fbcon: prevent user font height or width change from causing potential out-of-bounds...
authorGeorge Kennedy <george.kennedy@oracle.com>
Fri, 31 Jul 2020 16:33:11 +0000 (12:33 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 3 Sep 2020 09:22:30 +0000 (11:22 +0200)
commit2c455e9c5865861f5ce09c5f596909495ed7657c
treecff7b62c7bb02bcf6eb4fd4873ec08e681446fec
parent8b5638b71483f74ad3bf4eec7b994e8f85c09c1e
fbcon: prevent user font height or width change from causing potential out-of-bounds access

commit 39b3cffb8cf3111738ea993e2757ab382253d86a upstream.

Add a check to fbcon_resize() to ensure that a possible change to user font
height or user font width will not allow a font data out-of-bounds access.
NOTE: must use original charcount in calculation as font charcount can
change and cannot be used to determine the font data allocated size.

Signed-off-by: George Kennedy <george.kennedy@oracle.com>
Cc: stable <stable@vger.kernel.org>
Reported-by: syzbot+38a3699c7eaf165b97a6@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/1596213192-6635-1-git-send-email-george.kennedy@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/video/fbdev/core/fbcon.c