[PATCH] fbcon: Out-Of-Bounds write in sys_imageblit, add range check
From: tcs_kernel (腾讯云内核开发者) <hidden>
Date: 2021-07-26 11:41:57
Also in:
dri-devel, lkml
Subsystem:
framebuffer console, framebuffer core, framebuffer layer, the rest · Maintainers:
Helge Deller, Thomas Zimmermann, Simona Vetter, Linus Torvalds
yres and vyres can be controlled by user mode paramaters, and cause p->vrows to become a negative value. While this value be passed to real_y function, the ypos will be out of screen range. This is an out-of-bounds write bug.
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 22bb3892f6bd..0970de46782f 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c@@ -1956,11 +1956,12 @@ static void updatescrollmode(struct fbcon_display *p, int yres = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres); int vyres = FBCON_SWAP(ops->rotate, info->var.yres_virtual, info->var.xres_virtual); + int rows = vc->vc_rows; p->vrows = vyres/fh; - if (yres > (fh * (vc->vc_rows + 1))) - p->vrows -= (yres - (fh * vc->vc_rows)) / fh; - if ((yres % fh) && (vyres % fh < yres % fh)) + if ((yres > (fh * (rows + 1))) && (vyres >= (yres - (fh * rows))) && p->vrows) + p->vrows -= (yres - (fh * rows)) / fh; + if ((yres % fh) && (vyres % fh < yres % fh) && p->vrows) p->vrows--; }