Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4bcf5f7a authored by Thomas Zimmermann's avatar Thomas Zimmermann Committed by Greg Kroah-Hartman
Browse files

fbcon: Fix OOB access in font allocation 



commit 9b2f5ef00e852f8e8902a4d4f73aeedc60220c12 upstream.

Commit 1a194e6c8e1e ("fbcon: fix integer overflow in fbcon_do_set_font")
introduced an out-of-bounds access by storing data and allocation sizes
in the same variable. Restore the old size calculation and use the new
variable 'alloc_size' for the allocation.

Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
Fixes: 1a194e6c8e1e ("fbcon: fix integer overflow in fbcon_do_set_font")
Reported-by: default avatarJani Nikula <jani.nikula@linux.intel.com>
Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15020
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6201


Cc: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: George Kennedy <george.kennedy@oracle.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: Helge Deller <deller@gmx.de>
Cc: "Ville Syrjälä" <ville.syrjala@linux.intel.com>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Qianqiang Liu <qianqiang.liu@163.com>
Cc: Shixiong Ou <oushixiong@kylinos.cn>
Cc: Kees Cook <kees@kernel.org>
Cc: <stable@vger.kernel.org> # v5.9+
Cc: Zsolt Kajtar <soci@c64.rulez.org>
Reviewed-by: default avatarLucas De Marchi <lucas.demarchi@intel.com>
Reviewed-by: default avatarQianqiang Liu <qianqiang.liu@163.com>
Link: https://lore.kernel.org/r/20250922134619.257684-1-tzimmermann@suse.de


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 994bdc2d

drivers/video/fbdev/core/fbcon.c

+3 −3
Original line number Diff line number Diff line
@@ -2482,7 +2482,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, 
	unsigned charcount = font->charcount;

	int w = font->width;

	int h = font->height;

	int size;

	int size, alloc_size;

	int i, csum;

	u8 *new_data, *data = font->data;

	int pitch = PITCH(font->width);
@@ -2515,10 +2515,10 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, 
		return -EINVAL;



	/* Check for overflow in allocation size calculation */

	if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &size))

	if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &alloc_size))

		return -EINVAL;



	new_data = kmalloc(size, GFP_USER);

	new_data = kmalloc(alloc_size, GFP_USER);



	if (!new_data)

		return -ENOMEM;