[PATCH 1/2] fbcon: prevent user font height or width change from causing potential out-of-bounds access

[George Kennedy]

Add a check to fbcon_resize() to ensure that a possible change to user font
height or user font width will not allow a font data out-of-bounds access.
NOTE: must use original charcount in calculation as font charcount can
change and cannot be used to determine the font data allocated size.

Signed-off-by: George Kennedy <george.kenn...@oracle.com>
Reported-by: syzbot+38a3699c7eaf165b9...@syzkaller.appspotmail.com
---
 drivers/video/fbdev/core/fbcon.c | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 8a31fc2..6616783 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2191,6 +2191,9 @@ static void updatescrollmode(struct fbcon_display *p,
        }
 }
 
+#define PITCH(w) (((w) + 7) >> 3)
+#define CALC_FONTSZ(h, p, c) ((h) * (p) * (c)) /* size = height * pitch * 
charcount */
+
 static int fbcon_resize(struct vc_data *vc, unsigned int width, 
                        unsigned int height, unsigned int user)
 {
@@ -2200,6 +2203,24 @@ static int fbcon_resize(struct vc_data *vc, unsigned int 
width,
        struct fb_var_screeninfo var = info->var;
        int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh;
 
+       if (ops->p && ops->p->userfont && FNTSIZE(vc->vc_font.data)) {
+               int size;
+               int pitch = PITCH(vc->vc_font.width);
+
+               /*
+                * If user font, ensure that a possible change to user font
+                * height or width will not allow a font data out-of-bounds 
access.
+                * NOTE: must use original charcount in calculation as font
+                * charcount can change and cannot be used to determine the
+                * font data allocated size.
+                */
+               if (pitch <= 0)
+                       return -EINVAL;
+               size = CALC_FONTSZ(vc->vc_font.height, pitch, 
FNTCHARCNT(vc->vc_font.data));
+               if (size > FNTSIZE(vc->vc_font.data))
+                       return -EINVAL;
+       }
+
        virt_w = FBCON_SWAP(ops->rotate, width, height);
        virt_h = FBCON_SWAP(ops->rotate, height, width);
        virt_fw = FBCON_SWAP(ops->rotate, vc->vc_font.width,
@@ -2652,7 +2673,7 @@ static int fbcon_set_font(struct vc_data *vc, struct 
console_font *font,
        int size;
        int i, csum;
        u8 *new_data, *data = font->data;
-       int pitch = (font->width+7) >> 3;
+       int pitch = PITCH(font->width);
 
        /* Is there a reason why fbconsole couldn't handle any charcount >256?
         * If not this check should be changed to charcount < 256 */
@@ -2668,7 +2689,7 @@ static int fbcon_set_font(struct vc_data *vc, struct 
console_font *font,
        if (fbcon_invalid_charcount(info, charcount))
                return -EINVAL;
 
-       size = h * pitch * charcount;
+       size = CALC_FONTSZ(h, pitch, charcount);
 
        new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER);
 
-- 
1.8.3.1