Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ae021a90 authored by George Kennedy's avatar George Kennedy Committed by Greg Kroah-Hartman
Browse files

fbcon: prevent user font height or width change from causing potential out-of-bounds access 



commit 39b3cffb8cf3111738ea993e2757ab382253d86a upstream.

Add a check to fbcon_resize() to ensure that a possible change to user font
height or user font width will not allow a font data out-of-bounds access.
NOTE: must use original charcount in calculation as font charcount can
change and cannot be used to determine the font data allocated size.

Signed-off-by: default avatarGeorge Kennedy <george.kennedy@oracle.com>
Cc: stable <stable@vger.kernel.org>
Reported-by: default avatar <syzbot+38a3699c7eaf165b97a6@syzkaller.appspotmail.com>
Link: https://lore.kernel.org/r/1596213192-6635-1-git-send-email-george.kennedy@oracle.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 6f8f77d9

drivers/video/console/fbcon.c

+23 −2
Original line number Diff line number Diff line
@@ -2117,6 +2117,9 @@ static void updatescrollmode(struct display *p, 
	}

}



#define PITCH(w) (((w) + 7) >> 3)

#define CALC_FONTSZ(h, p, c) ((h) * (p) * (c)) /* size = height * pitch * charcount */



static int fbcon_resize(struct vc_data *vc, unsigned int width, 

			unsigned int height, unsigned int user)

{
@@ -2126,6 +2129,24 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width, 
	struct fb_var_screeninfo var = info->var;

	int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh;



	if (ops->p && ops->p->userfont && FNTSIZE(vc->vc_font.data)) {

		int size;

		int pitch = PITCH(vc->vc_font.width);



		/*

		 * If user font, ensure that a possible change to user font

		 * height or width will not allow a font data out-of-bounds access.

		 * NOTE: must use original charcount in calculation as font

		 * charcount can change and cannot be used to determine the

		 * font data allocated size.

		 */

		if (pitch <= 0)

			return -EINVAL;

		size = CALC_FONTSZ(vc->vc_font.height, pitch, FNTCHARCNT(vc->vc_font.data));

		if (size > FNTSIZE(vc->vc_font.data))

			return -EINVAL;

	}



	virt_w = FBCON_SWAP(ops->rotate, width, height);

	virt_h = FBCON_SWAP(ops->rotate, height, width);

	virt_fw = FBCON_SWAP(ops->rotate, vc->vc_font.width,
@@ -2587,7 +2608,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, unsigne 
	int size;

	int i, csum;

	u8 *new_data, *data = font->data;

	int pitch = (font->width+7) >> 3;

	int pitch = PITCH(font->width);



	/* Is there a reason why fbconsole couldn't handle any charcount >256?

	 * If not this check should be changed to charcount < 256 */
@@ -2603,7 +2624,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, unsigne 
	if (fbcon_invalid_charcount(info, charcount))

		return -EINVAL;



	size = h * pitch * charcount;

	size = CALC_FONTSZ(h, pitch, charcount);



	new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER);