All of lore.kernel.org
 help / color / mirror / Atom feed
From: Chen Jun <chenjun102@huawei.com>
To: <stable@vger.kernel.org>, <gregkh@linuxfoundation.org>
Cc: <xuqiang36@huawei.com>
Subject: [PATCH stable 4.9 3/4] fbcon: Disallow setting font bigger than screen size
Date: Thu, 4 Aug 2022 08:14:08 +0000	[thread overview]
Message-ID: <20220804081409.121787-4-chenjun102@huawei.com> (raw)
In-Reply-To: <20220804081409.121787-1-chenjun102@huawei.com>

From: Helge Deller <deller@gmx.de>

commit 65a01e601dbba8b7a51a2677811f70f783766682 upstream.

Prevent that users set a font size which is bigger than the physical screen.
It's unlikely this may happen (because screens are usually much larger than the
fonts and each font char is limited to 32x32 pixels), but it may happen on
smaller screens/LCD displays.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: stable@vger.kernel.org # v4.14+
Link: https://lore.kernel.org/all/20220706150253.2186-1-deller@gmx.de/
Signed-off-by: Chen Jun <chenjun102@huawei.com>
---
 drivers/video/console/fbcon.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 510bc3f51dcc..e9eb8aaa2040 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -2428,6 +2428,11 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, unsigne
 	if (charcount != 256 && charcount != 512)
 		return -EINVAL;
 
+	/* font bigger than screen resolution ? */
+	if (w > FBCON_SWAP(info->var.rotate, info->var.xres, info->var.yres) ||
+	    h > FBCON_SWAP(info->var.rotate, info->var.yres, info->var.xres))
+		return -EINVAL;
+
 	/* Make sure drawing engine can handle the font */
 	if (!(info->pixmap.blit_x & (1 << (font->width - 1))) ||
 	    !(info->pixmap.blit_y & (1 << (font->height - 1))))
-- 
2.17.1


  parent reply	other threads:[~2022-08-04  8:16 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-08-04  8:14 [PATCH stable 4.9 0/4] Fix CVE-2021-33655 Chen Jun
2022-08-04  8:14 ` [PATCH stable 4.9 1/4] printk: Export is_console_locked Chen Jun
2022-08-04  8:14 ` [PATCH stable 4.9 2/4] fbmem: Check virtual screen sizes in fb_set_var() Chen Jun
2022-08-04  8:14 ` Chen Jun [this message]
2022-08-04  8:14 ` [PATCH stable 4.9 4/4] fbcon: Prevent that screen size is smaller than font size Chen Jun

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220804081409.121787-4-chenjun102@huawei.com \
    --to=chenjun102@huawei.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=stable@vger.kernel.org \
    --cc=xuqiang36@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.