From: Greg Kroah-Hartman Date: Wed, 6 Nov 2024 08:12:23 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.19.323~18 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e9e8f0eee1fb7f02d3a9ea74e46c682ebf60c71b;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: vt-prevent-kernel-infoleak-in-con_font_get.patch --- diff --git a/queue-5.4/series b/queue-5.4/series index 1e33f4f5094..fb1f4b9b423 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -457,3 +457,4 @@ ocfs2-pass-u64-to-ocfs2_truncate_inline-maybe-overfl.patch nilfs2-fix-kernel-bug-due-to-missing-clearing-of-checked-flag.patch mm-shmem-fix-data-race-in-shmem_getattr.patch revert-drm-mipi-dsi-set-the-fwnode-for-mipi_dsi_device.patch +vt-prevent-kernel-infoleak-in-con_font_get.patch diff --git a/queue-5.4/vt-prevent-kernel-infoleak-in-con_font_get.patch b/queue-5.4/vt-prevent-kernel-infoleak-in-con_font_get.patch new file mode 100644 index 00000000000..3fa5dd1cf7f --- /dev/null +++ b/queue-5.4/vt-prevent-kernel-infoleak-in-con_font_get.patch @@ -0,0 +1,35 @@ +From f956052e00de211b5c9ebaa1958366c23f82ee9e Mon Sep 17 00:00:00 2001 +From: Jeongjun Park +Date: Fri, 11 Oct 2024 02:46:19 +0900 +Subject: vt: prevent kernel-infoleak in con_font_get() + +From: Jeongjun Park + +commit f956052e00de211b5c9ebaa1958366c23f82ee9e upstream. + +font.data may not initialize all memory spaces depending on the implementation +of vc->vc_sw->con_font_get. This may cause info-leak, so to prevent this, it +is safest to modify it to initialize the allocated memory space to 0, and it +generally does not affect the overall performance of the system. + +Cc: stable@vger.kernel.org +Reported-by: syzbot+955da2d57931604ee691@syzkaller.appspotmail.com +Fixes: 05e2600cb0a4 ("VT: Bump font size limitation to 64x128 pixels") +Signed-off-by: Jeongjun Park +Link: https://lore.kernel.org/r/20241010174619.59662-1-aha310510@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/vt/vt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -4519,7 +4519,7 @@ static int con_font_get(struct vc_data * + int c; + + if (op->data) { +- font.data = kmalloc(max_font_size, GFP_KERNEL); ++ font.data = kzalloc(max_font_size, GFP_KERNEL); + if (!font.data) + return -ENOMEM; + } else