From patchwork Fri Jul 1 20:22:03 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Helge Deller X-Patchwork-Id: 12903749 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3C35BC433EF for ; Fri, 1 Jul 2022 20:22:14 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 148A618B29F; Fri, 1 Jul 2022 20:22:13 +0000 (UTC) Received: from mout.gmx.net (mout.gmx.net [212.227.17.22]) by gabe.freedesktop.org (Postfix) with ESMTPS id 7B76D18B2A0 for ; Fri, 1 Jul 2022 20:22:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gmx.net; s=badeba3b8450; t=1656706927; bh=rQmS4yIj+Kq0oK+U8Ryv32tYGBvhOaSYofJZQWpZKAg=; h=X-UI-Sender-Class:From:To:Subject:Date:In-Reply-To:References; b=iWpE2jm7Ufk7mQ50Zm8w8zIY0Q+AxA+1DILK0QiyafiApwOBjuLngJqGaccX7I3Qn beQDUbzFzLO2afFs36vneCqxYr+5xajFpnCCd6bzOQoYlGx5IKKOcRVSyJYhwU2whx OrABWaWuIO+27WvTFOekaazhOFosvgnAhFdPfkbk= X-UI-Sender-Class: 01bb95c1-4bf8-414a-932a-4f6e2808ef9c Received: from p100.fritz.box ([92.116.182.192]) by mail.gmx.net (mrgmx104 [212.227.17.168]) with ESMTPSA (Nemesis) id 1MUGiJ-1oFJDI2ypf-00RF90; Fri, 01 Jul 2022 22:22:07 +0200 From: Helge Deller To: daniel.vetter@ffwll.ch, linux-fbdev@vger.kernel.org, geert@linux-m68k.org, dri-devel@lists.freedesktop.org Subject: [PATCH v2 1/4] fbcon: Disallow setting font bigger than screen size Date: Fri, 1 Jul 2022 22:22:03 +0200 Message-Id: <20220701202206.559518-2-deller@gmx.de> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220701202206.559518-1-deller@gmx.de> References: <20220701202206.559518-1-deller@gmx.de> MIME-Version: 1.0 X-Provags-ID: V03:K1:fzH1XW8PW0o+xI+pNd1m0oozUeUQdrEEe1OqFZbPAd7iLV4MbbW vpBM9C7r6IC/MKONWJGv1ouOBm6qifrprX+ZzZwO8B8xnLy6IxWnUXpmkmvQhe9Byl0hURi uULXJNuZacUcwswJYLALyFXgMEvpbs/Wo/KabteaPREOI1scjChnz5FvyKzv74Obuz+sZ30 nus/+ajPRxbKXM/OAifjQ== X-UI-Out-Filterresults: notjunk:1;V03:K0:aft038Hc5e4=:DFcBXqvipdLAoUMvLCG3KQ 80zH03BI5YlCMDQqxC8XuPR1VZscY83GWZiQ4SQ77IK/PAqiAORQ8AChtT0BGD4+s7ggp1B3n FHCgfscT2YDHes4MI37fquJjOpp0SL4EGnS8VE0K8LIus74E3L6xL70VJfaV+R7+hl8DJgqKV 0OBZp3DqPiWQcbFM5uEVys6l8bkadRY/fUmc9semeHwoYXhUZmq23TxoltxLCZQeoJsjbGQLN HDtFEha8Ad7WuENhZDGtrUvn+QGzoEymT+DK+XVXSrx0kClRufzflBQ1P0/oyts0S4GuQJdqd aGtqy3vtluBmNDgd56+TLYOQHZ4acchtwhT6Yqv5tIegbpy0AflL6HB2OwmDomQ0AOjd/fotG QEN2kvfdRAIF6GmF8giNDkwpwc/qSZ5G3REc8RX8rfKAfoFWxZ4cBXWby2KY4a8Rp1qmyNMY3 HJH1jzIXGtasgYCIFNSe3II7QHMv6Q4DINpNlC6gJm9wNg//6tH4m5uT/Sx8jKQSKT9CgY5qQ GIbg3bhAPrRICKeIUSVep4ue0yyv59A8N6fhVIRltNg/3/S4VhuJtul8hoMNpgYeJW4Z9TsZY K/disEvo5AwZG2vwg+twmvXtEInVnBsvdzmG6aEC17OBpCXDhpSlzfoIPcCStsGtoF0EHk56g bPbq/F/C/aGs86kpPDtSBD0wkE5OQO7FncrUBHdEnKq5PiOyS1KL3zHUcbX56zIomNmiDotO1 n39hlqlQe5H5L7Fyd21N1XUHjrURmyQDvAjjpcOLrB2mW44cD8X9+Iv/nzg4PVj+ubCnVJipl PxnyoXOvNuWqzxMHRA9UwdLmX2BpqTrSWYIvQ4ZrVIOJ0bYdqePiD0Xaq50I7zfa8NY7AHZLZ GHMv4q+DzHA95zJeysHdogTAR5WWbaDKIbaBcdMGhCVa/jTdfVv2KUlEBdGVO/491xjp4FMNo N+n7mPylb2cPJ0bykVq8XG9/xEcOj7ONsnsDqCCwQUWjSdJKIBFkmPpnhMXoYpbAlIkVz53Eo 1eJbUl5fFROzwG6UYr3yNsuMm7+mGglK9RN8ZDG96cLnIzridUv/1ejYdf8v45Z2bpl73plMT ODPuT8DVfK0IekD2J8UShfgWuqpWmS6DQH1PdmtQVQgas7eQz9RYnrrng== X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Prevent that users set a font size which is bigger than the physical screen. It's unlikely this may happen (because screens are usually much larger than the fonts and each font char is limited to 32x32 pixels), but it may happen on smaller screens/LCD displays. Signed-off-by: Helge Deller Reviewed-by: Daniel Vetter Reviewed-by: Geert Uytterhoeven Cc: stable@vger.kernel.org # v4.14+ --- drivers/video/fbdev/core/fbcon.c | 5 +++++ 1 file changed, 5 insertions(+) -- 2.35.3 diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index c4e91715ef00..a33532564393 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -2469,6 +2469,11 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, if (charcount != 256 && charcount != 512) return -EINVAL; + /* font bigger than screen resolution ? */ + if (w > FBCON_SWAP(info->var.rotate, info->var.xres, info->var.yres) || + h > FBCON_SWAP(info->var.rotate, info->var.yres, info->var.xres)) + return -EINVAL; + /* Make sure drawing engine can handle the font */ if (!(info->pixmap.blit_x & (1 << (font->width - 1))) || !(info->pixmap.blit_y & (1 << (font->height - 1)))) From patchwork Fri Jul 1 20:22:04 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Helge Deller X-Patchwork-Id: 12903752 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 4A51EC433EF for ; Fri, 1 Jul 2022 20:22:23 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 1DF8818B2A5; Fri, 1 Jul 2022 20:22:14 +0000 (UTC) Received: from mout.gmx.net (mout.gmx.net [212.227.17.20]) by gabe.freedesktop.org (Postfix) with ESMTPS id 8B33218B2A1 for ; Fri, 1 Jul 2022 20:22:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gmx.net; s=badeba3b8450; t=1656706928; bh=rxU496Ea/xTjK7QokoK/CvWIPeV4p8ucxlEYuQxng1c=; h=X-UI-Sender-Class:From:To:Subject:Date:In-Reply-To:References; b=Z59iAmdikPjyNlt3M36ojluNiGW75rOe2JPBiqqZ9S80nOUjatNojljF1wNNtl998 MzZG2ZlRiVLUBZWwSImL2Lk583wi3cCnQQyyqkcQSEyWCcK3l7L5y70X8YlYe7E1g2 rJclFSiN998+M1okbjsNPxSgbhzMVRHJVmoj/wgk= X-UI-Sender-Class: 01bb95c1-4bf8-414a-932a-4f6e2808ef9c Received: from p100.fritz.box ([92.116.182.192]) by mail.gmx.net (mrgmx104 [212.227.17.168]) with ESMTPSA (Nemesis) id 1M8hZJ-1o2gBy3gMj-004mLg; Fri, 01 Jul 2022 22:22:07 +0200 From: Helge Deller To: daniel.vetter@ffwll.ch, linux-fbdev@vger.kernel.org, geert@linux-m68k.org, dri-devel@lists.freedesktop.org Subject: [PATCH v2 2/4] fbcon: Prevent that screen size is smaller than font size Date: Fri, 1 Jul 2022 22:22:04 +0200 Message-Id: <20220701202206.559518-3-deller@gmx.de> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220701202206.559518-1-deller@gmx.de> References: <20220701202206.559518-1-deller@gmx.de> MIME-Version: 1.0 X-Provags-ID: V03:K1:m51ZFjziku3+nLdNnQ3v0ZjANLYrgX+zAVI4+wqnuo3LHXTKQ3e CRtJBTMO9m6eiMHvEKP/jdB5AyhFb+icj6DHkaDzu6u9JLDFBzo9Q+9SHmRG1HAO6iKGQiG zt4O39ER4vg/tA9qGwOltKoG83b7MjDAV5R1WCaQhBROb/AMdYTt13f/S4fszb+hCyUe6VB fTcmaiupoDbLumxpmVAfg== X-UI-Out-Filterresults: notjunk:1;V03:K0:UWS9HLNkmOw=:rsZSHlF7Hce145g3Rp33wk IlYjaURMO0XegJLAFpgyfTi4Kpl1jG/e29w4llEIoR3uiHW0BpJJ1/SIzFsy29sELiE/2qMPM t1MwubufOIXoLL5HsfCFNtseJrpYCy3ijeyitIAwbxjknt/Q0zJU5WcjU/saPi3c5s0+wFBV8 ebLdTv9RKR5hjjdEDkUljL3J+ttwgvu1gg6i3u1En7vDwZNlQgzXzzNNtHm7yAACnWAUz57Rv BDtoRHBb5lInv219ojTmFI1pkBj3wf75GRs1g4J30unltt8SCThu11Sp0ai2BUVvpDYNcZx3F 9wsQW8Upj7FSzYlUIwDGc7tBDY4n3dSHpBY0Mk9HBdJOFePf+eK6S9fe8MyP3v89bW8j3qNWW cAuNahtBdNQJd+c+DOXzyD0esHFYGClVEd7y0LbLxGCVrUlN4pEG3k6iGdK6RpCDgoAcwCwue 1m50RqjnmcL4mbW9tIn+pIjsSGR/Mqpx9/IQ2ldfGhXx1Dcdj5UT2q7y42nfNgAFYY7B98Lzv Tc978WOl/3O+HycKd0Xkm+Hd5YTYL1DXpXrtYRjCR+kINpxWR9ax04tYRxxC0cvcGJEyQGBQ0 Dq7vc5xCKnXeEnBQYZgdzCAjn5WrYg/S866Mujk7HH9Ov9PMXKJoaDp7wNXOQuN9A4M1K+Muw YOiSmiJkDG1aG69g/mV8SQO1qyibee2n/VotOqrwyalHiDROWSlS2NiUQ9OGJ0jkb0d7uoC+C NXfwlhLlde5AO4Tq4VW3VKz3lOLEd4r7N94W0JAbBayIBcKKCfw4HfJ9Ai3Cu3qTbQjuXj3zD JgWw0Xb5FedKSXAEuN8+AjRr/TyKh6yy4NAUQa8U4WTlA37E0DoXKxagw0lsIVHY9wwP384W+ ElirBRACW/2rckdZveTXbg4maVBYbYaQYXSPuaSdFiedb5ASyyP2ADqcjkUTjsHJKnl63iqGA zMfkNNCh1qlTfI8BfmV8sS9icKn3F08LZ6gC9jbDLIoFBuQ597a1q7JmdTL/kCWoTrVGMna5a qkPOCfBHSxYtKROUyJVsCq7+/1byshkyIeSJDIphn6qTrCOvBrrt4nXYrIUptnFR1S/YC2hTe 8ILLZR9v7BfcoNZyzLN87J80pXxt7Sw5kGTwen2ZCHeJqgIoO0JgqKquA== X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" We need to prevent that users configure a screen size which is smaller than the currently selected font size. Otherwise rendering chars on the screen will access memory outside the graphics memory region. This patch adds a new function fbcon_modechange_possible() which implements this check and which later may be extended with other checks if necessary. The new function is called from the FBIOPUT_VSCREENINFO ioctl handler in fbmem.c, which will return -EINVAL if userspace asked for a too small screen size. Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v5.4+ --- drivers/video/fbdev/core/fbcon.c | 28 ++++++++++++++++++++++++++++ drivers/video/fbdev/core/fbmem.c | 4 +++- include/linux/fbcon.h | 4 ++++ 3 files changed, 35 insertions(+), 1 deletion(-) -- 2.35.3 diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index a33532564393..14b0ab51744f 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -2736,6 +2736,34 @@ void fbcon_update_vcs(struct fb_info *info, bool all) } EXPORT_SYMBOL(fbcon_update_vcs); +/* let fbcon check if it supports a new screen resolution */ +int fbcon_modechange_possible(struct fb_info *info, struct fb_var_screeninfo *var) +{ + struct fbcon_ops *ops = info->fbcon_par; + struct vc_data *vc; + int i; + + WARN_CONSOLE_UNLOCKED(); + + if (!ops) + return -EINVAL; + + /* prevent setting a screen size which is smaller than font size */ + for (i = first_fb_vc; i <= last_fb_vc; i++) { + vc = vc_cons[i].d; + if (!vc || vc->vc_mode != KD_TEXT || + registered_fb[con2fb_map[i]] != info) + continue; + + if (vc->vc_font.width > FBCON_SWAP(var->rotate, var->xres, var->yres) || + vc->vc_font.height > FBCON_SWAP(var->rotate, var->yres, var->xres)) + return -EINVAL; + } + + return 0; +} +EXPORT_SYMBOL(fbcon_modechange_possible); + int fbcon_mode_deleted(struct fb_info *info, struct fb_videomode *mode) { diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c index afa2863670f3..160389365a36 100644 --- a/drivers/video/fbdev/core/fbmem.c +++ b/drivers/video/fbdev/core/fbmem.c @@ -1106,7 +1106,9 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd, return -EFAULT; console_lock(); lock_fb_info(info); - ret = fb_set_var(info, &var); + ret = fbcon_modechange_possible(info, &var); + if (!ret) + ret = fb_set_var(info, &var); if (!ret) fbcon_update_vcs(info, var.activate & FB_ACTIVATE_ALL); unlock_fb_info(info); diff --git a/include/linux/fbcon.h b/include/linux/fbcon.h index ff5596dd30f8..2382dec6d6ab 100644 --- a/include/linux/fbcon.h +++ b/include/linux/fbcon.h @@ -15,6 +15,8 @@ void fbcon_new_modelist(struct fb_info *info); void fbcon_get_requirement(struct fb_info *info, struct fb_blit_caps *caps); void fbcon_fb_blanked(struct fb_info *info, int blank); +int fbcon_modechange_possible(struct fb_info *info, + struct fb_var_screeninfo *var); void fbcon_update_vcs(struct fb_info *info, bool all); void fbcon_remap_all(struct fb_info *info); int fbcon_set_con2fb_map_ioctl(void __user *argp); @@ -33,6 +35,8 @@ static inline void fbcon_new_modelist(struct fb_info *info) {} static inline void fbcon_get_requirement(struct fb_info *info, struct fb_blit_caps *caps) {} static inline void fbcon_fb_blanked(struct fb_info *info, int blank) {} +static inline int fbcon_modechange_possible(struct fb_info *info, + struct fb_var_screeninfo *var) { return 0; } static inline void fbcon_update_vcs(struct fb_info *info, bool all) {} static inline void fbcon_remap_all(struct fb_info *info) {} static inline int fbcon_set_con2fb_map_ioctl(void __user *argp) { return 0; } From patchwork Fri Jul 1 20:22:05 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Helge Deller X-Patchwork-Id: 12903751 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 12CE7C433EF for ; Fri, 1 Jul 2022 20:22:21 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id AED8B18B2A2; Fri, 1 Jul 2022 20:22:13 +0000 (UTC) Received: from mout.gmx.net (mout.gmx.net [212.227.17.21]) by gabe.freedesktop.org (Postfix) with ESMTPS id 94F1B18B2A2 for ; Fri, 1 Jul 2022 20:22:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gmx.net; s=badeba3b8450; t=1656706928; bh=dEefPiI9Wq3+N76bPKdFvUHz0EeUTEIRh3WCR7KXkgA=; h=X-UI-Sender-Class:From:To:Subject:Date:In-Reply-To:References; b=OACZYikvy+/y21lPyc5myqfIifobXgs+rdBoYNeTCNyyCVp5HdTbcs9RNTycvqLkD k44nzweEViwLawfjGMepNzCMBAgTGVIomPHjR/TzyDHSt/HcP+UoDs5kIxHSeinSeb sZ31QulA5hmpnl6qAiOPs67kZfgNhbqwmdVjd5Ho= X-UI-Sender-Class: 01bb95c1-4bf8-414a-932a-4f6e2808ef9c Received: from p100.fritz.box ([92.116.182.192]) by mail.gmx.net (mrgmx104 [212.227.17.168]) with ESMTPSA (Nemesis) id 1MIwz4-1oM9us0AH4-00KPWt; Fri, 01 Jul 2022 22:22:08 +0200 From: Helge Deller To: daniel.vetter@ffwll.ch, linux-fbdev@vger.kernel.org, geert@linux-m68k.org, dri-devel@lists.freedesktop.org Subject: [PATCH v2 3/4] fbmem: Prevent invalid virtual screen sizes in fb_set_var() Date: Fri, 1 Jul 2022 22:22:05 +0200 Message-Id: <20220701202206.559518-4-deller@gmx.de> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220701202206.559518-1-deller@gmx.de> References: <20220701202206.559518-1-deller@gmx.de> MIME-Version: 1.0 X-Provags-ID: V03:K1:2Pema6bQD8hlqggTqzvIu9nIR9AjW15U3UF/mSjiWLLg5CVmqoI seppCR45WB7QBgxFfuaPbpf0bOxnP9/pENovo51jYwvBJ2P7qqCTTLTjYP1Sur0eyX2/o8+ zk1SVGkAarypSOoEGzkCwd1LZuaUAKSWOoVjxjtmdlpbazSvOGDjWAqdL59kV/Kpudrjpzv qHxmq48QgT6U+aRh2jLjg== X-UI-Out-Filterresults: notjunk:1;V03:K0:ZHqwHxMtiAA=:DGKBW9shxJwivEm6Hf33Yn VXdHUzTvVHQqJcxK2DO0D02MRy3TiIHEmXltoxvDEjBUz6pflPD90rfGkQmwpcjcbSU+AsX/B 0h2PJDQLE48ox9dZU6mdwS6auZ9mFZsixXAaxqCu8x88zTBOao3PLbQj1kbWZqMafEtRF//ze cD6TU+kJ4N8QfjAYyggn6vV0XJFFXaO0gEiBfnomC0R3NySCVKu+5jbdehIX/MdyupMCjKjrZ 0hvBIwYlVEIV5N81BZyOSBdNpTxIWZrc1OmR4VdnZoY+993IJe/5cjp1UZeX7cfGL5azBpMgY a8A0mwNX6WaVDGsJga3h8H9Q1XG/Hmbj91V8ht+TctbkY+dK6IQqe3fIgel4ndrTNmtO5lA5Z vYC0im1fPBNGxYZbLFnx2sE27QiQjU/MbA/2uhRlyu/X5gTe0VXPnSKsSydVOH6YkbB4L+TZy pP4K8KYs9Tf8KvzLOtkS/XCUjHfFxQ7jKew0bROViMaNzQBmGDXIJnM76wd9eodqDyBfmQoXo BpI260wPKh8NY/aOs+VvS7MslV0oTHY3ObQsENsWcZTH8PW9KfIGe6SH59gYTWlQNGZgW186V Kva9UXmN6IYs+pkWvhhyeVFOHjeJzQRV5CG6Wnj6PG+MrTZfwHcKQnFjaxH6I8jA9hxd1J0b8 C8cZolz32zFR4trrfKA57Ae0UiBos0ciOXUM+6VucLXV9ITxDH+pTiIwtp3KmJER3af1s4OH8 hlK8nFl3y8H/7n3iJpQuwh53fWvl5QC6Fn6+DT+q4eBbbDANBgGgwdib9d7pjeNtR8/pB72ib qD9P3aqBDubXEFwYAj96epkA4aO1KRh7Jppsj1Zf4BdrQiSMa/psoGERGEh4vpEPvcfyyj735 0HlI3BBgWOEtk3yPGpntQI/RZjv46awTROQRcTFI1/hjekjBQ6qfiYmM/ALV4FS49D0C3cmUW j6shuBbN2STQ/EYRem8BZYd7zaQQzuhBioBdPDht3H/7dP1AQGXw2UicHupxK2xVmj7gDPx93 GN12HrDvlV1ROGBGUx/8QBVoaQ633zc9dgwjNBM/qP8WXLqHtnBeAbQIVDX5KXEk7ojmsTSVP GmaJusnRG99SRXPe/Ni6GQQDE5rOWrCQqCIy1OwiJ9sMQGJpWAqn0Rmtg== X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Prevent that drivers configure a virtual screen resolution smaller than the physical screen resolution. This is important, because otherwise we may access memory outside of the graphics memory area. Give a kernel WARNing and show the driver name to help locating the buggy driver. Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v5.4+ --- drivers/video/fbdev/core/fbmem.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) -- 2.35.3 diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c index 160389365a36..e8f06d26803c 100644 --- a/drivers/video/fbdev/core/fbmem.c +++ b/drivers/video/fbdev/core/fbmem.c @@ -1016,6 +1016,18 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var) if (ret) return ret; + /* make sure virtual resolution >= physical resolution */ + if (WARN_ON(var->xres_virtual < var->xres)) { + pr_warn("fbcon: Fix up invalid xres %d for %s\n", + var->xres_virtual, info->fix.id); + var->xres_virtual = var->xres; + } + if (WARN_ON(var->yres_virtual < var->yres)) { + pr_warn("fbcon: Fix up invalid yres %d for %s\n", + var->yres_virtual, info->fix.id); + var->yres_virtual = var->yres; + } + if ((var->activate & FB_ACTIVATE_MASK) != FB_ACTIVATE_NOW) return 0;