From 2e6300afb47960816ef5fec305a92ba0b783b3fc Mon Sep 17 00:00:00 2001 From: Thomas Zimmermann Date: May 26 2023 09:06:44 +0000 Subject: fbcon: Check font dimension limits (bsc#1154048) Changes: * rename drivers/video/fbdev/core to drivers/video/console --- diff --git a/patches.suse/0003-fbcon-Check-font-dimension-limits.patch b/patches.suse/0003-fbcon-Check-font-dimension-limits.patch new file mode 100644 index 0000000..50c6ce3 --- /dev/null +++ b/patches.suse/0003-fbcon-Check-font-dimension-limits.patch @@ -0,0 +1,54 @@ +From 2b09d5d364986f724f17001ccfe4126b9b43a0be Mon Sep 17 00:00:00 2001 +From: Samuel Thibault +Date: Sun, 29 Jan 2023 16:17:40 +0100 +Subject: fbcon: Check font dimension limits +Git-commit: 2b09d5d364986f724f17001ccfe4126b9b43a0be +Patch-mainline: v6.2-rc7 +References: bsc#1154048 + +blit_x and blit_y are u32, so fbcon currently cannot support fonts +larger than 32x32. + +The 32x32 case also needs shifting an unsigned int, to properly set bit +31, otherwise we get "UBSAN: shift-out-of-bounds in fbcon_set_font", +as reported on: + +http://lore.kernel.org/all/IA1PR07MB98308653E259A6F2CE94A4AFABCE9@IA1PR07MB9830.namprd07.prod.outlook.com +Kernel Branch: 6.2.0-rc5-next-20230124 +Kernel config: https://drive.google.com/file/d/1F-LszDAizEEH0ZX0HcSR06v5q8FPl2Uv/view?usp=sharing +Reproducer: https://drive.google.com/file/d/1mP1jcLBY7vWCNM60OMf-ogw-urQRjNrm/view?usp=sharing + +Reported-by: Sanan Hasanov +Signed-off-by: Samuel Thibault +Fixes: 2d2699d98492 ("fbcon: font setting should check limitation of driver") +Cc: stable@vger.kernel.org +Tested-by: Miko Larsson +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Helge Deller +Acked-by: Thomas Zimmermann +--- + drivers/video/console/fbcon.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c +index 14a7d404062c..1b14c21af2b7 100644 +--- a/drivers/video/console/fbcon.c ++++ b/drivers/video/console/fbcon.c +@@ -2495,9 +2495,12 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, + h > FBCON_SWAP(info->var.rotate, info->var.yres, info->var.xres)) + return -EINVAL; + ++ if (font->width > 32 || font->height > 32) ++ return -EINVAL; ++ + /* Make sure drawing engine can handle the font */ +- if (!(info->pixmap.blit_x & (1 << (font->width - 1))) || +- !(info->pixmap.blit_y & (1 << (font->height - 1)))) ++ if (!(info->pixmap.blit_x & BIT(font->width - 1)) || ++ !(info->pixmap.blit_y & BIT(font->height - 1))) + return -EINVAL; + + /* Make sure driver can handle the font length */ +-- +2.40.1 + diff --git a/series.conf b/series.conf index abbb93d..a21b5f5 100644 --- a/series.conf +++ b/series.conf @@ -63271,6 +63271,7 @@ patches.suse/sctp-fail-if-no-bound-addresses-can-be-used-for-a-gi.patch patches.suse/tracing-Make-sure-trace_printk-can-output-as-soon-as-it-can-be-used.patch patches.suse/0001-netrom-Fix-use-after-free-caused-by-accept-on-alread.patch + patches.suse/0003-fbcon-Check-font-dimension-limits.patch patches.suse/net-USB-Fix-wrong-direction-WARNING-in-plusb.c.patch patches.suse/usb-typec-altmodes-displayport-Fix-probe-pin-assign-.patch patches.suse/net-sched-tcindex-update-imperfect-hash-filters-resp.patch