From b8b8abe36938878c52b8dcd21e2a6a3b05f16b97 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 7 May 2021 17:51:32 +0200 Subject: [PATCH] 4.4-stable patches added patches: fbdev-zero-fill-colormap-in-fbcmap.c.patch --- ...fbdev-zero-fill-colormap-in-fbcmap.c.patch | 51 +++++++++++++++++++ queue-4.4/series | 1 + 2 files changed, 52 insertions(+) create mode 100644 queue-4.4/fbdev-zero-fill-colormap-in-fbcmap.c.patch diff --git a/queue-4.4/fbdev-zero-fill-colormap-in-fbcmap.c.patch b/queue-4.4/fbdev-zero-fill-colormap-in-fbcmap.c.patch new file mode 100644 index 00000000000..2196dd1ea0c --- /dev/null +++ b/queue-4.4/fbdev-zero-fill-colormap-in-fbcmap.c.patch @@ -0,0 +1,51 @@ +From 19ab233989d0f7ab1de19a036e247afa4a0a1e9c Mon Sep 17 00:00:00 2001 +From: Phillip Potter +Date: Wed, 31 Mar 2021 23:07:19 +0100 +Subject: fbdev: zero-fill colormap in fbcmap.c + +From: Phillip Potter + +commit 19ab233989d0f7ab1de19a036e247afa4a0a1e9c upstream. + +Use kzalloc() rather than kmalloc() for the dynamically allocated parts +of the colormap in fb_alloc_cmap_gfp, to prevent a leak of random kernel +data to userspace under certain circumstances. + +Fixes a KMSAN-found infoleak bug reported by syzbot at: +https://syzkaller.appspot.com/bug?id=741578659feabd108ad9e06696f0c1f2e69c4b6e + +Reported-by: syzbot+47fa9c9c648b765305b9@syzkaller.appspotmail.com +Cc: stable +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Phillip Potter +Link: https://lore.kernel.org/r/20210331220719.1499743-1-phil@philpotter.co.uk +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/core/fbcmap.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/video/fbdev/core/fbcmap.c ++++ b/drivers/video/fbdev/core/fbcmap.c +@@ -101,17 +101,17 @@ int fb_alloc_cmap_gfp(struct fb_cmap *cm + if (!len) + return 0; + +- cmap->red = kmalloc(size, flags); ++ cmap->red = kzalloc(size, flags); + if (!cmap->red) + goto fail; +- cmap->green = kmalloc(size, flags); ++ cmap->green = kzalloc(size, flags); + if (!cmap->green) + goto fail; +- cmap->blue = kmalloc(size, flags); ++ cmap->blue = kzalloc(size, flags); + if (!cmap->blue) + goto fail; + if (transp) { +- cmap->transp = kmalloc(size, flags); ++ cmap->transp = kzalloc(size, flags); + if (!cmap->transp) + goto fail; + } else { diff --git a/queue-4.4/series b/queue-4.4/series index 43db85b78d7..ed3af6baf3a 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -11,3 +11,4 @@ acpi-custom_method-fix-a-possible-memory-leak.patch ecryptfs-fix-kernel-panic-with-null-dev_name.patch mmc-core-do-a-power-cycle-when-the-cmd11-fails.patch mmc-core-set-read-only-for-sd-cards-with-permanent-write-protect-bit.patch +fbdev-zero-fill-colormap-in-fbcmap.c.patch -- 2.47.3