From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 44850C43381 for ; Wed, 27 Mar 2019 18:07:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1586C2075C for ; Wed, 27 Mar 2019 18:07:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553710044; bh=xCL6z6qBX8ib2Z0Foj+e6nTdaaCAXy004wAiHVt12g4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=BTULw4Ruo/0KKMem5A/Z283S3sXlUFsxFt+BxvYkGGRt9FlkFgXNanL+zWG8gkhY/ uGsgh3v0K2gNM7coqVepiO40da+AtlF8lrP+lvLQywhzMoluQRPpFAOzMgpk+aF0A7 swBHGxt/AywIVpvj1VnlNl/oAmpV58vK6K7h0Izk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388162AbfC0SHW (ORCPT ); Wed, 27 Mar 2019 14:07:22 -0400 Received: from mail.kernel.org ([198.145.29.99]:49122 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388147AbfC0SHT (ORCPT ); Wed, 27 Mar 2019 14:07:19 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E36B52075C; Wed, 27 Mar 2019 18:07:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553710038; bh=xCL6z6qBX8ib2Z0Foj+e6nTdaaCAXy004wAiHVt12g4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SfUCWnYzYQvhNKbdQT7HiUUEFmAwCSPIhXoLSd8FSx5ILHwCex/quRUQzK6t9t2qh R47yhBnECcn0F9S96sC2fbOFClA8NoVFKTfqEb2ugArNMNfp2sMBWaTjwZirnGrM0e 6yIAO4V7uMFwb4vnblkxepEVjetxrq4ZTJQnYAcQ= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Manfred Schlaegl , Martin Kepplinger , Daniel Vetter , Bartlomiej Zolnierkiewicz , Sasha Levin , dri-devel@lists.freedesktop.org, linux-fbdev@vger.kernel.org Subject: [PATCH AUTOSEL 5.0 168/262] fbdev: fbmem: fix memory access if logo is bigger than the screen Date: Wed, 27 Mar 2019 14:00:23 -0400 Message-Id: <20190327180158.10245-168-sashal@kernel.org> X-Mailer: git-send-email 2.19.1 In-Reply-To: <20190327180158.10245-1-sashal@kernel.org> References: <20190327180158.10245-1-sashal@kernel.org> MIME-Version: 1.0 X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Manfred Schlaegl [ Upstream commit a5399db139cb3ad9b8502d8b1bd02da9ce0b9df0 ] There is no clipping on the x or y axis for logos larger that the framebuffer size. Therefore: a logo bigger than screen size leads to invalid memory access: [ 1.254664] Backtrace: [ 1.254728] [] (cfb_imageblit) from [] (fb_show_logo+0x620/0x684) [ 1.254763] r10:00000003 r9:00027fd8 r8:c6a40000 r7:c6a36e50 r6:00000000 r5:c06b81e4 [ 1.254774] r4:c6a3e800 [ 1.254810] [] (fb_show_logo) from [] (fbcon_switch+0x3fc/0x46c) [ 1.254842] r10:c6a3e824 r9:c6a3e800 r8:00000000 r7:c6a0c000 r6:c070b014 r5:c6a3e800 [ 1.254852] r4:c6808c00 [ 1.254889] [] (fbcon_switch) from [] (redraw_screen+0xf0/0x1e8) [ 1.254918] r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:c070d5a0 r5:00000080 [ 1.254928] r4:c6808c00 [ 1.254961] [] (redraw_screen) from [] (do_bind_con_driver+0x194/0x2e4) [ 1.254991] r9:00000000 r8:00000000 r7:00000014 r6:c070d5a0 r5:c070d5a0 r4:c070d5a0 So prevent displaying a logo bigger than screen size and avoid invalid memory access. Signed-off-by: Manfred Schlaegl Signed-off-by: Martin Kepplinger Cc: Daniel Vetter Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Sasha Levin --- drivers/video/fbdev/core/fbmem.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c index cb43a2258c51..4721491e6c8c 100644 --- a/drivers/video/fbdev/core/fbmem.c +++ b/drivers/video/fbdev/core/fbmem.c @@ -431,6 +431,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image, { unsigned int x; + if (image->width > info->var.xres || image->height > info->var.yres) + return; + if (rotate == FB_ROTATE_UR) { for (x = 0; x < num && image->dx + image->width <= info->var.xres; -- 2.19.1 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sasha Levin Date: Wed, 27 Mar 2019 18:00:23 +0000 Subject: [PATCH AUTOSEL 5.0 168/262] fbdev: fbmem: fix memory access if logo is bigger than the screen Message-Id: <20190327180158.10245-168-sashal@kernel.org> List-Id: References: <20190327180158.10245-1-sashal@kernel.org> In-Reply-To: <20190327180158.10245-1-sashal@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Sasha Levin , linux-fbdev@vger.kernel.org, Bartlomiej Zolnierkiewicz , Manfred Schlaegl , Daniel Vetter , Martin Kepplinger , dri-devel@lists.freedesktop.org From: Manfred Schlaegl [ Upstream commit a5399db139cb3ad9b8502d8b1bd02da9ce0b9df0 ] There is no clipping on the x or y axis for logos larger that the framebuffer size. Therefore: a logo bigger than screen size leads to invalid memory access: [ 1.254664] Backtrace: [ 1.254728] [] (cfb_imageblit) from [] (fb_show_logo+0x620/0x684) [ 1.254763] r10:00000003 r9:00027fd8 r8:c6a40000 r7:c6a36e50 r6:00000000 r5:c06b81e4 [ 1.254774] r4:c6a3e800 [ 1.254810] [] (fb_show_logo) from [] (fbcon_switch+0x3fc/0x46c) [ 1.254842] r10:c6a3e824 r9:c6a3e800 r8:00000000 r7:c6a0c000 r6:c070b014 r5:c6a3e800 [ 1.254852] r4:c6808c00 [ 1.254889] [] (fbcon_switch) from [] (redraw_screen+0xf0/0x1e8) [ 1.254918] r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:c070d5a0 r5:00000080 [ 1.254928] r4:c6808c00 [ 1.254961] [] (redraw_screen) from [] (do_bind_con_driver+0x194/0x2e4) [ 1.254991] r9:00000000 r8:00000000 r7:00000014 r6:c070d5a0 r5:c070d5a0 r4:c070d5a0 So prevent displaying a logo bigger than screen size and avoid invalid memory access. Signed-off-by: Manfred Schlaegl Signed-off-by: Martin Kepplinger Cc: Daniel Vetter Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Sasha Levin --- drivers/video/fbdev/core/fbmem.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c index cb43a2258c51..4721491e6c8c 100644 --- a/drivers/video/fbdev/core/fbmem.c +++ b/drivers/video/fbdev/core/fbmem.c @@ -431,6 +431,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image, { unsigned int x; + if (image->width > info->var.xres || image->height > info->var.yres) + return; + if (rotate = FB_ROTATE_UR) { for (x = 0; x < num && image->dx + image->width <= info->var.xres; -- 2.19.1 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sasha Levin Subject: [PATCH AUTOSEL 5.0 168/262] fbdev: fbmem: fix memory access if logo is bigger than the screen Date: Wed, 27 Mar 2019 14:00:23 -0400 Message-ID: <20190327180158.10245-168-sashal@kernel.org> References: <20190327180158.10245-1-sashal@kernel.org> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by gabe.freedesktop.org (Postfix) with ESMTPS id 0A3CD89B46 for ; Wed, 27 Mar 2019 18:07:19 +0000 (UTC) In-Reply-To: <20190327180158.10245-1-sashal@kernel.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Sasha Levin , linux-fbdev@vger.kernel.org, Bartlomiej Zolnierkiewicz , Manfred Schlaegl , Daniel Vetter , Martin Kepplinger , dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org RnJvbTogTWFuZnJlZCBTY2hsYWVnbCA8bWFuZnJlZC5zY2hsYWVnbEBnaW56aW5nZXIuY29tPgoK WyBVcHN0cmVhbSBjb21taXQgYTUzOTlkYjEzOWNiM2FkOWI4NTAyZDhiMWJkMDJkYTljZTBiOWRm MCBdCgpUaGVyZSBpcyBubyBjbGlwcGluZyBvbiB0aGUgeCBvciB5IGF4aXMgZm9yIGxvZ29zIGxh cmdlciB0aGF0IHRoZSBmcmFtZWJ1ZmZlcgpzaXplLiBUaGVyZWZvcmU6IGEgbG9nbyBiaWdnZXIg dGhhbiBzY3JlZW4gc2l6ZSBsZWFkcyB0byBpbnZhbGlkIG1lbW9yeSBhY2Nlc3M6CgpbICAgIDEu MjU0NjY0XSBCYWNrdHJhY2U6ClsgICAgMS4yNTQ3MjhdIFs8YzAyNzE0ZTA+XSAoY2ZiX2ltYWdl YmxpdCkgZnJvbSBbPGMwMjYxODRjPl0gKGZiX3Nob3dfbG9nbysweDYyMC8weDY4NCkKWyAgICAx LjI1NDc2M10gIHIxMDowMDAwMDAwMyByOTowMDAyN2ZkOCByODpjNmE0MDAwMCByNzpjNmEzNmU1 MCByNjowMDAwMDAwMCByNTpjMDZiODFlNApbICAgIDEuMjU0Nzc0XSAgcjQ6YzZhM2U4MDAKWyAg ICAxLjI1NDgxMF0gWzxjMDI2MTIyYz5dIChmYl9zaG93X2xvZ28pIGZyb20gWzxjMDI2YzFlND5d IChmYmNvbl9zd2l0Y2grMHgzZmMvMHg0NmMpClsgICAgMS4yNTQ4NDJdICByMTA6YzZhM2U4MjQg cjk6YzZhM2U4MDAgcjg6MDAwMDAwMDAgcjc6YzZhMGMwMDAgcjY6YzA3MGIwMTQgcjU6YzZhM2U4 MDAKWyAgICAxLjI1NDg1Ml0gIHI0OmM2ODA4YzAwClsgICAgMS4yNTQ4ODldIFs8YzAyNmJkZTg+ XSAoZmJjb25fc3dpdGNoKSBmcm9tIFs8YzAyOWM4Zjg+XSAocmVkcmF3X3NjcmVlbisweGYwLzB4 MWU4KQpbICAgIDEuMjU0OTE4XSAgcjEwOjAwMDAwMDAwIHI5OjAwMDAwMDAwIHI4OjAwMDAwMDAw IHI3OjAwMDAwMDAwIHI2OmMwNzBkNWEwIHI1OjAwMDAwMDgwClsgICAgMS4yNTQ5MjhdICByNDpj NjgwOGMwMApbICAgIDEuMjU0OTYxXSBbPGMwMjljODA4Pl0gKHJlZHJhd19zY3JlZW4pIGZyb20g WzxjMDI5ZDI2ND5dIChkb19iaW5kX2Nvbl9kcml2ZXIrMHgxOTQvMHgyZTQpClsgICAgMS4yNTQ5 OTFdICByOTowMDAwMDAwMCByODowMDAwMDAwMCByNzowMDAwMDAxNCByNjpjMDcwZDVhMCByNTpj MDcwZDVhMCByNDpjMDcwZDVhMAoKU28gcHJldmVudCBkaXNwbGF5aW5nIGEgbG9nbyBiaWdnZXIg dGhhbiBzY3JlZW4gc2l6ZSBhbmQgYXZvaWQgaW52YWxpZAptZW1vcnkgYWNjZXNzLgoKU2lnbmVk LW9mZi1ieTogTWFuZnJlZCBTY2hsYWVnbCA8bWFuZnJlZC5zY2hsYWVnbEBnaW56aW5nZXIuY29t PgpTaWduZWQtb2ZmLWJ5OiBNYXJ0aW4gS2VwcGxpbmdlciA8bWFydGluLmtlcHBsaW5nZXJAZ2lu emluZ2VyLmNvbT4KQ2M6IERhbmllbCBWZXR0ZXIgPGRhbmllbC52ZXR0ZXJAZmZ3bGwuY2g+ClNp Z25lZC1vZmYtYnk6IEJhcnRsb21pZWogWm9sbmllcmtpZXdpY3ogPGIuem9sbmllcmtpZUBzYW1z dW5nLmNvbT4KU2lnbmVkLW9mZi1ieTogU2FzaGEgTGV2aW4gPHNhc2hhbEBrZXJuZWwub3JnPgot LS0KIGRyaXZlcnMvdmlkZW8vZmJkZXYvY29yZS9mYm1lbS5jIHwgMyArKysKIDEgZmlsZSBjaGFu Z2VkLCAzIGluc2VydGlvbnMoKykKCmRpZmYgLS1naXQgYS9kcml2ZXJzL3ZpZGVvL2ZiZGV2L2Nv cmUvZmJtZW0uYyBiL2RyaXZlcnMvdmlkZW8vZmJkZXYvY29yZS9mYm1lbS5jCmluZGV4IGNiNDNh MjI1OGM1MS4uNDcyMTQ5MWU2YzhjIDEwMDY0NAotLS0gYS9kcml2ZXJzL3ZpZGVvL2ZiZGV2L2Nv cmUvZmJtZW0uYworKysgYi9kcml2ZXJzL3ZpZGVvL2ZiZGV2L2NvcmUvZmJtZW0uYwpAQCAtNDMx LDYgKzQzMSw5IEBAIHN0YXRpYyB2b2lkIGZiX2RvX3Nob3dfbG9nbyhzdHJ1Y3QgZmJfaW5mbyAq aW5mbywgc3RydWN0IGZiX2ltYWdlICppbWFnZSwKIHsKIAl1bnNpZ25lZCBpbnQgeDsKIAorCWlm IChpbWFnZS0+d2lkdGggPiBpbmZvLT52YXIueHJlcyB8fCBpbWFnZS0+aGVpZ2h0ID4gaW5mby0+ dmFyLnlyZXMpCisJCXJldHVybjsKKwogCWlmIChyb3RhdGUgPT0gRkJfUk9UQVRFX1VSKSB7CiAJ CWZvciAoeCA9IDA7CiAJCSAgICAgeCA8IG51bSAmJiBpbWFnZS0+ZHggKyBpbWFnZS0+d2lkdGgg PD0gaW5mby0+dmFyLnhyZXM7Ci0tIAoyLjE5LjEKCl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fCmRyaS1kZXZlbCBtYWlsaW5nIGxpc3QKZHJpLWRldmVsQGxp c3RzLmZyZWVkZXNrdG9wLm9yZwpodHRwczovL2xpc3RzLmZyZWVkZXNrdG9wLm9yZy9tYWlsbWFu L2xpc3RpbmZvL2RyaS1kZXZlbA==