lkml.org 
[lkml]   [2020]   [Oct]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.4 65/80] fbmem: add margin check to fb_check_caps()
    Date
    From: George Kennedy <george.kennedy@oracle.com>

    [ Upstream commit a49145acfb975d921464b84fe00279f99827d816 ]

    A fb_ioctl() FBIOPUT_VSCREENINFO call with invalid xres setting
    or yres setting in struct fb_var_screeninfo will result in a
    KASAN: vmalloc-out-of-bounds failure in bitfill_aligned() as
    the margins are being cleared. The margins are cleared in
    chunks and if the xres setting or yres setting is a value of
    zero upto the chunk size, the failure will occur.

    Add a margin check to validate xres and yres settings.

    Signed-off-by: George Kennedy <george.kennedy@oracle.com>
    Reported-by: syzbot+e5fd3e65515b48c02a30@syzkaller.appspotmail.com
    Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
    Cc: Dhaval Giani <dhaval.giani@oracle.com>
    Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/1594149963-13801-1-git-send-email-george.kennedy@oracle.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/video/fbdev/core/fbmem.c | 4 ++++
    1 file changed, 4 insertions(+)

    diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
    index 97abcd497c7e0..bf76dadbed87f 100644
    --- a/drivers/video/fbdev/core/fbmem.c
    +++ b/drivers/video/fbdev/core/fbmem.c
    @@ -1001,6 +1001,10 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
    return 0;
    }

    + /* bitfill_aligned() assumes that it's at least 8x8 */
    + if (var->xres < 8 || var->yres < 8)
    + return -EINVAL;
    +
    ret = info->fbops->fb_check_var(var, info);

    if (ret)
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-10-18 21:42    [W:3.261 / U:0.376 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site