lkml.org 
[lkml]   [2020]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 119/138] fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.
    Date
    From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

    commit 033724d6864245a11f8e04c066002e6ad22b3fd0 upstream.

    syzbot is reporting general protection fault in bitfill_aligned() [1]
    caused by integer underflow in bit_clear_margins(). The cause of this
    problem is when and how do_vc_resize() updates vc->vc_{cols,rows}.

    If vc_do_resize() fails (e.g. kzalloc() fails) when var.xres or var.yres
    is going to shrink, vc->vc_{cols,rows} will not be updated. This allows
    bit_clear_margins() to see info->var.xres < (vc->vc_cols * cw) or
    info->var.yres < (vc->vc_rows * ch). Unexpectedly large rw or bh will
    try to overrun the __iomem region and causes general protection fault.

    Also, vc_resize(vc, 0, 0) does not set vc->vc_{cols,rows} = 0 due to

    new_cols = (cols ? cols : vc->vc_cols);
    new_rows = (lines ? lines : vc->vc_rows);

    exception. Since cols and lines are calculated as

    cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
    rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
    cols /= vc->vc_font.width;
    rows /= vc->vc_font.height;
    vc_resize(vc, cols, rows);

    in fbcon_modechanged(), var.xres < vc->vc_font.width makes cols = 0
    and var.yres < vc->vc_font.height makes rows = 0. This means that

    const int fd = open("/dev/fb0", O_ACCMODE);
    struct fb_var_screeninfo var = { };
    ioctl(fd, FBIOGET_VSCREENINFO, &var);
    var.xres = var.yres = 1;
    ioctl(fd, FBIOPUT_VSCREENINFO, &var);

    easily reproduces integer underflow bug explained above.

    Of course, callers of vc_resize() are not handling vc_do_resize() failure
    is bad. But we can't avoid vc_resize(vc, 0, 0) which returns 0. Therefore,
    as a band-aid workaround, this patch checks integer underflow in
    "struct fbcon_ops"->clear_margins call, assuming that
    vc->vc_cols * vc->vc_font.width and vc->vc_rows * vc->vc_font.heigh do not
    cause integer overflow.

    [1] https://syzkaller.appspot.com/bug?id=a565882df74fa76f10d3a6fec4be31098dbb37c6

    Reported-and-tested-by: syzbot <syzbot+e5fd3e65515b48c02a30@syzkaller.appspotmail.com>
    Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Cc: stable <stable@vger.kernel.org>
    Link: https://lore.kernel.org/r/20200715015102.3814-1-penguin-kernel@I-love.SAKURA.ne.jp
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/video/fbdev/core/bitblit.c | 4 ++--
    drivers/video/fbdev/core/fbcon_ccw.c | 4 ++--
    drivers/video/fbdev/core/fbcon_cw.c | 4 ++--
    drivers/video/fbdev/core/fbcon_ud.c | 4 ++--
    4 files changed, 8 insertions(+), 8 deletions(-)

    --- a/drivers/video/fbdev/core/bitblit.c
    +++ b/drivers/video/fbdev/core/bitblit.c
    @@ -216,7 +216,7 @@ static void bit_clear_margins(struct vc_
    region.color = color;
    region.rop = ROP_COPY;

    - if (rw && !bottom_only) {
    + if ((int) rw > 0 && !bottom_only) {
    region.dx = info->var.xoffset + rs;
    region.dy = 0;
    region.width = rw;
    @@ -224,7 +224,7 @@ static void bit_clear_margins(struct vc_
    info->fbops->fb_fillrect(info, &region);
    }

    - if (bh) {
    + if ((int) bh > 0) {
    region.dx = info->var.xoffset;
    region.dy = info->var.yoffset + bs;
    region.width = rs;
    --- a/drivers/video/fbdev/core/fbcon_ccw.c
    +++ b/drivers/video/fbdev/core/fbcon_ccw.c
    @@ -201,7 +201,7 @@ static void ccw_clear_margins(struct vc_
    region.color = color;
    region.rop = ROP_COPY;

    - if (rw && !bottom_only) {
    + if ((int) rw > 0 && !bottom_only) {
    region.dx = 0;
    region.dy = info->var.yoffset;
    region.height = rw;
    @@ -209,7 +209,7 @@ static void ccw_clear_margins(struct vc_
    info->fbops->fb_fillrect(info, &region);
    }

    - if (bh) {
    + if ((int) bh > 0) {
    region.dx = info->var.xoffset + bs;
    region.dy = 0;
    region.height = info->var.yres_virtual;
    --- a/drivers/video/fbdev/core/fbcon_cw.c
    +++ b/drivers/video/fbdev/core/fbcon_cw.c
    @@ -184,7 +184,7 @@ static void cw_clear_margins(struct vc_d
    region.color = color;
    region.rop = ROP_COPY;

    - if (rw && !bottom_only) {
    + if ((int) rw > 0 && !bottom_only) {
    region.dx = 0;
    region.dy = info->var.yoffset + rs;
    region.height = rw;
    @@ -192,7 +192,7 @@ static void cw_clear_margins(struct vc_d
    info->fbops->fb_fillrect(info, &region);
    }

    - if (bh) {
    + if ((int) bh > 0) {
    region.dx = info->var.xoffset;
    region.dy = info->var.yoffset;
    region.height = info->var.yres;
    --- a/drivers/video/fbdev/core/fbcon_ud.c
    +++ b/drivers/video/fbdev/core/fbcon_ud.c
    @@ -231,7 +231,7 @@ static void ud_clear_margins(struct vc_d
    region.color = color;
    region.rop = ROP_COPY;

    - if (rw && !bottom_only) {
    + if ((int) rw > 0 && !bottom_only) {
    region.dy = 0;
    region.dx = info->var.xoffset;
    region.width = rw;
    @@ -239,7 +239,7 @@ static void ud_clear_margins(struct vc_d
    info->fbops->fb_fillrect(info, &region);
    }

    - if (bh) {
    + if ((int) bh > 0) {
    region.dy = info->var.yoffset;
    region.dx = info->var.xoffset;
    region.height = bh;

    \
     
     \ /
      Last update: 2020-07-27 16:34    [W:4.516 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site