From e12bf5070a25c91eb5373b8dc26cced4324c2938 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 31 Jul 2022 14:16:17 +0200 Subject: [PATCH] 4.14-stable patches added patches: fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch fbmem-check-virtual-screen-sizes-in-fb_set_var.patch --- ...creen-size-is-smaller-than-font-size.patch | 106 ++++++++++++++++++ ...k-virtual-screen-sizes-in-fb_set_var.patch | 45 ++++++++ queue-4.14/series | 2 + 3 files changed, 153 insertions(+) create mode 100644 queue-4.14/fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch create mode 100644 queue-4.14/fbmem-check-virtual-screen-sizes-in-fb_set_var.patch diff --git a/queue-4.14/fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch b/queue-4.14/fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch new file mode 100644 index 00000000000..cd7cc721dc4 --- /dev/null +++ b/queue-4.14/fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch @@ -0,0 +1,106 @@ +From foo@baz Sun Jul 31 01:15:12 PM CEST 2022 +From: Chen Jun +Date: Fri, 29 Jul 2022 03:11:39 +0000 +Subject: fbcon: Prevent that screen size is smaller than font size +To: , , , , +Cc: , +Message-ID: <20220729031140.21806-2-chenjun102@huawei.com> + +From: Helge Deller + +commit e64242caef18b4a5840b0e7a9bff37abd4f4f933 upstream + +We need to prevent that users configure a screen size which is smaller than the +currently selected font size. Otherwise rendering chars on the screen will +access memory outside the graphics memory region. + +This patch adds a new function fbcon_modechange_possible() which +implements this check and which later may be extended with other checks +if necessary. The new function is called from the FBIOPUT_VSCREENINFO +ioctl handler in fbmem.c, which will return -EINVAL if userspace asked +for a too small screen size. + +Signed-off-by: Helge Deller +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/all/20220706150253.2186-1-deller@gmx.de/ +[sudip: adjust context] +Signed-off-by: Chen Jun +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/core/fbcon.c | 28 ++++++++++++++++++++++++++++ + drivers/video/fbdev/core/fbmem.c | 10 +++++++--- + include/linux/fbcon.h | 4 ++++ + 3 files changed, 39 insertions(+), 3 deletions(-) + +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -2706,6 +2706,34 @@ static void fbcon_set_all_vcs(struct fb_ + fbcon_modechanged(info); + } + ++/* let fbcon check if it supports a new screen resolution */ ++int fbcon_modechange_possible(struct fb_info *info, struct fb_var_screeninfo *var) ++{ ++ struct fbcon_ops *ops = info->fbcon_par; ++ struct vc_data *vc; ++ unsigned int i; ++ ++ WARN_CONSOLE_UNLOCKED(); ++ ++ if (!ops) ++ return 0; ++ ++ /* prevent setting a screen size which is smaller than font size */ ++ for (i = first_fb_vc; i <= last_fb_vc; i++) { ++ vc = vc_cons[i].d; ++ if (!vc || vc->vc_mode != KD_TEXT || ++ registered_fb[con2fb_map[i]] != info) ++ continue; ++ ++ if (vc->vc_font.width > FBCON_SWAP(var->rotate, var->xres, var->yres) || ++ vc->vc_font.height > FBCON_SWAP(var->rotate, var->yres, var->xres)) ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++EXPORT_SYMBOL_GPL(fbcon_modechange_possible); ++ + static int fbcon_mode_deleted(struct fb_info *info, + struct fb_videomode *mode) + { +--- a/drivers/video/fbdev/core/fbmem.c ++++ b/drivers/video/fbdev/core/fbmem.c +@@ -1134,9 +1134,13 @@ static long do_fb_ioctl(struct fb_info * + console_unlock(); + return -ENODEV; + } +- info->flags |= FBINFO_MISC_USEREVENT; +- ret = fb_set_var(info, &var); +- info->flags &= ~FBINFO_MISC_USEREVENT; ++ ret = fbcon_modechange_possible(info, &var); ++ if (!ret) { ++ info->flags |= FBINFO_MISC_USEREVENT; ++ ret = fb_set_var(info, &var); ++ info->flags &= ~FBINFO_MISC_USEREVENT; ++ } ++ lock_fb_info(info); + unlock_fb_info(info); + console_unlock(); + if (!ret && copy_to_user(argp, &var, sizeof(var))) +--- a/include/linux/fbcon.h ++++ b/include/linux/fbcon.h +@@ -4,9 +4,13 @@ + #ifdef CONFIG_FRAMEBUFFER_CONSOLE + void __init fb_console_init(void); + void __exit fb_console_exit(void); ++int fbcon_modechange_possible(struct fb_info *info, ++ struct fb_var_screeninfo *var); + #else + static inline void fb_console_init(void) {} + static inline void fb_console_exit(void) {} ++static inline int fbcon_modechange_possible(struct fb_info *info, ++ struct fb_var_screeninfo *var) { return 0; } + #endif + + #endif /* _LINUX_FBCON_H */ diff --git a/queue-4.14/fbmem-check-virtual-screen-sizes-in-fb_set_var.patch b/queue-4.14/fbmem-check-virtual-screen-sizes-in-fb_set_var.patch new file mode 100644 index 00000000000..7aa36793c83 --- /dev/null +++ b/queue-4.14/fbmem-check-virtual-screen-sizes-in-fb_set_var.patch @@ -0,0 +1,45 @@ +From foo@baz Sun Jul 31 01:15:12 PM CEST 2022 +From: Chen Jun +Date: Fri, 29 Jul 2022 03:11:40 +0000 +Subject: fbmem: Check virtual screen sizes in fb_set_var() +To: , , , , +Cc: , +Message-ID: <20220729031140.21806-3-chenjun102@huawei.com> + +From: Helge Deller + +commit 6c11df58fd1ac0aefcb3b227f72769272b939e56 upstream + +Verify that the fbdev or drm driver correctly adjusted the virtual +screen sizes. On failure report the failing driver and reject the screen +size change. + +Signed-off-by: Helge Deller +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/all/20220706150253.2186-1-deller@gmx.de/ +[sudip: adjust context] +Signed-off-by: Chen Jun +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/core/fbmem.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/video/fbdev/core/fbmem.c ++++ b/drivers/video/fbdev/core/fbmem.c +@@ -1019,6 +1019,16 @@ fb_set_var(struct fb_info *info, struct + if (ret) + goto done; + ++ /* verify that virtual resolution >= physical resolution */ ++ if (var->xres_virtual < var->xres || ++ var->yres_virtual < var->yres) { ++ pr_warn("WARNING: fbcon: Driver '%s' missed to adjust virtual screen size (%ux%u vs. %ux%u)\n", ++ info->fix.id, ++ var->xres_virtual, var->yres_virtual, ++ var->xres, var->yres); ++ return -EINVAL; ++ } ++ + if ((var->activate & FB_ACTIVATE_MASK) == FB_ACTIVATE_NOW) { + struct fb_var_screeninfo old_var; + struct fb_videomode mode; diff --git a/queue-4.14/series b/queue-4.14/series index 157b6fdfa59..830d786ac90 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -7,3 +7,5 @@ net-sungem_phy-add-of_node_put-for-reference-returne.patch netfilter-nf_queue-do-not-allow-packet-truncation-be.patch arm-crypto-comment-out-gcc-warning-that-breaks-clang-builds.patch mt7601u-add-usb-device-id-for-some-versions-of-xiaodu-wifi-dongle.patch +fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch +fbmem-check-virtual-screen-sizes-in-fb_set_var.patch -- 2.47.3