linux-fbdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] fbcon: Out-Of-Bounds write in sys_imageblit, add range check
@ 2021-07-26 11:32 tcs_kernel(腾讯云内核开发者)
  2021-07-26 13:00 ` gregkh
       [not found] ` <YP68cQ4WVVusCv0N@ravnborg.org>
  0 siblings, 2 replies; 4+ messages in thread
From: tcs_kernel(腾讯云内核开发者) @ 2021-07-26 11:32 UTC (permalink / raw)
  To: gregkh, daniel.vetter, yepeilin.cs, penguin-kernel, tzimmermann,
	george.kennedy, ducheng2, sam
  Cc: dri-devel, linux-fbdev, linux-kernel

yres and vyres can be controlled by user mode paramaters, and cause p->vrows to become a negative value. While this value be passed to real_y function, the ypos will be out of screen range.
This is an out-of-bounds write bug.


diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 22bb3892f6bd..0970de46782f 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -1956,11 +1956,12 @@ static void updatescrollmode(struct fbcon_display *p,
        int yres = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
        int vyres = FBCON_SWAP(ops->rotate, info->var.yres_virtual,
                                   info->var.xres_virtual);
+       int rows = vc->vc_rows;
 
        p->vrows = vyres/fh;
-       if (yres > (fh * (vc->vc_rows + 1)))
-               p->vrows -= (yres - (fh * vc->vc_rows)) / fh;
-       if ((yres % fh) && (vyres % fh < yres % fh))
+       if ((yres > (fh * (rows + 1))) && (vyres >= (yres - (fh * rows))) && p->vrows)
+               p->vrows -= (yres - (fh * rows)) / fh;
+       if ((yres % fh) && (vyres % fh < yres % fh) && p->vrows)
                p->vrows--;
 }


^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2021-07-27  5:35 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-26 11:32 [PATCH] fbcon: Out-Of-Bounds write in sys_imageblit, add range check tcs_kernel(腾讯云内核开发者)
2021-07-26 13:00 ` gregkh
     [not found] ` <YP68cQ4WVVusCv0N@ravnborg.org>
2021-07-27  1:53   ` [Internet]Re: " tcs_kernel(腾讯云内核开发者)
2021-07-27  5:35     ` gregkh

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).