Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2afb553d authored by Helge Deller's avatar Helge Deller Committed by Greg Kroah-Hartman
Browse files

fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters 



commit cad564ca557f8d3bb3b1fa965d9a2b3f6490ec69 upstream.

The user may use the fbcon=vc:<n1>-<n2> option to tell fbcon to take
over the given range (n1...n2) of consoles. The value for n1 and n2
needs to be a positive number and up to (MAX_NR_CONSOLES - 1).
The given values were not fully checked against those boundaries yet.

To fix the issue, convert first_fb_vc and last_fb_vc to unsigned
integers and check them against the upper boundary, and make sure that
first_fb_vc is smaller than last_fb_vc.

Cc: stable@vger.kernel.org # v4.19+
Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: default avatarHelge Deller <deller@gmx.de>
Link: https://patchwork.freedesktop.org/patch/msgid/YpkYRMojilrtZIgM@p100


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 6f9cd356

drivers/video/fbdev/core/fbcon.c

+5 −3
Original line number Diff line number Diff line
@@ -123,8 +123,8 @@ static int logo_lines; 
   enums.  */

static int logo_shown = FBCON_LOGO_CANSHOW;

/* console mappings */

static int first_fb_vc;

static int last_fb_vc = MAX_NR_CONSOLES - 1;

static unsigned int first_fb_vc;

static unsigned int last_fb_vc = MAX_NR_CONSOLES - 1;

static int fbcon_is_default = 1; 

static int primary_device = -1;

static int fbcon_has_console_bind;
@@ -474,10 +474,12 @@ static int __init fb_console_setup(char *this_opt) 
			options += 3;

			if (*options)

				first_fb_vc = simple_strtoul(options, &options, 10) - 1;

			if (first_fb_vc < 0)

			if (first_fb_vc >= MAX_NR_CONSOLES)

				first_fb_vc = 0;

			if (*options++ == '-')

				last_fb_vc = simple_strtoul(options, &options, 10) - 1;

			if (last_fb_vc < first_fb_vc || last_fb_vc >= MAX_NR_CONSOLES)

				last_fb_vc = MAX_NR_CONSOLES - 1;

			fbcon_is_default = 0; 

			continue;

		}