[PATCH v3 0/4] fbcon: Fixes for screen resolution changes

[PATCH v3 0/4] fbcon: Fixes for screen resolution changes

[Helge Deller]

This series fixes possible out-of-bound memory accesses when users trigger
screen resolutions changes with invalid input parameters, e.g. reconfigures
screen which is smaller than the current font size, or if the virtual screen
size is smaller than the physical screen size.

Helge Deller (4):
  fbcon: Disallow setting font bigger than screen size
  fbcon: Add fbcon_modechange_possible() check
  fbmem: Check screen resolution change against font size
  fbmem: Prevent invalid virtual screen sizes

 drivers/video/fbdev/core/fbcon.c | 32 ++++++++++++++++++++++++++++++++
 drivers/video/fbdev/core/fbmem.c | 10 +++++++++-
 include/linux/fbcon.h            |  4 ++++
 3 files changed, 45 insertions(+), 1 deletion(-)

--
2.35.3

[PATCH v3 1/4] fbcon: Disallow setting font bigger than screen size

[Helge Deller]

Prevent that users set a font size which is bigger than the physical screen.
It's unlikely this may happen (because screens are usually much larger than the
fonts and each font char is limited to 32x32 pixels), but it may happen on
smaller screens/LCD displays.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: stable@vger.kernel.org # v4.14+
---
 drivers/video/fbdev/core/fbcon.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index c4e91715ef00..e162d5e753e5 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2469,6 +2469,11 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font,
 	if (charcount != 256 && charcount != 512)
 		return -EINVAL;

+	/* font bigger than screen resolution ? */
+	if (font->width  > FBCON_SWAP(info->var.rotate, info->var.xres, info->var.yres) ||
+	    font->height > FBCON_SWAP(info->var.rotate, info->var.yres, info->var.xres))
+		return -EINVAL;
+
 	/* Make sure drawing engine can handle the font */
 	if (!(info->pixmap.blit_x & (1 << (font->width - 1))) ||
 	    !(info->pixmap.blit_y & (1 << (font->height - 1))))
--
2.35.3

[PATCH v3 2/4] fbcon: Add fbcon_modechange_possible() check

[Helge Deller]

We need to prevent that users configure a screen size which is smaller than the
currently selected font size. Otherwise rendering chars on the screen will
access memory outside the graphics memory region.

This patch adds a new function fbcon_modechange_possible() which implements
this check and which may be extended with other checks later if necessary.  The
new function will be called from the FBIOPUT_VSCREENINFO ioctl handler in
fbmem.c, which will then return -EINVAL to the user if the new screen size is
too small.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org # v5.4+
---
 drivers/video/fbdev/core/fbcon.c | 27 +++++++++++++++++++++++++++
 include/linux/fbcon.h            |  4 ++++
 2 files changed, 31 insertions(+)

diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index e162d5e753e5..2ab7515ac842 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2736,6 +2736,33 @@ void fbcon_update_vcs(struct fb_info *info, bool all)
 }
 EXPORT_SYMBOL(fbcon_update_vcs);

+/* let fbcon check if it supports a new screen resolution */
+int fbcon_modechange_possible(struct fb_info *info, struct fb_var_screeninfo *var)
+{
+	struct fbcon_ops *ops = info->fbcon_par;
+	struct vc_data *vc;
+	int i;
+
+	WARN_CONSOLE_UNLOCKED();
+
+	if (!ops || ops->currcon < 0)
+		return -EINVAL;
+
+	/* prevent setting a screen size which is smaller than font size */
+	for (i = first_fb_vc; i <= last_fb_vc; i++) {
+		vc = vc_cons[i].d;
+		if (!vc || fbcon_info_from_console(i) != info)
+			continue;
+
+		if (vc->vc_font.width  > FBCON_SWAP(var->rotate, var->xres, var->yres) ||
+		    vc->vc_font.height > FBCON_SWAP(var->rotate, var->yres, var->xres))
+			return -EINVAL;
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL(fbcon_modechange_possible);
+
 int fbcon_mode_deleted(struct fb_info *info,
 		       struct fb_videomode *mode)
 {
diff --git a/include/linux/fbcon.h b/include/linux/fbcon.h
index ff5596dd30f8..2382dec6d6ab 100644
--- a/include/linux/fbcon.h
+++ b/include/linux/fbcon.h
@@ -15,6 +15,8 @@ void fbcon_new_modelist(struct fb_info *info);
 void fbcon_get_requirement(struct fb_info *info,
 			   struct fb_blit_caps *caps);
 void fbcon_fb_blanked(struct fb_info *info, int blank);
+int  fbcon_modechange_possible(struct fb_info *info,
+			       struct fb_var_screeninfo *var);
 void fbcon_update_vcs(struct fb_info *info, bool all);
 void fbcon_remap_all(struct fb_info *info);
 int fbcon_set_con2fb_map_ioctl(void __user *argp);
@@ -33,6 +35,8 @@ static inline void fbcon_new_modelist(struct fb_info *info) {}
 static inline void fbcon_get_requirement(struct fb_info *info,
 					 struct fb_blit_caps *caps) {}
 static inline void fbcon_fb_blanked(struct fb_info *info, int blank) {}
+static inline int  fbcon_modechange_possible(struct fb_info *info,
+				struct fb_var_screeninfo *var) { return 0; }
 static inline void fbcon_update_vcs(struct fb_info *info, bool all) {}
 static inline void fbcon_remap_all(struct fb_info *info) {}
 static inline int fbcon_set_con2fb_map_ioctl(void __user *argp) { return 0; }
--
2.35.3

[PATCH v3 3/4] fbmem: Check screen resolution change against font size

[Helge Deller]

Enhance the check in the FBIOPUT_VSCREENINFO ioctl handler to verify if the
user-provided new screen size is bigger than the current font size.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org # v5.4+
---
 drivers/video/fbdev/core/fbmem.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index afa2863670f3..160389365a36 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -1106,7 +1106,9 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
 			return -EFAULT;
 		console_lock();
 		lock_fb_info(info);
-		ret = fb_set_var(info, &var);
+		ret = fbcon_modechange_possible(info, &var);
+		if (!ret)
+			ret = fb_set_var(info, &var);
 		if (!ret)
 			fbcon_update_vcs(info, var.activate & FB_ACTIVATE_ALL);
 		unlock_fb_info(info);
--
2.35.3

Re: [PATCH v3 3/4] fbmem: Check screen resolution change against font size

[Daniel Vetter]

On Sun, Jun 26, 2022 at 12:06:29AM +0200, Helge Deller wrote:
> Enhance the check in the FBIOPUT_VSCREENINFO ioctl handler to verify if the
> user-provided new screen size is bigger than the current font size.
> 
> Signed-off-by: Helge Deller <deller@gmx.de>
> Cc: stable@vger.kernel.org # v5.4+

Please squash with previous patch. You might also want to add a note there
that on older kernels backporters need to open-code
fbcon_info_from_console instead, since it only exists since 
409d6c95f9c6 ("fbcon: Introduce wrapper for console->fb_info lookup")

With these two nits: Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>

> ---
>  drivers/video/fbdev/core/fbmem.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
> index afa2863670f3..160389365a36 100644
> --- a/drivers/video/fbdev/core/fbmem.c
> +++ b/drivers/video/fbdev/core/fbmem.c
> @@ -1106,7 +1106,9 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
>  			return -EFAULT;
>  		console_lock();
>  		lock_fb_info(info);
> -		ret = fb_set_var(info, &var);
> +		ret = fbcon_modechange_possible(info, &var);
> +		if (!ret)
> +			ret = fb_set_var(info, &var);
>  		if (!ret)
>  			fbcon_update_vcs(info, var.activate & FB_ACTIVATE_ALL);
>  		unlock_fb_info(info);
> --
> 2.35.3
> 

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch

Re: [PATCH v3 3/4] fbmem: Check screen resolution change against font size

[Daniel Vetter]

On Sun, Jun 26, 2022 at 12:33:53AM +0200, Daniel Vetter wrote:
> On Sun, Jun 26, 2022 at 12:06:29AM +0200, Helge Deller wrote:
> > Enhance the check in the FBIOPUT_VSCREENINFO ioctl handler to verify if the
> > user-provided new screen size is bigger than the current font size.
> > 
> > Signed-off-by: Helge Deller <deller@gmx.de>
> > Cc: stable@vger.kernel.org # v5.4+
> 
> Please squash with previous patch. You might also want to add a note there
> that on older kernels backporters need to open-code
> fbcon_info_from_console instead, since it only exists since 
> 409d6c95f9c6 ("fbcon: Introduce wrapper for console->fb_info lookup")

Maybe easier would be to include that patch in the backports instead of
open coding. I think that's what Greg generally prefers at least, less
divergence between stable kernels.
-Daniel

> 
> With these two nits: Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
> 
> > ---
> >  drivers/video/fbdev/core/fbmem.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
> > index afa2863670f3..160389365a36 100644
> > --- a/drivers/video/fbdev/core/fbmem.c
> > +++ b/drivers/video/fbdev/core/fbmem.c
> > @@ -1106,7 +1106,9 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
> >  			return -EFAULT;
> >  		console_lock();
> >  		lock_fb_info(info);
> > -		ret = fb_set_var(info, &var);
> > +		ret = fbcon_modechange_possible(info, &var);
> > +		if (!ret)
> > +			ret = fb_set_var(info, &var);
> >  		if (!ret)
> >  			fbcon_update_vcs(info, var.activate & FB_ACTIVATE_ALL);
> >  		unlock_fb_info(info);
> > --
> > 2.35.3
> > 
> 
> -- 
> Daniel Vetter
> Software Engineer, Intel Corporation
> http://blog.ffwll.ch

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch

Re: [PATCH v3 3/4] fbmem: Check screen resolution change against font size

[Helge Deller]

On 6/26/22 00:37, Daniel Vetter wrote:
> On Sun, Jun 26, 2022 at 12:33:53AM +0200, Daniel Vetter wrote:
>> On Sun, Jun 26, 2022 at 12:06:29AM +0200, Helge Deller wrote:
>>> Enhance the check in the FBIOPUT_VSCREENINFO ioctl handler to verify if the
>>> user-provided new screen size is bigger than the current font size.
>>>
>>> Signed-off-by: Helge Deller <deller@gmx.de>
>>> Cc: stable@vger.kernel.org # v5.4+
>>
>> Please squash with previous patch. You might also want to add a note there
>> that on older kernels backporters need to open-code
>> fbcon_info_from_console instead, since it only exists since
>> 409d6c95f9c6 ("fbcon: Introduce wrapper for console->fb_info lookup")
>
> Maybe easier would be to include that patch in the backports instead of
> open coding.

I was afraid that WARN_CONSOLE_UNLOCKED() hadn't been backported.
But it seems it's in v4.19+ (from patch 56e6c104e4f15), so that's ok.

So, yes, it seems pushing 409d6c95f9c6 backwards is probably best.

Will try that approach now.

Helge

 I think that's what Greg generally prefers at least, less
> divergence between stable kernels.
> -Daniel
>
>>
>> With these two nits: Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
>>
>>> ---
>>>  drivers/video/fbdev/core/fbmem.c | 4 +++-
>>>  1 file changed, 3 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
>>> index afa2863670f3..160389365a36 100644
>>> --- a/drivers/video/fbdev/core/fbmem.c
>>> +++ b/drivers/video/fbdev/core/fbmem.c
>>> @@ -1106,7 +1106,9 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
>>>  			return -EFAULT;
>>>  		console_lock();
>>>  		lock_fb_info(info);
>>> -		ret = fb_set_var(info, &var);
>>> +		ret = fbcon_modechange_possible(info, &var);
>>> +		if (!ret)
>>> +			ret = fb_set_var(info, &var);
>>>  		if (!ret)
>>>  			fbcon_update_vcs(info, var.activate & FB_ACTIVATE_ALL);
>>>  		unlock_fb_info(info);
>>> --
>>> 2.35.3
>>>
>>
>> --
>> Daniel Vetter
>> Software Engineer, Intel Corporation
>> http://blog.ffwll.ch
>

Re: [PATCH v3 3/4] fbmem: Check screen resolution change against font size

[Helge Deller]

On 6/26/22 01:12, Helge Deller wrote:
> On 6/26/22 00:37, Daniel Vetter wrote:
>> On Sun, Jun 26, 2022 at 12:33:53AM +0200, Daniel Vetter wrote:
>>> On Sun, Jun 26, 2022 at 12:06:29AM +0200, Helge Deller wrote:
>>>> Enhance the check in the FBIOPUT_VSCREENINFO ioctl handler to verify if the
>>>> user-provided new screen size is bigger than the current font size.
>>>>
>>>> Signed-off-by: Helge Deller <deller@gmx.de>
>>>> Cc: stable@vger.kernel.org # v5.4+
>>>
>>> Please squash with previous patch. You might also want to add a note there
>>> that on older kernels backporters need to open-code
>>> fbcon_info_from_console instead, since it only exists since
>>> 409d6c95f9c6 ("fbcon: Introduce wrapper for console->fb_info lookup")
>>
>> Maybe easier would be to include that patch in the backports instead of
>> open coding.
>
> I was afraid that WARN_CONSOLE_UNLOCKED() hadn't been backported.
> But it seems it's in v4.19+ (from patch 56e6c104e4f15), so that's ok.
>
> So, yes, it seems pushing 409d6c95f9c6 backwards is probably best.

It would be the best solution, but sadly 409d6c95f9c6 can't easily be backported.
So, probably my other approach (fix up afterwards with extra patch) is
the way to go.

What's your thought on this ?

Helge



> Will try that approach now.
>
> Helge
>
>  I think that's what Greg generally prefers at least, less
>> divergence between stable kernels.
>> -Daniel
>>
>>>
>>> With these two nits: Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
>>>
>>>> ---
>>>>  drivers/video/fbdev/core/fbmem.c | 4 +++-
>>>>  1 file changed, 3 insertions(+), 1 deletion(-)
>>>>
>>>> diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
>>>> index afa2863670f3..160389365a36 100644
>>>> --- a/drivers/video/fbdev/core/fbmem.c
>>>> +++ b/drivers/video/fbdev/core/fbmem.c
>>>> @@ -1106,7 +1106,9 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
>>>>  			return -EFAULT;
>>>>  		console_lock();
>>>>  		lock_fb_info(info);
>>>> -		ret = fb_set_var(info, &var);
>>>> +		ret = fbcon_modechange_possible(info, &var);
>>>> +		if (!ret)
>>>> +			ret = fb_set_var(info, &var);
>>>>  		if (!ret)
>>>>  			fbcon_update_vcs(info, var.activate & FB_ACTIVATE_ALL);
>>>>  		unlock_fb_info(info);
>>>> --
>>>> 2.35.3
>>>>
>>>
>>> --
>>> Daniel Vetter
>>> Software Engineer, Intel Corporation
>>> http://blog.ffwll.ch
>>
>

Re: [PATCH v3 3/4] fbmem: Check screen resolution change against font size

[Daniel Vetter]

On Sun, Jun 26, 2022 at 01:56:18AM +0200, Helge Deller wrote:
> On 6/26/22 01:12, Helge Deller wrote:
> > On 6/26/22 00:37, Daniel Vetter wrote:
> >> On Sun, Jun 26, 2022 at 12:33:53AM +0200, Daniel Vetter wrote:
> >>> On Sun, Jun 26, 2022 at 12:06:29AM +0200, Helge Deller wrote:
> >>>> Enhance the check in the FBIOPUT_VSCREENINFO ioctl handler to verify if the
> >>>> user-provided new screen size is bigger than the current font size.
> >>>>
> >>>> Signed-off-by: Helge Deller <deller@gmx.de>
> >>>> Cc: stable@vger.kernel.org # v5.4+
> >>>
> >>> Please squash with previous patch. You might also want to add a note there
> >>> that on older kernels backporters need to open-code
> >>> fbcon_info_from_console instead, since it only exists since
> >>> 409d6c95f9c6 ("fbcon: Introduce wrapper for console->fb_info lookup")
> >>
> >> Maybe easier would be to include that patch in the backports instead of
> >> open coding.
> >
> > I was afraid that WARN_CONSOLE_UNLOCKED() hadn't been backported.
> > But it seems it's in v4.19+ (from patch 56e6c104e4f15), so that's ok.
> >
> > So, yes, it seems pushing 409d6c95f9c6 backwards is probably best.
> 
> It would be the best solution, but sadly 409d6c95f9c6 can't easily be backported.
> So, probably my other approach (fix up afterwards with extra patch) is
> the way to go.

Ah right there's some conflicts with the restoration/removal of scroll
accel.

> What's your thought on this ?

I guess just open code in a separate backport is simplest.
-Daniel

> 
> Helge
> 
> 
> 
> > Will try that approach now.
> >
> > Helge
> >
> >  I think that's what Greg generally prefers at least, less
> >> divergence between stable kernels.
> >> -Daniel
> >>
> >>>
> >>> With these two nits: Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
> >>>
> >>>> ---
> >>>>  drivers/video/fbdev/core/fbmem.c | 4 +++-
> >>>>  1 file changed, 3 insertions(+), 1 deletion(-)
> >>>>
> >>>> diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
> >>>> index afa2863670f3..160389365a36 100644
> >>>> --- a/drivers/video/fbdev/core/fbmem.c
> >>>> +++ b/drivers/video/fbdev/core/fbmem.c
> >>>> @@ -1106,7 +1106,9 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
> >>>>  			return -EFAULT;
> >>>>  		console_lock();
> >>>>  		lock_fb_info(info);
> >>>> -		ret = fb_set_var(info, &var);
> >>>> +		ret = fbcon_modechange_possible(info, &var);
> >>>> +		if (!ret)
> >>>> +			ret = fb_set_var(info, &var);
> >>>>  		if (!ret)
> >>>>  			fbcon_update_vcs(info, var.activate & FB_ACTIVATE_ALL);
> >>>>  		unlock_fb_info(info);
> >>>> --
> >>>> 2.35.3
> >>>>
> >>>
> >>> --
> >>> Daniel Vetter
> >>> Software Engineer, Intel Corporation
> >>> http://blog.ffwll.ch
> >>
> >
> 

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch

Re: [PATCH v3 3/4] fbmem: Check screen resolution change against font size

[Helge Deller]

On 6/26/22 10:49, Daniel Vetter wrote:
> On Sun, Jun 26, 2022 at 01:56:18AM +0200, Helge Deller wrote:
>> On 6/26/22 01:12, Helge Deller wrote:
>>> On 6/26/22 00:37, Daniel Vetter wrote:
>>>> On Sun, Jun 26, 2022 at 12:33:53AM +0200, Daniel Vetter wrote:
>>>>> On Sun, Jun 26, 2022 at 12:06:29AM +0200, Helge Deller wrote:
>>>>>> Enhance the check in the FBIOPUT_VSCREENINFO ioctl handler to verify if the
>>>>>> user-provided new screen size is bigger than the current font size.
>>>>>>
>>>>>> Signed-off-by: Helge Deller <deller@gmx.de>
>>>>>> Cc: stable@vger.kernel.org # v5.4+
>>>>>
>>>>> Please squash with previous patch. You might also want to add a note there
>>>>> that on older kernels backporters need to open-code
>>>>> fbcon_info_from_console instead, since it only exists since
>>>>> 409d6c95f9c6 ("fbcon: Introduce wrapper for console->fb_info lookup")
>>>>
>>>> Maybe easier would be to include that patch in the backports instead of
>>>> open coding.
>>>
>>> I was afraid that WARN_CONSOLE_UNLOCKED() hadn't been backported.
>>> But it seems it's in v4.19+ (from patch 56e6c104e4f15), so that's ok.
>>>
>>> So, yes, it seems pushing 409d6c95f9c6 backwards is probably best.
>>
>> It would be the best solution, but sadly 409d6c95f9c6 can't easily be backported.
>> So, probably my other approach (fix up afterwards with extra patch) is
>> the way to go.
>
> Ah right there's some conflicts with the restoration/removal of scroll
> accel.
>
>> What's your thought on this ?
>
> I guess just open code in a separate backport is simplest.

I think my just-sent series is somewhat smarter... use old open-coding
in patch which goes backwards, and then just fix up in v5.19 (where
commit 409d6c95f9c6 was added).

Helge



> -Daniel
>
>>
>> Helge
>>
>>
>>
>>> Will try that approach now.
>>>
>>> Helge
>>>
>>>  I think that's what Greg generally prefers at least, less
>>>> divergence between stable kernels.
>>>> -Daniel
>>>>
>>>>>
>>>>> With these two nits: Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
>>>>>
>>>>>> ---
>>>>>>  drivers/video/fbdev/core/fbmem.c | 4 +++-
>>>>>>  1 file changed, 3 insertions(+), 1 deletion(-)
>>>>>>
>>>>>> diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
>>>>>> index afa2863670f3..160389365a36 100644
>>>>>> --- a/drivers/video/fbdev/core/fbmem.c
>>>>>> +++ b/drivers/video/fbdev/core/fbmem.c
>>>>>> @@ -1106,7 +1106,9 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
>>>>>>  			return -EFAULT;
>>>>>>  		console_lock();
>>>>>>  		lock_fb_info(info);
>>>>>> -		ret = fb_set_var(info, &var);
>>>>>> +		ret = fbcon_modechange_possible(info, &var);
>>>>>> +		if (!ret)
>>>>>> +			ret = fb_set_var(info, &var);
>>>>>>  		if (!ret)
>>>>>>  			fbcon_update_vcs(info, var.activate & FB_ACTIVATE_ALL);
>>>>>>  		unlock_fb_info(info);
>>>>>> --
>>>>>> 2.35.3
>>>>>>
>>>>>
>>>>> --
>>>>> Daniel Vetter
>>>>> Software Engineer, Intel Corporation
>>>>> http://blog.ffwll.ch
>>>>
>>>
>>
>

Re: [PATCH v3 3/4] fbmem: Check screen resolution change against font size

[Helge Deller]

On 6/26/22 00:33, Daniel Vetter wrote:
> On Sun, Jun 26, 2022 at 12:06:29AM +0200, Helge Deller wrote:
>> Enhance the check in the FBIOPUT_VSCREENINFO ioctl handler to verify if the
>> user-provided new screen size is bigger than the current font size.
>>
>> Signed-off-by: Helge Deller <deller@gmx.de>
>> Cc: stable@vger.kernel.org # v5.4+
>
> Please squash with previous patch.

Will do.

> You might also want to add a note there
> that on older kernels backporters need to open-code
> fbcon_info_from_console instead, since it only exists since
> 409d6c95f9c6 ("fbcon: Introduce wrapper for console->fb_info lookup")

Good catch!
For sake of easier backportability I will change this (joined with previous) patch
to use registered_fb[]. Those patches can then easily be pushed backwards.
In addition I'll add another patch to this series which fixes registered_fb[] usage
back to fbcon_info_from_console(). That patch is only applied to v5.19.

Will send new series...

Helge

>
> With these two nits: Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
>
>> ---
>>  drivers/video/fbdev/core/fbmem.c | 4 +++-
>>  1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
>> index afa2863670f3..160389365a36 100644
>> --- a/drivers/video/fbdev/core/fbmem.c
>> +++ b/drivers/video/fbdev/core/fbmem.c
>> @@ -1106,7 +1106,9 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
>>  			return -EFAULT;
>>  		console_lock();
>>  		lock_fb_info(info);
>> -		ret = fb_set_var(info, &var);
>> +		ret = fbcon_modechange_possible(info, &var);
>> +		if (!ret)
>> +			ret = fb_set_var(info, &var);
>>  		if (!ret)
>>  			fbcon_update_vcs(info, var.activate & FB_ACTIVATE_ALL);
>>  		unlock_fb_info(info);
>> --
>> 2.35.3
>>
>

[PATCH v3 4/4] fbmem: Prevent invalid virtual screen sizes

[Helge Deller]

Prevent that drivers or the user sets the virtual screen resolution
smaller than the physical screen resolution.  This is important, because
otherwise we may get accesses outside of the graphics memory area.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org # v5.4+
---
 drivers/video/fbdev/core/fbmem.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index 160389365a36..b6e1d0f2b974 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -1006,6 +1006,12 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
 	if (var->xres < 8 || var->yres < 8)
 		return -EINVAL;

+	/* make sure virtual resolution >= physical resolution */
+	if (var->xres_virtual < var->xres)
+		return -EINVAL;
+	if (var->yres_virtual < var->yres)
+		return -EINVAL;
+
 	/* Too huge resolution causes multiplication overflow. */
 	if (check_mul_overflow(var->xres, var->yres, &unused) ||
 	    check_mul_overflow(var->xres_virtual, var->yres_virtual, &unused))
--
2.35.3

Re: [PATCH v3 4/4] fbmem: Prevent invalid virtual screen sizes

[Daniel Vetter]

On Sun, Jun 26, 2022 at 12:06:30AM +0200, Helge Deller wrote:
> Prevent that drivers or the user sets the virtual screen resolution
> smaller than the physical screen resolution.  This is important, because
> otherwise we may get accesses outside of the graphics memory area.
> 
> Signed-off-by: Helge Deller <deller@gmx.de>
> Cc: stable@vger.kernel.org # v5.4+

Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>

> ---
>  drivers/video/fbdev/core/fbmem.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
> index 160389365a36..b6e1d0f2b974 100644
> --- a/drivers/video/fbdev/core/fbmem.c
> +++ b/drivers/video/fbdev/core/fbmem.c
> @@ -1006,6 +1006,12 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
>  	if (var->xres < 8 || var->yres < 8)
>  		return -EINVAL;
> 
> +	/* make sure virtual resolution >= physical resolution */
> +	if (var->xres_virtual < var->xres)
> +		return -EINVAL;
> +	if (var->yres_virtual < var->yres)
> +		return -EINVAL;
> +
>  	/* Too huge resolution causes multiplication overflow. */
>  	if (check_mul_overflow(var->xres, var->yres, &unused) ||
>  	    check_mul_overflow(var->xres_virtual, var->yres_virtual, &unused))
> --
> 2.35.3
> 

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch