# \[PATCH\] video: fbdev: fix potential OOB read in vga\_8planes\_imageblit() - Subsystems: FRAMEBUFFER LAYER, THE REST - Maintainers: Helge Deller, Linus Torvalds - List: linux-fbdev - 5 messages, 2 authors - Page: https://ratatoskr.run/linux-fbdev/2020/08/9187444/t ## \[PATCH\] video: fbdev: fix potential OOB read in vga\_8planes\_imageblit() - From: Tetsuo Handa \ - Date: 2020-08-26 08:05:13 - Message: https://ratatoskr.run/linux-fbdev/2020/08/9187444.md ```text Since transl_l[16] is accessed via cdat[y] >> 4, cdat[y] needs to be evaluated as an "unsigned char" value in order to fit 0...15 range. Signed-off-by: Tetsuo Handa --- drivers/video/fbdev/vga16fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/vga16fb.c b/drivers/video/fbdev/vga16fb.c index a20eeb8308ff..578d3541e3d6 100644 --- a/drivers/video/fbdev/vga16fb.c +++ b/drivers/video/fbdev/vga16fb.c @@ -1121,7 +1121,7 @@ static void vga_8planes_imageblit(struct fb_info *info, const struct fb_image *i char oldop = setop(0); char oldsr = setsr(0); char oldmask = selectmask(); - const char *cdat = image->data; + const unsigned char *cdat = image->data; u32 dx = image->dx; char __iomem *where; int y; -- 2.18.4 ``` ## \[PATCH v2\] video: fbdev: fix OOB read in vga\_8planes\_imageblit() - From: Tetsuo Handa \ - Date: 2020-08-26 08:05:24 - Message: https://ratatoskr.run/linux-fbdev/2020/08/9187445.md ```text syzbot is reporting OOB read at vga_8planes_imageblit() [1], for "cdat[y] >> 4" can become a negative value due to "const char *cdat". [1] https://syzkaller.appspot.com/bug?id 7a0da1557dcd1989e00cb3692b26d4173b4132 Reported-by: syzbot Signed-off-by: Tetsuo Handa --- drivers/video/fbdev/vga16fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/vga16fb.c b/drivers/video/fbdev/vga16fb.c index a20eeb8308ff..578d3541e3d6 100644 --- a/drivers/video/fbdev/vga16fb.c +++ b/drivers/video/fbdev/vga16fb.c @@ -1121,7 +1121,7 @@ static void vga_8planes_imageblit(struct fb_info *info, const struct fb_image *i char oldop = setop(0); char oldsr = setsr(0); char oldmask = selectmask(); - const char *cdat = image->data; + const unsigned char *cdat = image->data; u32 dx = image->dx; char __iomem *where; int y; -- 2.18.4 ``` ## \[PATCH v2 (resend)\] video: fbdev: fix OOB read in vga\_8planes\_imageblit() - From: Tetsuo Handa \ - Date: 2020-09-01 07:32:22 - Message: https://ratatoskr.run/linux-fbdev/2020/09/9187556.md ```text syzbot is reporting OOB read at vga_8planes_imageblit() [1], for "cdat[y] >> 4" can become a negative value due to "const char *cdat". [1] https://syzkaller.appspot.com/bug?id 7a0da1557dcd1989e00cb3692b26d4173b4132 Reported-by: syzbot Signed-off-by: Tetsuo Handa --- drivers/video/fbdev/vga16fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/vga16fb.c b/drivers/video/fbdev/vga16fb.c index a20eeb8308ff..578d3541e3d6 100644 --- a/drivers/video/fbdev/vga16fb.c +++ b/drivers/video/fbdev/vga16fb.c @@ -1121,7 +1121,7 @@ static void vga_8planes_imageblit(struct fb_info *info, const struct fb_image *i char oldop = setop(0); char oldsr = setsr(0); char oldmask = selectmask(); - const char *cdat = image->data; + const unsigned char *cdat = image->data; u32 dx = image->dx; char __iomem *where; int y; -- 2.18.4 ``` ## Re: \[PATCH v2 (resend)\] video: fbdev: fix OOB read in vga\_8planes\_imageblit() - From: Greg Kroah-Hartman \ - Date: 2020-09-04 15:24:10 - Message: https://ratatoskr.run/linux-fbdev/2020/09/9187818.md ```text On Fri, Sep 04, 2020 at 11:53:16PM +0900, Tetsuo Handa wrote: > Hello, Greg. > > Since nobody is interested in this bug, can you directly pick up > this obvious patch without waiting for maintainer's response? I'll pick it up now. thanks, greg k-h ``` ## Re: \[PATCH v2 (resend)\] video: fbdev: fix OOB read in vga\_8planes\_imageblit() - From: Tetsuo Handa \ - Date: 2020-09-05 00:35:38 - Message: https://ratatoskr.run/linux-fbdev/2020/09/9187833.md ```text Hello, Greg. Since nobody is interested in this bug, can you directly pick up this obvious patch without waiting for maintainer's response? On 2020/08/31 19:37, Tetsuo Handa wrote: > syzbot is reporting OOB read at vga_8planes_imageblit() [1], for > "cdat[y] >> 4" can become a negative value due to "const char *cdat". > > [1] https://syzkaller.appspot.com/bug?id 7a0da1557dcd1989e00cb3692b26d4173b4132 > > Reported-by: syzbot > Signed-off-by: Tetsuo Handa > --- > drivers/video/fbdev/vga16fb.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/video/fbdev/vga16fb.c b/drivers/video/fbdev/vga16fb.c > index a20eeb8308ff..578d3541e3d6 100644 > --- a/drivers/video/fbdev/vga16fb.c > +++ b/drivers/video/fbdev/vga16fb.c > @@ -1121,7 +1121,7 @@ static void vga_8planes_imageblit(struct fb_info *info, const struct fb_image *i > char oldop = setop(0); > char oldsr = setsr(0); > char oldmask = selectmask(); > - const char *cdat = image->data; > + const unsigned char *cdat = image->data; > u32 dx = image->dx; > char __iomem *where; > int y; > ```