github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-13 01:08:08 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
4ff840604a
linux/drivers/video/fbdev/core
History
Peilin Ye 43198a5b1c fbcon: Fix global-out-of-bounds read in fbcon_get_font() 
commit 5af0864079 upstream.

fbcon_get_font() is reading out-of-bounds. A malicious user may resize
`vc->vc_font.height` to a large value, causing fbcon_get_font() to
read out of `fontdata`.

fbcon_get_font() handles both built-in and user-provided fonts.
Fortunately, recently we have added FONT_EXTRA_WORDS support for built-in
fonts, so fix it by adding range checks using FNTSIZE().

This patch depends on patch "fbdev, newport_con: Move FONT_EXTRA_WORDS
macros into linux/font.h", and patch "Fonts: Support FONT_EXTRA_WORDS
macros for built-in fonts".

Cc: stable@vger.kernel.org
Reported-and-tested-by: syzbot+29d4ed7f3bdedf2aa2fd@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=08b8be45afea11888776f897895aef9ad1c3ecfd
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/b34544687a1a09d6de630659eb7a773f4953238b.1600953813.git.yepeilin.cs@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-14 10:31:21 +02:00
..
bitblit.c fbcon: remove now unusued 'softback_lines' cursor() argument 2020-09-17 13:45:30 +02:00
cfbcopyarea.c
cfbfillrect.c
cfbimgblt.c
fb_cmdline.c
fb_ddc.c
fb_defio.c
fb_draw.h
fb_notify.c
fb_sys_fops.c
fbcmap.c
fbcon_ccw.c fbcon: remove now unusued 'softback_lines' cursor() argument 2020-09-17 13:45:30 +02:00
fbcon_cw.c fbcon: remove now unusued 'softback_lines' cursor() argument 2020-09-17 13:45:30 +02:00
fbcon_rotate.c fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h 2020-10-14 10:31:21 +02:00
fbcon_rotate.h
fbcon_ud.c fbcon: remove now unusued 'softback_lines' cursor() argument 2020-09-17 13:45:30 +02:00
fbcon.c fbcon: Fix global-out-of-bounds read in fbcon_get_font() 2020-10-14 10:31:21 +02:00
fbcon.h fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h 2020-10-14 10:31:21 +02:00
fbcvt.c
fbmem.c fbdev: potential information leak in do_fb_ioctl() 2020-04-23 10:30:22 +02:00
fbmon.c fbdev: Ditch fb_edid_add_monspecs 2019-11-24 08:19:14 +01:00
fbsysfs.c
Makefile
modedb.c fbdev: Ditch fb_edid_add_monspecs 2019-11-24 08:19:14 +01:00
softcursor.c
svgalib.c
syscopyarea.c
sysfillrect.c
sysimgblt.c
tileblit.c fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h 2020-10-14 10:31:21 +02:00