| From 1bafcbf59fed92af58955024452f45430d3898c5 Mon Sep 17 00:00:00 2001 |
| From: Tomi Valkeinen <tomi.valkeinen@ti.com> |
| Date: Wed, 26 Sep 2018 18:11:22 +0200 |
| Subject: fbdev/omapfb: fix omapfb_memory_read infoleak |
| |
| From: Tomi Valkeinen <tomi.valkeinen@ti.com> |
| |
| commit 1bafcbf59fed92af58955024452f45430d3898c5 upstream. |
| |
| OMAPFB_MEMORY_READ ioctl reads pixels from the LCD's memory and copies |
| them to a userspace buffer. The code has two issues: |
| |
| - The user provided width and height could be large enough to overflow |
| the calculations |
| - The copy_to_user() can copy uninitialized memory to the userspace, |
| which might contain sensitive kernel information. |
| |
| Fix these by limiting the width & height parameters, and only copying |
| the amount of data that we actually received from the LCD. |
| |
| Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com> |
| Reported-by: Jann Horn <jannh@google.com> |
| Cc: stable@vger.kernel.org |
| Cc: security@kernel.org |
| Cc: Will Deacon <will.deacon@arm.com> |
| Cc: Jann Horn <jannh@google.com> |
| Cc: Tony Lindgren <tony@atomide.com> |
| Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c | 5 ++++- |
| 1 file changed, 4 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c |
| +++ b/drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c |
| @@ -496,6 +496,9 @@ static int omapfb_memory_read(struct fb_ |
| if (!access_ok(VERIFY_WRITE, mr->buffer, mr->buffer_size)) |
| return -EFAULT; |
| |
| + if (mr->w > 4096 || mr->h > 4096) |
| + return -EINVAL; |
| + |
| if (mr->w * mr->h * 3 > mr->buffer_size) |
| return -EINVAL; |
| |
| @@ -509,7 +512,7 @@ static int omapfb_memory_read(struct fb_ |
| mr->x, mr->y, mr->w, mr->h); |
| |
| if (r > 0) { |
| - if (copy_to_user(mr->buffer, buf, mr->buffer_size)) |
| + if (copy_to_user(mr->buffer, buf, r)) |
| r = -EFAULT; |
| } |
| |