From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 77580C19F2A for ; Thu, 11 Aug 2022 14:49:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234973AbiHKOtR (ORCPT ); Thu, 11 Aug 2022 10:49:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35096 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229594AbiHKOtP (ORCPT ); Thu, 11 Aug 2022 10:49:15 -0400 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6B1FC90802 for ; Thu, 11 Aug 2022 07:49:13 -0700 (PDT) Received: from localhost.localdomain (unknown [83.149.199.65]) by mail.ispras.ru (Postfix) with ESMTPS id BD73640D403E; Thu, 11 Aug 2022 14:49:10 +0000 (UTC) From: Andrey Strachuk To: Maarten Lankhorst Cc: Andrey Strachuk , Maxime Ripard , Thomas Zimmermann , David Airlie , Daniel Vetter , Geert Uytterhoeven , Helge Deller , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, ldv-project@linuxtesting.org Subject: [PATCH v2] drm/fb-helper: add virtual screen size check to drm_fb_helper_check_var() Date: Thu, 11 Aug 2022 17:48:50 +0300 Message-Id: <20220811144850.215377-1-strochuk@ispras.ru> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Add virtual screen size check to drm_fb_helper_check_var() in order to validate userspace input. Found by Linux Verification Center (linuxtesting.org) with syzkaller. Signed-off-by: Andrey Strachuk Fixes: 785b93ef8c30 ("drm/kms: move driver specific fb common code to helper functions (v2)") --- drivers/gpu/drm/drm_fb_helper.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c index 2d4cee6a10ff..5c8b211769eb 100644 --- a/drivers/gpu/drm/drm_fb_helper.c +++ b/drivers/gpu/drm/drm_fb_helper.c @@ -1355,6 +1355,12 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var, (drm_format_info_block_height(fb->format, 0) > 1)) return -EINVAL; + /* verify that virtual resolution >= physical resolution */ + if (var->xres_virtual < var->xres) + var->xres_virtual = var->xres; + if (var->yres_virtual < var->yres) + var->yres_virtual = var->yres; + /* * Changes struct fb_var_screeninfo are currently not pushed back * to KMS, hence fail if different settings are requested. -- 2.25.1 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id BFDA0C25B0C for ; Thu, 11 Aug 2022 14:49:24 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 1184FB307A; Thu, 11 Aug 2022 14:49:21 +0000 (UTC) Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by gabe.freedesktop.org (Postfix) with ESMTPS id AB217B30AB for ; Thu, 11 Aug 2022 14:49:13 +0000 (UTC) Received: from localhost.localdomain (unknown [83.149.199.65]) by mail.ispras.ru (Postfix) with ESMTPS id BD73640D403E; Thu, 11 Aug 2022 14:49:10 +0000 (UTC) From: Andrey Strachuk To: Maarten Lankhorst Subject: [PATCH v2] drm/fb-helper: add virtual screen size check to drm_fb_helper_check_var() Date: Thu, 11 Aug 2022 17:48:50 +0300 Message-Id: <20220811144850.215377-1-strochuk@ispras.ru> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: ldv-project@linuxtesting.org, Andrey Strachuk , Thomas Zimmermann , David Airlie , Helge Deller , linux-kernel@vger.kernel.org, Geert Uytterhoeven , dri-devel@lists.freedesktop.org Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Add virtual screen size check to drm_fb_helper_check_var() in order to validate userspace input. Found by Linux Verification Center (linuxtesting.org) with syzkaller. Signed-off-by: Andrey Strachuk Fixes: 785b93ef8c30 ("drm/kms: move driver specific fb common code to helper functions (v2)") --- drivers/gpu/drm/drm_fb_helper.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c index 2d4cee6a10ff..5c8b211769eb 100644 --- a/drivers/gpu/drm/drm_fb_helper.c +++ b/drivers/gpu/drm/drm_fb_helper.c @@ -1355,6 +1355,12 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var, (drm_format_info_block_height(fb->format, 0) > 1)) return -EINVAL; + /* verify that virtual resolution >= physical resolution */ + if (var->xres_virtual < var->xres) + var->xres_virtual = var->xres; + if (var->yres_virtual < var->yres) + var->yres_virtual = var->yres; + /* * Changes struct fb_var_screeninfo are currently not pushed back * to KMS, hence fail if different settings are requested. -- 2.25.1