Commit 1a194e6c8e1e ("fbcon: fix integer overflow in fbcon_do_set_font")
introduced an out-of-bounds access by storing data and allocation sizes
in the same variable. Restore the old size calculation and use the new
variable 'alloc_size' for the allocation.Signed-off-by: Thomas Zimmermann <[email protected]> Fixes: 1a194e6c8e1e ("fbcon: fix integer overflow in fbcon_do_set_font") Reported-by: Jani Nikula <[email protected]> Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15020 Cc: Samasth Norway Ananda <[email protected]> Cc: Thomas Zimmermann <[email protected]> Cc: George Kennedy <[email protected]> Cc: Greg Kroah-Hartman <[email protected]> Cc: Simona Vetter <[email protected]> Cc: Helge Deller <[email protected]> Cc: "Ville Syrjälä" <[email protected]> Cc: Sam Ravnborg <[email protected]> Cc: Qianqiang Liu <[email protected]> Cc: Shixiong Ou <[email protected]> Cc: Kees Cook <[email protected]> Cc: <[email protected]> # v5.9+ Cc: Zsolt Kajtar <[email protected]> --- drivers/video/fbdev/core/fbcon.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 5fade44931b8..c1c0cdd7597c 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -2518,7 +2518,7 @@ static int fbcon_set_font(struct vc_data *vc, const struct console_font *font, unsigned charcount = font->charcount; int w = font->width; int h = font->height; - int size; + int size, alloc_size; int i, csum; u8 *new_data, *data = font->data; int pitch = PITCH(font->width); @@ -2551,10 +2551,10 @@ static int fbcon_set_font(struct vc_data *vc, const struct console_font *font, return -EINVAL; /* Check for overflow in allocation size calculation */ - if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &size)) + if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &alloc_size)) return -EINVAL; - new_data = kmalloc(size, GFP_USER); + new_data = kmalloc(alloc_size, GFP_USER); if (!new_data) return -ENOMEM; -- 2.51.0
