4.14-stable patches

added patches:
	fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch
	fbmem-check-virtual-screen-sizes-in-fb_set_var.patch

diff --git a/queue-4.14/fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch b/queue-4.14/fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch
new file mode 100644 (file)
index 0000000..cd7cc72
--- /dev/null
+++ b/queue-4.14/fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch
@@ -0,0 +1,106 @@
+From foo@baz Sun Jul 31 01:15:12 PM CEST 2022
+From: Chen Jun <chenjun102@huawei.com>
+Date: Fri, 29 Jul 2022 03:11:39 +0000
+Subject: fbcon: Prevent that screen size is smaller than font size
+To: <stable@vger.kernel.org>, <deller@gmx.de>, <geert@linux-m68k.org>, <b.zolnierkie@samsung.com>, <gregkh@linuxfoundation.org>
+Cc: <xuqiang36@huawei.com>, <xiujianfeng@huawei.com>
+Message-ID: <20220729031140.21806-2-chenjun102@huawei.com>
+
+From: Helge Deller <deller@gmx.de>
+
+commit e64242caef18b4a5840b0e7a9bff37abd4f4f933 upstream
+
+We need to prevent that users configure a screen size which is smaller than the
+currently selected font size. Otherwise rendering chars on the screen will
+access memory outside the graphics memory region.
+
+This patch adds a new function fbcon_modechange_possible() which
+implements this check and which later may be extended with other checks
+if necessary.  The new function is called from the FBIOPUT_VSCREENINFO
+ioctl handler in fbmem.c, which will return -EINVAL if userspace asked
+for a too small screen size.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Link: https://lore.kernel.org/all/20220706150253.2186-1-deller@gmx.de/
+[sudip: adjust context]
+Signed-off-by: Chen Jun <chenjun102@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/core/fbcon.c |   28 ++++++++++++++++++++++++++++
+ drivers/video/fbdev/core/fbmem.c |   10 +++++++---
+ include/linux/fbcon.h            |    4 ++++
+ 3 files changed, 39 insertions(+), 3 deletions(-)
+
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -2706,6 +2706,34 @@ static void fbcon_set_all_vcs(struct fb_
+               fbcon_modechanged(info);
+ }
+ 
++/* let fbcon check if it supports a new screen resolution */
++int fbcon_modechange_possible(struct fb_info *info, struct fb_var_screeninfo *var)
++{
++      struct fbcon_ops *ops = info->fbcon_par;
++      struct vc_data *vc;
++      unsigned int i;
++
++      WARN_CONSOLE_UNLOCKED();
++
++      if (!ops)
++              return 0;
++
++      /* prevent setting a screen size which is smaller than font size */
++      for (i = first_fb_vc; i <= last_fb_vc; i++) {
++              vc = vc_cons[i].d;
++              if (!vc || vc->vc_mode != KD_TEXT ||
++                         registered_fb[con2fb_map[i]] != info)
++                      continue;
++
++              if (vc->vc_font.width  > FBCON_SWAP(var->rotate, var->xres, var->yres) ||
++                  vc->vc_font.height > FBCON_SWAP(var->rotate, var->yres, var->xres))
++                      return -EINVAL;
++      }
++
++      return 0;
++}
++EXPORT_SYMBOL_GPL(fbcon_modechange_possible);
++
+ static int fbcon_mode_deleted(struct fb_info *info,
+                             struct fb_videomode *mode)
+ {
+--- a/drivers/video/fbdev/core/fbmem.c
++++ b/drivers/video/fbdev/core/fbmem.c
+@@ -1134,9 +1134,13 @@ static long do_fb_ioctl(struct fb_info *
+                       console_unlock();
+                       return -ENODEV;
+               }
+-              info->flags |= FBINFO_MISC_USEREVENT;
+-              ret = fb_set_var(info, &var);
+-              info->flags &= ~FBINFO_MISC_USEREVENT;
++              ret = fbcon_modechange_possible(info, &var);
++              if (!ret) {
++                      info->flags |= FBINFO_MISC_USEREVENT;
++                      ret = fb_set_var(info, &var);
++                      info->flags &= ~FBINFO_MISC_USEREVENT;
++              }
++              lock_fb_info(info);
+               unlock_fb_info(info);
+               console_unlock();
+               if (!ret && copy_to_user(argp, &var, sizeof(var)))
+--- a/include/linux/fbcon.h
++++ b/include/linux/fbcon.h
+@@ -4,9 +4,13 @@
+ #ifdef CONFIG_FRAMEBUFFER_CONSOLE
+ void __init fb_console_init(void);
+ void __exit fb_console_exit(void);
++int  fbcon_modechange_possible(struct fb_info *info,
++                             struct fb_var_screeninfo *var);
+ #else
+ static inline void fb_console_init(void) {}
+ static inline void fb_console_exit(void) {}
++static inline int  fbcon_modechange_possible(struct fb_info *info,
++                              struct fb_var_screeninfo *var) { return 0; }
+ #endif
+ 
+ #endif /* _LINUX_FBCON_H */

diff --git a/queue-4.14/fbmem-check-virtual-screen-sizes-in-fb_set_var.patch b/queue-4.14/fbmem-check-virtual-screen-sizes-in-fb_set_var.patch
new file mode 100644 (file)
index 0000000..7aa3679
--- /dev/null
+++ b/queue-4.14/fbmem-check-virtual-screen-sizes-in-fb_set_var.patch
@@ -0,0 +1,45 @@
+From foo@baz Sun Jul 31 01:15:12 PM CEST 2022
+From: Chen Jun <chenjun102@huawei.com>
+Date: Fri, 29 Jul 2022 03:11:40 +0000
+Subject: fbmem: Check virtual screen sizes in fb_set_var()
+To: <stable@vger.kernel.org>, <deller@gmx.de>, <geert@linux-m68k.org>, <b.zolnierkie@samsung.com>, <gregkh@linuxfoundation.org>
+Cc: <xuqiang36@huawei.com>, <xiujianfeng@huawei.com>
+Message-ID: <20220729031140.21806-3-chenjun102@huawei.com>
+
+From: Helge Deller <deller@gmx.de>
+
+commit 6c11df58fd1ac0aefcb3b227f72769272b939e56 upstream
+
+Verify that the fbdev or drm driver correctly adjusted the virtual
+screen sizes. On failure report the failing driver and reject the screen
+size change.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Link: https://lore.kernel.org/all/20220706150253.2186-1-deller@gmx.de/
+[sudip: adjust context]
+Signed-off-by: Chen Jun <chenjun102@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/core/fbmem.c |   10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/video/fbdev/core/fbmem.c
++++ b/drivers/video/fbdev/core/fbmem.c
+@@ -1019,6 +1019,16 @@ fb_set_var(struct fb_info *info, struct
+               if (ret)
+                       goto done;
+ 
++              /* verify that virtual resolution >= physical resolution */
++              if (var->xres_virtual < var->xres ||
++                  var->yres_virtual < var->yres) {
++                      pr_warn("WARNING: fbcon: Driver '%s' missed to adjust virtual screen size (%ux%u vs. %ux%u)\n",
++                              info->fix.id,
++                              var->xres_virtual, var->yres_virtual,
++                              var->xres, var->yres);
++                      return -EINVAL;
++              }
++
+               if ((var->activate & FB_ACTIVATE_MASK) == FB_ACTIVATE_NOW) {
+                       struct fb_var_screeninfo old_var;
+                       struct fb_videomode mode;

diff --git a/queue-4.14/series b/queue-4.14/series
index 157b6fdfa59cae73fa47f9a3034f3a88a61792ba..830d786ac907c066261789ea7a998fa15cbe8f73 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -7,3 +7,5 @@ net-sungem_phy-add-of_node_put-for-reference-returne.patch
 netfilter-nf_queue-do-not-allow-packet-truncation-be.patch
 arm-crypto-comment-out-gcc-warning-that-breaks-clang-builds.patch
 mt7601u-add-usb-device-id-for-some-versions-of-xiaodu-wifi-dongle.patch
+fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch
+fbmem-check-virtual-screen-sizes-in-fb_set_var.patch