* [PATCH] fbdev: fbmem: fix memory access if logo is bigger than the screen
@ 2019-01-28 10:04 ` Martin Kepplinger
2019-02-08 17:41 ` Bartlomiej Zolnierkiewicz
0 siblings, 1 reply; 2+ messages in thread
From: Martin Kepplinger @ 2019-01-28 10:04 UTC (permalink / raw)
To: linux-fbdev, dri-devel, b.zolnierkie
Cc: daniel.vetter, manfred.schlaegl, linux-kernel, Martin Kepplinger
From: Manfred Schlaegl <manfred.schlaegl@ginzinger.com>
There is no clipping on the x or y axis for logos larger that the framebuffer
size. Therefore: a logo bigger than screen size leads to invalid memory access:
[ 1.254664] Backtrace:
[ 1.254728] [<c02714e0>] (cfb_imageblit) from [<c026184c>] (fb_show_logo+0x620/0x684)
[ 1.254763] r10:00000003 r9:00027fd8 r8:c6a40000 r7:c6a36e50 r6:00000000 r5:c06b81e4
[ 1.254774] r4:c6a3e800
[ 1.254810] [<c026122c>] (fb_show_logo) from [<c026c1e4>] (fbcon_switch+0x3fc/0x46c)
[ 1.254842] r10:c6a3e824 r9:c6a3e800 r8:00000000 r7:c6a0c000 r6:c070b014 r5:c6a3e800
[ 1.254852] r4:c6808c00
[ 1.254889] [<c026bde8>] (fbcon_switch) from [<c029c8f8>] (redraw_screen+0xf0/0x1e8)
[ 1.254918] r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:c070d5a0 r5:00000080
[ 1.254928] r4:c6808c00
[ 1.254961] [<c029c808>] (redraw_screen) from [<c029d264>] (do_bind_con_driver+0x194/0x2e4)
[ 1.254991] r9:00000000 r8:00000000 r7:00000014 r6:c070d5a0 r5:c070d5a0 r4:c070d5a0
So prevent displaying a logo bigger than screen size and avoid invalid
memory access.
Signed-off-by: Manfred Schlaegl <manfred.schlaegl@ginzinger.com>
Signed-off-by: Martin Kepplinger <martin.kepplinger@ginzinger.com>
---
drivers/video/fbdev/core/fbmem.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index cb43a2258c51..4721491e6c8c 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -431,6 +431,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
{
unsigned int x;
+ if (image->width > info->var.xres || image->height > info->var.yres)
+ return;
+
if (rotate == FB_ROTATE_UR) {
for (x = 0;
x < num && image->dx + image->width <= info->var.xres;
--
2.20.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] fbdev: fbmem: fix memory access if logo is bigger than the screen
2019-01-28 10:04 ` [PATCH] fbdev: fbmem: fix memory access if logo is bigger than the screen Martin Kepplinger
@ 2019-02-08 17:41 ` Bartlomiej Zolnierkiewicz
0 siblings, 0 replies; 2+ messages in thread
From: Bartlomiej Zolnierkiewicz @ 2019-02-08 17:41 UTC (permalink / raw)
To: Martin Kepplinger
Cc: linux-fbdev, dri-devel, daniel.vetter, manfred.schlaegl,
linux-kernel, Martin Kepplinger
On 01/28/2019 11:04 AM, Martin Kepplinger wrote:
> From: Manfred Schlaegl <manfred.schlaegl@ginzinger.com>
>
> There is no clipping on the x or y axis for logos larger that the framebuffer
> size. Therefore: a logo bigger than screen size leads to invalid memory access:
>
> [ 1.254664] Backtrace:
> [ 1.254728] [<c02714e0>] (cfb_imageblit) from [<c026184c>] (fb_show_logo+0x620/0x684)
> [ 1.254763] r10:00000003 r9:00027fd8 r8:c6a40000 r7:c6a36e50 r6:00000000 r5:c06b81e4
> [ 1.254774] r4:c6a3e800
> [ 1.254810] [<c026122c>] (fb_show_logo) from [<c026c1e4>] (fbcon_switch+0x3fc/0x46c)
> [ 1.254842] r10:c6a3e824 r9:c6a3e800 r8:00000000 r7:c6a0c000 r6:c070b014 r5:c6a3e800
> [ 1.254852] r4:c6808c00
> [ 1.254889] [<c026bde8>] (fbcon_switch) from [<c029c8f8>] (redraw_screen+0xf0/0x1e8)
> [ 1.254918] r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:c070d5a0 r5:00000080
> [ 1.254928] r4:c6808c00
> [ 1.254961] [<c029c808>] (redraw_screen) from [<c029d264>] (do_bind_con_driver+0x194/0x2e4)
> [ 1.254991] r9:00000000 r8:00000000 r7:00000014 r6:c070d5a0 r5:c070d5a0 r4:c070d5a0
>
> So prevent displaying a logo bigger than screen size and avoid invalid
> memory access.
>
> Signed-off-by: Manfred Schlaegl <manfred.schlaegl@ginzinger.com>
> Signed-off-by: Martin Kepplinger <martin.kepplinger@ginzinger.com>
Patch queued for v5.1, thanks.
Best regards,
--
Bartlomiej Zolnierkiewicz
Samsung R&D Institute Poland
Samsung Electronics
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-02-08 17:41 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <CGME20190128100446epcas2p24b13ff5ae2af639b66d4bcd4d4722799@epcas2p2.samsung.com>
2019-01-28 10:04 ` [PATCH] fbdev: fbmem: fix memory access if logo is bigger than the screen Martin Kepplinger
2019-02-08 17:41 ` Bartlomiej Zolnierkiewicz
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).