Peilin Ye 43198a5b1c fbcon: Fix global-out-of-bounds read in fbcon_get_font() ... commit 5af08640795b2b9a940c9266c0260455377ae262 upstream. fbcon_get_font() is reading out-of-bounds. A malicious user may resize `vc->vc_font.height` to a large value, causing fbcon_get_font() to read out of `fontdata`. fbcon_get_font() handles both built-in and user-provided fonts. Fortunately, recently we have added FONT_EXTRA_WORDS support for built-in fonts, so fix it by adding range checks using FNTSIZE(). This patch depends on patch "fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h", and patch "Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts". Cc: stable@vger.kernel.org Reported-and-tested-by: syzbot+29d4ed7f3bdedf2aa2fd@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=08b8be45afea11888776f897895aef9ad1c3ecfd Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/b34544687a1a09d6de630659eb7a773f4953238b.1600953813.git.yepeilin.cs@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-10-14 10:31:21 +02:00
..
aty
core	fbcon: Fix global-out-of-bounds read in fbcon_get_font()	2020-10-14 10:31:21 +02:00
geode
i810
intelfb
kyro
matrox
mb862xx
mbx
mmp
nvidia
omap
omap2	omapfb: fix multiple reference count leaks due to pm_runtime_get_sync	2020-09-03 11:24:20 +02:00
riva
savage
sis	video: fbdev: sis: Remove unnecessary parentheses and commented code	2020-04-23 10:30:15 +02:00
vermilion
via
68328fb.c
acornfb.c
acornfb.h
amba-clcd-nomadik.c
amba-clcd-nomadik.h
amba-clcd-versatile.c
amba-clcd-versatile.h
amba-clcd.c
amifb.c
arcfb.c
arkfb.c
asiliantfb.c
atafb.c
atafb.h
atafb_iplan2p2.c
atafb_iplan2p4.c
atafb_iplan2p8.c
atafb_mfb.c
atafb_utils.h
atmel_lcdfb.c
au1100fb.c
au1100fb.h
au1200fb.c
au1200fb.h
broadsheetfb.c
bt431.h
bt455.h
bw2.c
c2p.h
c2p_core.h
c2p_iplan2.c
c2p_planar.c
carminefb.c
carminefb.h
carminefb_regs.h
cg3.c
cg6.c
cg14.c
chipsfb.c
cirrusfb.c
clps711x-fb.c
clps711xfb.c
cobalt_lcdfb.c
controlfb.c
controlfb.h
cyber2000fb.c
cyber2000fb.h
da8xx-fb.c
dnfb.c
edid.h
efifb.c	efi: avoid error message when booting under Xen	2020-08-26 10:31:05 +02:00
ep93xx-fb.c
fb-puv3.c
ffb.c
fm2fb.c
fsl-diu-fb.c
g364fb.c
gbefb.c
goldfishfb.c
grvga.c
gxt4500.c
hecubafb.c
hgafb.c
hitfb.c
hpfb.c
hyperv_fb.c
i740_reg.h
i740fb.c
imsttfb.c
imxfb.c
jz4740_fb.c
Kconfig
leo.c
macfb.c
macmodes.c
macmodes.h
Makefile
maxinefb.c
metronomefb.c
mx3fb.c
mxsfb.c
n411.c
neofb.c	video: fbdev: neofb: fix memory leak in neo_scan_monitor()	2020-08-19 08:14:51 +02:00
nuc900fb.c
nuc900fb.h
ocfb.c
offb.c
p9100.c
platinumfb.c
platinumfb.h
pm2fb.c
pm3fb.c
pmag-aa-fb.c
pmag-ba-fb.c
pmagb-b-fb.c
ps3fb.c
pvr2fb.c
pxa3xx-gcu.c
pxa3xx-gcu.h
pxa168fb.c
pxa168fb.h
pxafb.c	video: pxafb: Fix the function used to balance a 'dma_alloc_coherent()' call	2020-08-19 08:14:54 +02:00
pxafb.h
q40fb.c
s1d13xxxfb.c
s3c-fb.c
s3c2410fb.c
s3c2410fb.h
s3fb.c
sa1100fb.c
sa1100fb.h
sbuslib.c
sbuslib.h
sh7760fb.c
sh_mobile_lcdcfb.c
sh_mobile_lcdcfb.h
simplefb.c
skeletonfb.c
sm501fb.c
sm712.h
sm712fb.c	video: fbdev: sm712fb: fix an issue about iounmap for a wrong address	2020-08-19 08:14:54 +02:00
smscufx.c
ssd1307fb.c
sstfb.c
sticore.h
stifb.c
sunxvr500.c
sunxvr1000.c
sunxvr2500.c
tcx.c
tdfxfb.c
tgafb.c
tmiofb.c
tridentfb.c
udlfb.c
uvesafb.c
valkyriefb.c
valkyriefb.h
vesafb.c
vfb.c
vga16fb.c	video: fbdev: fix OOB read in vga_8planes_imageblit()	2020-09-17 13:45:30 +02:00
vt8500lcdfb.c
vt8500lcdfb.h
vt8623fb.c
w100fb.c	video: fbdev: w100fb: Fix a potential double free.	2020-06-22 09:05:06 +02:00
w100fb.h
wm8505fb.c
wm8505fb_regs.h
wmt_ge_rops.c
wmt_ge_rops.h
xen-fbfront.c
xilinxfb.c