From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DA37D2F6167; Tue, 30 Sep 2025 15:07:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1759244855; cv=none; b=hp/8Wm0DpD8sbZ0AtdUwsVIhseiHUgpIFA+4Gpf7nI0L0sT7oC1FJcm/6/QvoG1FlaZTGYCo8vmQbHbQBiy4+iiPFwgrwqysHgZ9cUUFn6lzgYgTpxqIUvnPg2P7BQBbL7LxHpDaTmfv1h7d4ezjOWr80jEWYRVgoMeTrVvlJMw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1759244855; c=relaxed/simple; bh=sufmZgpap5XQoRae0ytL9J4B4WSfdIpgY2TVn2EM26s=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=rFubU/7SSKl9JQg1GRnQbe1hxnlwnZcJia4E6mWPAVHkqhyRac74Mpjqaw57wYXIc0lR2zH/GCeIPMXBrnZEP7fkZPCPr6YsTxtuCpmVR0pxSbd3zEIERtwWGuMUpKXgAsMt7VHOMhkMw4IZ+fGqtDcrlUQGMcFGYZUWRsFVnHs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=M5RM+ML1; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="M5RM+ML1" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 31771C4CEF0; Tue, 30 Sep 2025 15:07:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1759244855; bh=sufmZgpap5XQoRae0ytL9J4B4WSfdIpgY2TVn2EM26s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=M5RM+ML1ojLK6kRZ6pgHYFTxQ96rZtMLN6Z+ZueoPJGHJ4+WLgvy2Dscnn1qKvOYk BF6meoooGlrNWfssoLk47vrVX7X0OQ9Rc/T1rkLrXRKh4he6r8RMIJjiOD3W9j7Cqr E9W94P0lNC8bHMR/esa8ek750BbafqcIep3g+wEI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Samasth Norway Ananda , Thomas Zimmermann , George Kennedy , syzbot+38a3699c7eaf165b97a6@syzkaller.appspotmail.com, Simona Vetter , Helge Deller , =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= , Sam Ravnborg , Qianqiang Liu , Shixiong Ou , Kees Cook Subject: [PATCH 6.16 135/143] fbcon: fix integer overflow in fbcon_do_set_font Date: Tue, 30 Sep 2025 16:47:39 +0200 Message-ID: <20250930143836.613232567@linuxfoundation.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20250930143831.236060637@linuxfoundation.org> References: <20250930143831.236060637@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 6.16-stable review patch. If anyone has any objections, please let me know. ------------------ From: Samasth Norway Ananda commit 1a194e6c8e1ee745e914b0b7f50fa86c89ed13fe upstream. Fix integer overflow vulnerabilities in fbcon_do_set_font() where font size calculations could overflow when handling user-controlled font parameters. The vulnerabilities occur when: 1. CALC_FONTSZ(h, pitch, charcount) performs h * pith * charcount multiplication with user-controlled values that can overflow. 2. FONT_EXTRA_WORDS * sizeof(int) + size addition can also overflow 3. This results in smaller allocations than expected, leading to buffer overflows during font data copying. Add explicit overflow checking using check_mul_overflow() and check_add_overflow() kernel helpers to safety validate all size calculations before allocation. Signed-off-by: Samasth Norway Ananda Reviewed-by: Thomas Zimmermann Fixes: 39b3cffb8cf3 ("fbcon: prevent user font height or width change from causing potential out-of-bounds access") Cc: George Kennedy Cc: stable Cc: syzbot+38a3699c7eaf165b97a6@syzkaller.appspotmail.com Cc: Greg Kroah-Hartman Cc: Simona Vetter Cc: Helge Deller Cc: Thomas Zimmermann Cc: "Ville Syrjälä" Cc: Sam Ravnborg Cc: Qianqiang Liu Cc: Shixiong Ou Cc: Kees Cook Cc: # v5.9+ Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250912170023.3931881-1-samasth.norway.ananda@oracle.com Signed-off-by: Greg Kroah-Hartman --- drivers/video/fbdev/core/fbcon.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -2518,9 +2518,16 @@ static int fbcon_set_font(struct vc_data if (fbcon_invalid_charcount(info, charcount)) return -EINVAL; - size = CALC_FONTSZ(h, pitch, charcount); + /* Check for integer overflow in font size calculation */ + if (check_mul_overflow(h, pitch, &size) || + check_mul_overflow(size, charcount, &size)) + return -EINVAL; + + /* Check for overflow in allocation size calculation */ + if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &size)) + return -EINVAL; - new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER); + new_data = kmalloc(size, GFP_USER); if (!new_data) return -ENOMEM;