
  26
  27 Signed-off-by: Manfred Schlaegl <manfred.schlaegl@ginzinger.com>
  28 Signed-off-by: Martin Kepplinger <martin.kepplinger@ginzinger.com>
  29 Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
  30 Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
  31 Signed-off-by: Sasha Levin <sashal@kernel.org>
  32 ---
  33  drivers/video/fbdev/core/fbmem.c | 3 +++
  34  1 file changed, 3 insertions(+)
  35
  36 diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
  37 index 77cee99fc36c..c48f083d522a 100644
  38 --- a/drivers/video/fbdev/core/fbmem.c
  39 +++ b/drivers/video/fbdev/core/fbmem.c
  40 @@ -427,6 +427,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
  41  {
  42         unsigned int x;
  43
  44 +       if (image->width > info->var.xres || image->height > info->var.yres)
  45 +               return;
  46 +
  47         if (rotate == FB_ROTATE_UR) {
  48                 for (x = 0;
  49                      x < num && image->dx + image->width <= info->var.xres;
  50 --
  51 2.19.1
  52