shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-08 03:40:35 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
1b2fcd82c0ca23f6fa01298c0d7b59eb4efbaf48
linux/drivers
History
Peilin Ye 1b2fcd82c0 fbcon: Fix global-out-of-bounds read in fbcon_get_font() 
commit 5af0864079 upstream.

fbcon_get_font() is reading out-of-bounds. A malicious user may resize
`vc->vc_font.height` to a large value, causing fbcon_get_font() to
read out of `fontdata`.

fbcon_get_font() handles both built-in and user-provided fonts.
Fortunately, recently we have added FONT_EXTRA_WORDS support for built-in
fonts, so fix it by adding range checks using FNTSIZE().

This patch depends on patch "fbdev, newport_con: Move FONT_EXTRA_WORDS
macros into linux/font.h", and patch "Fonts: Support FONT_EXTRA_WORDS
macros for built-in fonts".

Cc: stable@vger.kernel.org
Reported-and-tested-by: syzbot+29d4ed7f3bdedf2aa2fd@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=08b8be45afea11888776f897895aef9ad1c3ecfd
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/b34544687a1a09d6de630659eb7a773f4953238b.1600953813.git.yepeilin.cs@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-14 10:32:56 +02:00
..
accessibility
…
acpi
ACPI: EC: Reference count query handlers under lock
2020-10-01 13:17:27 +02:00
amba
…
android
binder: Prevent context manager from incrementing ref 0
2020-08-11 15:33:35 +02:00
ata
ata: sata_mv, avoid trigerrable BUG_ON
2020-10-01 13:18:26 +02:00
atm
atm: eni: fix the missed pci_disable_device() for eni_init_one()
2020-10-01 13:18:17 +02:00
auxdisplay
…
base
mm: don't rely on system state to detect hot-plug operations
2020-10-07 08:01:30 +02:00
bcma
…
block
rbd: require global CAP_SYS_ADMIN for mapping and unmapping
2020-09-17 13:47:53 +02:00
bluetooth
Bluetooth: btrtl: Use kvmalloc for FW allocations
2020-10-01 13:17:29 +02:00
bus
bus: hisi_lpc: Fixup IO ports addresses to avoid use-after-free in host removal
2020-10-01 13:17:37 +02:00
cdrom
…
char
ipmi:bt-bmc: Fix error handling and status check
2020-10-01 13:18:01 +02:00
clk
clk: samsung: exynos4: mark 'chipid' clock as CLK_IGNORE_UNUSED
2020-10-07 08:01:28 +02:00
clocksource
clocksource/drivers/timer-gx6605s: Fixup counter reload
2020-10-07 08:01:25 +02:00
connector
…
counter
counter: 104-quad-8: Add lock guards - generic interface
2020-05-02 08:48:44 +02:00
cpufreq
cpufreq: powernv: Fix frame-size-overflow in powernv_cpufreq_work_fn
2020-10-01 13:17:47 +02:00
cpuidle
cpuidle: Fixup IRQ state
2020-09-09 19:12:21 +02:00
crypto
crypto: chelsio - This fixes the kernel panic which occurs during a libkcapi test
2020-10-01 13:17:33 +02:00
dax
dax: Fix alloc_dax_region() compile warning
2020-10-01 13:17:15 +02:00
dca
…
devfreq
PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out
2020-10-01 13:17:14 +02:00
dio
…
dma
dmaengine: tegra-apb: Prevent race conditions on channel's freeing
2020-10-01 13:17:36 +02:00
dma-buf
dmabuf: fix NULL pointer dereference in dma_buf_release()
2020-10-01 13:18:24 +02:00
edac
EDAC/ghes: Check whether the driver is on the safe list correctly
2020-10-01 13:18:14 +02:00
eisa
…
extcon
extcon: adc-jack: Fix an error handling path in 'adc_jack_probe()'
2020-06-24 17:50:36 +02:00
firewire
…
firmware
firmware: arm_sdei: Use cpus_read_lock() to avoid races with cpuhp
2020-10-01 13:17:37 +02:00
fpga
fpga: dfl: fix bug in port reset handshake
2020-07-29 10:18:31 +02:00
fsi
…
gnss
gnss: sirf: fix error return code in sirf_probe()
2020-06-22 09:31:20 +02:00
gpio
gpio: aspeed: fix ast2600 bank properties
2020-10-07 08:01:29 +02:00
gpu
drm/sun4i: mixer: Extend regmap max_register
2020-10-07 08:01:26 +02:00
greybus
…
hid
HID: elan: Fix memleak in elan_input_configured
2020-09-17 13:47:48 +02:00
hsi
…
hv
Drivers: hv: vmbus: Add timeout to vmbus_wait_for_unload
2020-09-23 12:40:40 +02:00
hwmon
hwmon: (applesmc) check status earlier.
2020-09-09 19:12:20 +02:00
hwspinlock
…
hwtracing
coresight: etm4x: Fix use-after-free of per-cpu etm drvdata
2020-10-01 13:18:02 +02:00
i2c
i2c: cpm: Fix i2c_ram structure
2020-10-07 08:01:29 +02:00
i3c
…
ide
ide: serverworks: potential overflow in svwks_set_pio_mode()
2020-02-24 08:36:53 +01:00
idle
…
iio
iio: adc: qcom-spmi-adc5: fix driver name
2020-10-07 08:01:25 +02:00
infiniband
IB/iser: Always check sig MR before putting it to the free pool
2020-10-01 13:17:50 +02:00
input
Input: trackpoint - enable Synaptics trackpoints
2020-10-07 08:01:29 +02:00
interconnect
…
iommu
iommu/exynos: add missing put_device() call in exynos_iommu_of_xlate()
2020-10-07 08:01:28 +02:00
ipack
ipack: tpci200: fix error return code in tpci200_register()
2020-05-27 17:46:47 +02:00
irqchip
irqchip/stm32-exti: Avoid losing interrupts due to clearing pending bits by mistake
2020-09-03 11:27:06 +02:00
isdn
…
leds
leds: mlxreg: Fix possible buffer overflow
2020-10-01 13:17:14 +02:00
lightnvm
…
macintosh
macintosh/via-macii: Access autopoll_devs when inside lock
2020-08-19 08:16:15 +02:00
mailbox
mailbox: zynqmp-ipi: Fix NULL vs IS_ERR() check in zynqmp_ipi_mbox_probe()
2020-06-24 17:50:36 +02:00
mcb
…
md
dm: fix bio splitting and its bio completion order for regular IO
2020-10-01 13:18:25 +02:00
media
media: venus: vdec: Init registered list unconditionally
2020-10-01 13:17:58 +02:00
memory
…
memstick
memstick: Skip allocating card when removing host
2020-10-07 08:01:25 +02:00
message
scsi: mptscsih: Fix read sense data size
2020-07-16 08:16:36 +02:00
mfd
mfd: mfd-core: Protect against NULL call-back function pointer
2020-10-01 13:17:17 +02:00
misc
habanalabs: check correct vmalloc return code
2020-09-09 19:12:21 +02:00
mmc
mmc: sdhci: Workaround broken command queuing on Intel GLK based IRBIS models
2020-10-07 08:01:23 +02:00
mtd
ubi: fastmap: Free unused fastmap anchor peb during detach
2020-10-01 13:18:11 +02:00
mux
…
net
drivers/net/wan/hdlc: Set skb->protocol before transmitting
2020-10-07 08:01:26 +02:00
nfc
NFC: st95hf: Fix memleak in st95hf_in_send_cmd
2020-09-17 13:47:45 +02:00
ntb
NTB: perf: Fix race condition when run with ntb_test
2020-06-24 17:50:41 +02:00
nubus
…
nvdimm
libnvdimm/security: ensure sysfs poll thread woke up and fetch updated attr
2020-08-21 13:05:35 +02:00
nvme
nvme: consolidate chunk_sectors settings
2020-10-07 08:01:30 +02:00
nvmem
nvmem: qfprom: remove incorrect write support
2020-06-10 20:24:57 +02:00
of
of: of_mdio: Correct loop scanning logic
2020-07-22 09:32:55 +02:00
opp
opp: Increase parsed_static_opps in _of_add_opp_table_v1()
2020-10-01 13:18:11 +02:00
oprofile
…
parisc
parisc: mask out enable and reserved bits from sba imask
2020-08-19 08:16:26 +02:00
parport
…
pci
PCI: tegra: Fix runtime PM imbalance on error
2020-10-01 13:18:07 +02:00
pcmcia
…
perf
drivers/perf: Prevent forced unbinding of PMU drivers
2020-07-29 10:18:40 +02:00
phy
phy: ti: am654: Fix a leak in serdes_am654_probe()
2020-10-07 08:01:28 +02:00
pinctrl
pinctrl: mvebu: Fix i2c sda definition for 98DX3236
2020-10-07 08:01:28 +02:00
platform
platform/chrome: cros_ec_ishtp: Fix a double-unlock issue
2020-08-21 13:05:30 +02:00
pnp
…
power
power: supply: max17040: Correct voltage reading
2020-10-01 13:17:59 +02:00
powercap
…
pps
…
ps3
…
ptp
…
pwm
pwm: bcm-iproc: handle clk_get_rate() return
2020-08-21 13:05:34 +02:00
rapidio
rapidio: avoid data race between file operation callbacks and mport_cdev_add().
2020-10-01 13:18:08 +02:00
ras
…
regulator
regulator: axp20x: fix LDO2/4 description
2020-10-01 13:18:21 +02:00
remoteproc
remoteproc: qcom_q6v5_mss: Validate modem blob firmware size before load
2020-08-21 13:05:29 +02:00
reset
reset: uniphier: Add SCSSI reset control for each channel
2020-02-24 08:36:41 +01:00
rpmsg
…
rtc
rtc: ds1374: fix possible race condition
2020-10-01 13:17:43 +02:00
s390
s390/zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctl
2020-10-01 13:18:24 +02:00
sbus
…
scsi
scsi: lpfc: Fix initial FLOGI failure due to BBSCN not supported
2020-10-01 13:18:22 +02:00
sfi
…
sh
…
siox
…
slimbus
slimbus: core: Fix mismatch in of_node_get/put
2020-07-22 09:33:08 +02:00
soc
soc: qcom: rpmh-rsc: Set suppress_bind_attrs flag
2020-08-19 08:15:59 +02:00
soundwire
soundwire: bus: disable pm_runtime in sdw_slave_delete
2020-10-01 13:17:36 +02:00
spi
spi: fsl-espi: Only process interrupts for expected events
2020-10-07 08:01:27 +02:00
spmi
spmi: pmic-arb: Set lockdep class for hierarchical irq domains
2020-02-19 19:53:07 +01:00
ssb
…
staging
staging:r8188eu: avoid skb_clone for amsdu to msdu conversion
2020-10-01 13:17:57 +02:00
target
scsi: target: iscsi: Fix hang in iscsit_access_np() when getting tpg->np_login_sem
2020-09-17 13:47:53 +02:00
tc
…
tee
…
thermal
thermal: rcar_thermal: Handle probe error gracefully
2020-10-01 13:17:44 +02:00
thunderbolt
thunderbolt: Prevent crash if non-active NVMem file is read
2020-02-28 17:22:13 +01:00
tty
tty: serial: samsung: Correct clock selection logic
2020-10-01 13:18:00 +02:00
uio
uio_pdrv_genirq: fix use without device tree and no interrupt
2020-07-22 09:33:13 +02:00
usb
USB: gadget: f_ncm: Fix NDP16 datagram validation
2020-10-07 08:01:23 +02:00
vfio
vfio/pci: fix racy on error and request eventfd ctx
2020-10-01 13:18:10 +02:00
vhost
vsock/virtio: add transport parameter to the virtio_transport_reset_no_sock()
2020-10-07 08:01:24 +02:00
video
fbcon: Fix global-out-of-bounds read in fbcon_get_font()
2020-10-14 10:32:56 +02:00
virt
virt: vbox: Fix guest capabilities mask check
2020-07-22 09:33:11 +02:00
virtio
virtio_ring: Avoid loop when vq is broken in virtqueue_poll
2020-08-26 10:40:57 +02:00
visorbus
visorbus: fix uninitialized variable access
2020-02-24 08:36:47 +01:00
vlynq
…
vme
vme: bridges: reduce stack usage
2020-02-24 08:36:48 +01:00
w1
w1: omap-hdq: cleanup to add missing newline for some dev_dbg
2020-06-22 09:31:26 +02:00
watchdog
watchdog: initialize device before misc_register
2020-08-21 13:05:36 +02:00
xen
xen/xenbus: Fix granting of vmalloc'd memory
2020-09-09 19:12:22 +02:00
zorro
…
Kconfig
…
Makefile
…