diff options
| author | Samuel Thibault <[email protected]> | 2023-03-06 09:49:21 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <[email protected]> | 2023-03-09 16:56:56 +0000 |
| commit | 18365ebf23f3e713e5dd8e295c9a639295250f3c (patch) | |
| tree | 4a4fc800a36c518168e0cf38a2e52c69d6cb0794 /drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | |
| parent | serial: qcom-geni: drop bogus uart_write_wakeup() (diff) | |
| download | kernel-18365ebf23f3e713e5dd8e295c9a639295250f3c.tar.gz kernel-18365ebf23f3e713e5dd8e295c9a639295250f3c.zip | |
tty: vt: protect KD_FONT_OP_GET_TALL from unbound access
In ioctl(KD_FONT_OP_GET_TALL), userland tells through op->height which
vpitch should be used to copy over the font. In con_font_get, we were
not checking that it is within the maximum height value, and thus
userland could make the vc->vc_sw->con_font_get(vc, &font, vpitch);
call possibly overflow the allocated max_font_size bytes, and the
copy_to_user(op->data, font.data, c) call possibly read out of that
allocated buffer.
By checking vpitch against max_font_height, the max_font_size buffer
will always be large enough for the vc->vc_sw->con_font_get(vc, &font,
vpitch) call (since we already prevent loading a font larger than that),
and c = (font.width+7)/8 * vpitch * font.charcount will always remain
below max_font_size.
Fixes: 24d69384bcd3 ("VT: Add KD_FONT_OP_SET/GET_TALL operations")
Reported-by: [email protected]
Signed-off-by: Samuel Thibault <[email protected]>
Reviewed-by: Jiri Slaby <[email protected]>
Link: https://lore.kernel.org/r/20230306094921.tik5ewne4ft6mfpo@begin
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c')
0 files changed, 0 insertions, 0 deletions