| From 39b3cffb8cf3111738ea993e2757ab382253d86a Mon Sep 17 00:00:00 2001 |
| From: George Kennedy <george.kennedy@oracle.com> |
| Date: Fri, 31 Jul 2020 12:33:11 -0400 |
| Subject: fbcon: prevent user font height or width change from causing potential out-of-bounds access |
| |
| From: George Kennedy <george.kennedy@oracle.com> |
| |
| commit 39b3cffb8cf3111738ea993e2757ab382253d86a upstream. |
| |
| Add a check to fbcon_resize() to ensure that a possible change to user font |
| height or user font width will not allow a font data out-of-bounds access. |
| NOTE: must use original charcount in calculation as font charcount can |
| change and cannot be used to determine the font data allocated size. |
| |
| Signed-off-by: George Kennedy <george.kennedy@oracle.com> |
| Cc: stable <stable@vger.kernel.org> |
| Reported-by: syzbot+38a3699c7eaf165b97a6@syzkaller.appspotmail.com |
| Link: https://lore.kernel.org/r/1596213192-6635-1-git-send-email-george.kennedy@oracle.com |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/video/console/fbcon.c | 25 +++++++++++++++++++++++-- |
| 1 file changed, 23 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/video/console/fbcon.c |
| +++ b/drivers/video/console/fbcon.c |
| @@ -2116,6 +2116,9 @@ static void updatescrollmode(struct disp |
| } |
| } |
| |
| +#define PITCH(w) (((w) + 7) >> 3) |
| +#define CALC_FONTSZ(h, p, c) ((h) * (p) * (c)) /* size = height * pitch * charcount */ |
| + |
| static int fbcon_resize(struct vc_data *vc, unsigned int width, |
| unsigned int height, unsigned int user) |
| { |
| @@ -2125,6 +2128,24 @@ static int fbcon_resize(struct vc_data * |
| struct fb_var_screeninfo var = info->var; |
| int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh; |
| |
| + if (ops->p && ops->p->userfont && FNTSIZE(vc->vc_font.data)) { |
| + int size; |
| + int pitch = PITCH(vc->vc_font.width); |
| + |
| + /* |
| + * If user font, ensure that a possible change to user font |
| + * height or width will not allow a font data out-of-bounds access. |
| + * NOTE: must use original charcount in calculation as font |
| + * charcount can change and cannot be used to determine the |
| + * font data allocated size. |
| + */ |
| + if (pitch <= 0) |
| + return -EINVAL; |
| + size = CALC_FONTSZ(vc->vc_font.height, pitch, FNTCHARCNT(vc->vc_font.data)); |
| + if (size > FNTSIZE(vc->vc_font.data)) |
| + return -EINVAL; |
| + } |
| + |
| virt_w = FBCON_SWAP(ops->rotate, width, height); |
| virt_h = FBCON_SWAP(ops->rotate, height, width); |
| virt_fw = FBCON_SWAP(ops->rotate, vc->vc_font.width, |
| @@ -2586,7 +2607,7 @@ static int fbcon_set_font(struct vc_data |
| int size; |
| int i, csum; |
| u8 *new_data, *data = font->data; |
| - int pitch = (font->width+7) >> 3; |
| + int pitch = PITCH(font->width); |
| |
| /* Is there a reason why fbconsole couldn't handle any charcount >256? |
| * If not this check should be changed to charcount < 256 */ |
| @@ -2602,7 +2623,7 @@ static int fbcon_set_font(struct vc_data |
| if (fbcon_invalid_charcount(info, charcount)) |
| return -EINVAL; |
| |
| - size = h * pitch * charcount; |
| + size = CALC_FONTSZ(h, pitch, charcount); |
| |
| new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER); |
| |