blit_x and blit_y are u32, so fbcon currently cannot support fonts
larger than 32x32.
The 32x32 case also needs shifting an unsigned int, to properly set bit
31, otherwise we get "UBSAN: shift-out-of-bounds in fbcon_set_font",
as reported on:
http://lore.kernel.org/all/IA1PR07MB98308653E259A6F2CE94A4AFABCE9@IA1PR07MB…
Kernel Branch: 6.2.0-rc5-next-20230124
Kernel config: https://drive.google.com/file/d/1F-LszDAizEEH0ZX0HcSR06v5q8FPl2Uv/view?usp=…
Reproducer: https://drive.google.com/file/d/1mP1jcLBY7vWCNM60OMf-ogw-urQRjNrm/view?usp=…
Reported-by: Sanan Hasanov <sanan.hasanov(a)Knights.ucf.edu>
Signed-off-by: Samuel Thibault <samuel.thibault(a)ens-lyon.org>
Fixes: 2d2699d98492 ("fbcon: font setting should check limitation of driver")
Cc: stable(a)vger.kernel.org
---
v1 -> v2:
- Use BIT macro instead of fixing bit test by hand.
- Add Fixes and Cc: stable headers.
Index: linux-6.0/drivers/video/fbdev/core/fbcon.c
===================================================================
--- linux-6.0.orig/drivers/video/fbdev/core/fbcon.c
+++ linux-6.0/drivers/video/fbdev/core/fbcon.c
@@ -2489,9 +2489,12 @@ static int fbcon_set_font(struct vc_data
h > FBCON_SWAP(info->var.rotate, info->var.yres, info->var.xres))
return -EINVAL;
+ if (font->width > 32 || font->height > 32)
+ return -EINVAL;
+
/* Make sure drawing engine can handle the font */
- if (!(info->pixmap.blit_x & (1 << (font->width - 1))) ||
- !(info->pixmap.blit_y & (1 << (font->height - 1))))
+ if (!(info->pixmap.blit_x & BIT(font->width - 1)) ||
+ !(info->pixmap.blit_y & BIT(font->height - 1)))
return -EINVAL;
/* Make sure driver can handle the font length */
This is the start of the stable review cycle for the 5.10.167 release.
There are 9 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 05 Feb 2023 10:09:58 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.167-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.167-rc1
Yan Zhai <yan(a)cloudflare.com>
net: fix NULL pointer in skb_segment_list
Soenke Huster <soenke.huster(a)eknoes.de>
Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt
Dave Hansen <dave.hansen(a)intel.com>
ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel systems
Hui Wang <hui.wang(a)canonical.com>
dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
Yu Kuai <yukuai3(a)huawei.com>
blk-cgroup: fix missing pd_online_fn() while activating policy
Hao Sun <sunhao.th(a)gmail.com>
bpf: Skip task with pid=1 in send_signal_common()
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
arm64: dts: imx8mq-thor96: fix no-mmc property for SDHCI
Geert Uytterhoeven <geert+renesas(a)glider.be>
ARM: dts: vf610: Fix pca9548 i2c-mux node names
Geert Uytterhoeven <geert+renesas(a)glider.be>
ARM: dts: imx: Fix pca9547 i2c-mux node name
-------------
Diffstat:
Makefile | 4 ++--
arch/arm/boot/dts/imx53-ppd.dts | 2 +-
arch/arm/boot/dts/vf610-zii-dev-rev-b.dts | 2 +-
arch/arm/boot/dts/vf610-zii-dev-rev-c.dts | 2 +-
arch/arm64/boot/dts/freescale/imx8mq-thor96.dts | 4 ++--
block/blk-cgroup.c | 4 ++++
drivers/acpi/processor_idle.c | 23 ++++++++++++++++++++---
drivers/dma/imx-sdma.c | 4 +++-
kernel/trace/bpf_trace.c | 3 +++
net/bluetooth/hci_event.c | 13 +++++++++++++
net/core/skbuff.c | 5 ++---
11 files changed, 52 insertions(+), 14 deletions(-)