* [PATCH] fbdev: controlfb: Add missing modes to fix out of bounds access @ 2017-11-07 14:05 ` Geert Uytterhoeven 2017-11-09 16:11 ` Bartlomiej Zolnierkiewicz 0 siblings, 1 reply; 2+ messages in thread From: Geert Uytterhoeven @ 2017-11-07 14:05 UTC (permalink / raw) To: Bartlomiej Zolnierkiewicz Cc: Dan Carpenter, Benjamin Herrenschmidt, linux-fbdev, linuxppc-dev, linux-kernel, Geert Uytterhoeven Dan's static analysis says: drivers/video/fbdev/controlfb.c:560 control_setup() error: buffer overflow 'control_mac_modes' 20 <= 21 Indeed, control_mac_modes[] has only 20 elements, while VMODE_MAX is 22, which may lead to an out of bounds read when parsing vmode commandline options. The bug was introduced in v2.4.5.6, when 2 new modes were added to macmodes.h, but control_mac_modes[] wasn't updated: https://kernel.opensuse.org/cgit/kernel/diff/include/video/macmodes.h?h=v2.5.2&id=29f279c764808560eaceb88fef36cbc35c529aad Augment control_mac_modes[] with the two new video modes to fix this. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> --- Compile-tested only. The 1152x768 mode should be OK. Given the 1600x1024 mode has a lower dotclock (112 MHz) than the supported 1280x960 mode, it's probably OK, too. --- drivers/video/fbdev/controlfb.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/video/fbdev/controlfb.h b/drivers/video/fbdev/controlfb.h index 6026c60fc1007e00..261522fabdac89ae 100644 --- a/drivers/video/fbdev/controlfb.h +++ b/drivers/video/fbdev/controlfb.h @@ -141,5 +141,7 @@ static struct max_cmodes control_mac_modes[] = { {{ 1, 2}}, /* 1152x870, 75Hz */ {{ 0, 1}}, /* 1280x960, 75Hz */ {{ 0, 1}}, /* 1280x1024, 75Hz */ + {{ 1, 2}}, /* 1152x768, 60Hz */ + {{ 0, 1}}, /* 1600x1024, 60Hz */ }; -- 2.7.4 ^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] fbdev: controlfb: Add missing modes to fix out of bounds access 2017-11-07 14:05 ` [PATCH] fbdev: controlfb: Add missing modes to fix out of bounds access Geert Uytterhoeven @ 2017-11-09 16:11 ` Bartlomiej Zolnierkiewicz 0 siblings, 0 replies; 2+ messages in thread From: Bartlomiej Zolnierkiewicz @ 2017-11-09 16:11 UTC (permalink / raw) To: Geert Uytterhoeven Cc: Dan Carpenter, Benjamin Herrenschmidt, linux-fbdev, linuxppc-dev, linux-kernel On Tuesday, November 07, 2017 03:05:05 PM Geert Uytterhoeven wrote: > Dan's static analysis says: > > drivers/video/fbdev/controlfb.c:560 control_setup() > error: buffer overflow 'control_mac_modes' 20 <= 21 > > Indeed, control_mac_modes[] has only 20 elements, while VMODE_MAX is 22, > which may lead to an out of bounds read when parsing vmode commandline > options. > > The bug was introduced in v2.4.5.6, when 2 new modes were added to > macmodes.h, but control_mac_modes[] wasn't updated: > > https://kernel.opensuse.org/cgit/kernel/diff/include/video/macmodes.h?h=v2.5.2&id=29f279c764808560eaceb88fef36cbc35c529aad > > Augment control_mac_modes[] with the two new video modes to fix this. > > Reported-by: Dan Carpenter <dan.carpenter@oracle.com> > Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Patch queued for 4.15, thanks. Best regards, -- Bartlomiej Zolnierkiewicz Samsung R&D Institute Poland Samsung Electronics ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-11-09 16:11 UTC | newest] Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- [not found] <CGME20171107140514epcas4p2988fc367b675dd8facef2f2dba0908db@epcas4p2.samsung.com> 2017-11-07 14:05 ` [PATCH] fbdev: controlfb: Add missing modes to fix out of bounds access Geert Uytterhoeven 2017-11-09 16:11 ` Bartlomiej Zolnierkiewicz
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).