github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-07 14:04:54 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters

Browse Source 
commit cad564ca55 upstream.

The user may use the fbcon=vc:<n1>-<n2> option to tell fbcon to take
over the given range (n1...n2) of consoles. The value for n1 and n2
needs to be a positive number and up to (MAX_NR_CONSOLES - 1).
The given values were not fully checked against those boundaries yet.

To fix the issue, convert first_fb_vc and last_fb_vc to unsigned
integers and check them against the upper boundary, and make sure that
first_fb_vc is smaller than last_fb_vc.

Cc: stable@vger.kernel.org # v4.19+
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Helge Deller <deller@gmx.de>
Link: https://patchwork.freedesktop.org/patch/msgid/YpkYRMojilrtZIgM@p100
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Helge Deller 2022-06-02 22:06:28 +02:00 committed by Greg Kroah-Hartman
parent 826955eebc
commit 16badd9987
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/video/fbdev/core/fbcon.c
View File

@ -123,8 +123,8 @@ static int logo_lines;
enums. */ enums. */
static int logo_shown = FBCON_LOGO_CANSHOW; static int logo_shown = FBCON_LOGO_CANSHOW;
/* console mappings */ /* console mappings */
static int first_fb_vc; static unsigned int first_fb_vc;
static int last_fb_vc = MAX_NR_CONSOLES - 1; static unsigned int last_fb_vc = MAX_NR_CONSOLES - 1;
static int fbcon_is_default = 1; static int fbcon_is_default = 1;
static int primary_device = -1; static int primary_device = -1;
static int fbcon_has_console_bind; static int fbcon_has_console_bind;
@ -472,10 +472,12 @@ static int __init fb_console_setup(char *this_opt)
options += 3; options += 3;
if (*options) if (*options)
first_fb_vc = simple_strtoul(options, &options, 10) - 1; first_fb_vc = simple_strtoul(options, &options, 10) - 1;
if (first_fb_vc < 0) if (first_fb_vc >= MAX_NR_CONSOLES)
first_fb_vc = 0; first_fb_vc = 0;
if (*options++ == '-') if (*options++ == '-')
last_fb_vc = simple_strtoul(options, &options, 10) - 1; last_fb_vc = simple_strtoul(options, &options, 10) - 1;
if (last_fb_vc < first_fb_vc || last_fb_vc >= MAX_NR_CONSOLES)
last_fb_vc = MAX_NR_CONSOLES - 1;
fbcon_is_default = 0; fbcon_is_default = 0;
continue; continue;
} }