iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/video/fbdev
History
Helge Deller 0f747181d8 fbcon: Fix null-ptr-deref in soft_cursor 
commit d78bd6cc68276bd57f766f7cb98bfe32c23ab327 upstream.

syzbot repored this bug in the softcursor code:

BUG: KASAN: null-ptr-deref in soft_cursor+0x384/0x6b4 drivers/video/fbdev/core/softcursor.c:70
Read of size 16 at addr 0000000000000200 by task kworker/u4:1/12

CPU: 0 PID: 12 Comm: kworker/u4:1 Not tainted 6.4.0-rc3-syzkaller-geb0f1697d729 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Workqueue: events_power_efficient fb_flashcursor
Call trace:
 dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233
 show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106
 print_report+0xe4/0x514 mm/kasan/report.c:465
 kasan_report+0xd4/0x130 mm/kasan/report.c:572
 kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:187
 __asan_memcpy+0x3c/0x84 mm/kasan/shadow.c:105
 soft_cursor+0x384/0x6b4 drivers/video/fbdev/core/softcursor.c:70
 bit_cursor+0x113c/0x1a64 drivers/video/fbdev/core/bitblit.c:377
 fb_flashcursor+0x35c/0x54c drivers/video/fbdev/core/fbcon.c:380
 process_one_work+0x788/0x12d4 kernel/workqueue.c:2405
 worker_thread+0x8e0/0xfe8 kernel/workqueue.c:2552
 kthread+0x288/0x310 kernel/kthread.c:379
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:853

This fix let bit_cursor() bail out early when a font bitmap
isn't available yet.

Signed-off-by: Helge Deller <deller@gmx.de>
Reported-by: syzbot+d910bd780e6efac35869@syzkaller.appspotmail.com
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-06-09 10:24:04 +02:00
..
aty
video: fbdev: radeon: Fix memleak in radeonfb_pci_register
2020-10-29 09:55:09 +01:00
core
fbcon: Fix null-ptr-deref in soft_cursor
2023-06-09 10:24:04 +02:00
geode
fbdev: lxfb: Fix potential divide by zero
2023-04-05 11:15:40 +02:00
i810
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
intelfb
fbdev: intelfb: Fix potential divide by zero
2023-04-05 11:15:39 +02:00
kyro
video: fbdev: kyro: Error out if 'pixclock' equals zero
2021-09-22 11:48:04 +02:00
matrox
video: matroxfb: Delete an error message for a failed memory allocation in matroxfb_crtc2_probe()
2018-03-28 16:34:28 +02:00
mb862xx
treewide: kmalloc() -> kmalloc_array()
2018-06-12 16:19:22 -07:00
mbx
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
mmp
fbdev changes for v4.18:
2018-06-17 05:00:24 +09:00
nvidia
fbdev: nvidia: Fix potential divide by zero
2023-04-05 11:15:39 +02:00
omap
fbdev: omapfb: off by one in omapfb_register_client()
2018-07-24 19:11:28 +02:00
omap2
video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf()
2022-04-15 14:14:55 +02:00
riva
video: fbdev: riva: Error out if 'pixclock' equals zero
2021-09-22 11:48:04 +02:00
savage
video: fbdev: savage: Replace mdelay with usleep_range in savage_init_hw
2018-04-24 18:11:21 +02:00
sis
video: fbdev: sis: fix typos in SiS_GetModeID()
2022-08-25 11:15:24 +02:00
vermilion
fbdev: vermilion: decrease reference count in error path
2023-01-18 11:30:29 +01:00
via
fbdev: via: Fix error in via_core_init()
2023-01-18 11:30:29 +01:00
68328fb.c
video: fbdev: annotate fb_fix_screeninfo with const and __initconst
2017-09-04 16:00:49 +02:00
acornfb.c
…
acornfb.h
…
amba-clcd-nomadik.c
…
amba-clcd-nomadik.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
amba-clcd-versatile.c
…
amba-clcd-versatile.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
amba-clcd.c
video: fbdev: amba-clcd: Fix refcount leak bugs
2022-08-25 11:15:24 +02:00
amifb.c
fb: amifb: fix build warnings when not builtin
2018-07-31 13:06:58 +02:00
arcfb.c
…
arkfb.c
video: fbdev: arkfb: Check the size of screen before memset_io()
2022-08-25 11:15:27 +02:00
asiliantfb.c
video: fbdev: asiliantfb: Error out if 'pixclock' equals zero
2021-09-22 11:48:04 +02:00
atafb_iplan2p2.c
…
atafb_iplan2p4.c
…
atafb_iplan2p8.c
…
atafb_mfb.c
…
atafb_utils.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
atafb.c
video: fbdev: atari: Atari 2 bpp (STe) palette bugfix
2022-04-15 14:14:41 +02:00
atafb.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
atmel_lcdfb.c
video: fbdev: atmel_lcdfb: fix return error code in atmel_lcdfb_of_init()
2020-12-30 11:25:54 +01:00
au1100fb.c
fbdev changes for v4.18:
2018-06-17 05:00:24 +09:00
au1100fb.h
…
au1200fb.c
fbdev: au1200fb: Fix potential divide by zero
2023-04-05 11:15:40 +02:00
au1200fb.h
fbdev: au1200fb: delete duplicate header contents
2018-01-04 16:53:49 +01:00
broadsheetfb.c
treewide: kzalloc() -> kcalloc()
2018-06-12 16:19:22 -07:00
bt431.h
…
bt455.h
…
bw2.c
video: fbdev: Convert to using %pOF instead of full_name
2017-08-07 17:22:13 +02:00
c2p_core.h
…
c2p_iplan2.c
…
c2p_planar.c
…
c2p.h
…
carminefb_regs.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
carminefb.c
…
carminefb.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
cg3.c
video: fbdev: Convert to using %pOF instead of full_name
2017-08-07 17:22:13 +02:00
cg6.c
video: fbdev: Convert to using %pOF instead of full_name
2017-08-07 17:22:13 +02:00
cg14.c
video: fbdev: Convert to using %pOF instead of full_name
2017-08-07 17:22:13 +02:00
chipsfb.c
fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init()
2022-09-15 12:17:05 +02:00
cirrusfb.c
video: fbdev: cirrusfb: check pixclock to avoid divide by zero
2022-04-15 14:14:55 +02:00
clps711x-fb.c
video: clps711x-fb: release disp device node in probe()
2019-02-12 19:47:15 +01:00
clps711xfb.c
…
cobalt_lcdfb.c
video: cobalt_lcdfb: constify fb_fix_screeninfo structure
2017-08-01 17:20:39 +02:00
controlfb.c
…
controlfb.h
fbdev: controlfb: Add missing modes to fix out of bounds access
2017-11-09 18:09:33 +01:00
cyber2000fb.c
video: fbdev: make fb_videomode const
2017-09-04 16:00:49 +02:00
cyber2000fb.h
…
da8xx-fb.c
fbdev: da8xx-fb: Drop unnecessary static
2017-08-01 17:20:39 +02:00
dnfb.c
video/fbdev/dnfb: Use common error handling code in dnfb_probe()
2017-11-09 18:09:31 +01:00
edid.h
…
efifb.c
efi: avoid error message when booting under Xen
2020-08-26 10:31:05 +02:00
ep93xx-fb.c
…
fb-puv3.c
video: fbdev: make fb_var_screeninfo const
2017-09-04 16:00:50 +02:00
ffb.c
video: fbdev: Convert to using %pOF instead of full_name
2017-08-07 17:22:13 +02:00
fm2fb.c
video: fm2fb: constify zorro_device_id
2017-09-04 16:00:49 +02:00
fsl-diu-fb.c
video: fbdev: fsl-diu-fb: Remove VLA usage
2018-07-24 19:11:26 +02:00
g364fb.c
…
gbefb.c
…
goldfishfb.c
video: goldfishfb: fix memory leak on driver remove
2018-07-24 19:11:27 +02:00
grvga.c
video: fbdev: annotate fb_fix_screeninfo with const and __initconst
2017-09-04 16:00:49 +02:00
gxt4500.c
…
hecubafb.c
…
hgafb.c
video: hgafb: correctly handle card detect failure during probe
2021-05-26 11:48:35 +02:00
hitfb.c
…
hpfb.c
…
hyperv_fb.c
video: hyperv_fb: Fix the mmap() regression for v5.4.y and older
2021-01-12 20:10:20 +01:00
i740_reg.h
…
i740fb.c
video: fbdev: i740fb: Check the argument of i740_calc_vclk()
2022-08-25 11:15:47 +02:00
imsttfb.c
Revert "video: imsttfb: fix potential NULL pointer dereferences"
2021-05-26 11:48:34 +02:00
imxfb.c
treewide: kmalloc() -> kmalloc_array()
2018-06-12 16:19:22 -07:00
jz4740_fb.c
…
Kconfig
fbdev: ssd1307fb: Drop optional dependency
2023-01-18 11:30:29 +01:00
leo.c
video: fbdev: Convert to using %pOF instead of full_name
2017-08-07 17:22:13 +02:00
macfb.c
nubus: Adopt standard linked list implementation
2018-01-16 16:47:29 +01:00
macmodes.c
…
macmodes.h
…
Makefile
video: fbdev: remove unused sh_mobile_meram driver
2018-05-14 15:47:30 +02:00
maxinefb.c
video: fbdev: make fb_var_screeninfo const
2017-09-04 16:00:50 +02:00
metronomefb.c
video: fbdev: metronomefb: fix some off by one bugs
2018-07-24 19:11:26 +02:00
mx3fb.c
…
mxsfb.c
treewide: devm_kzalloc() -> devm_kcalloc()
2018-06-12 16:19:22 -07:00
n411.c
…
neofb.c
video: fbdev: neofb: fix memory leak in neo_scan_monitor()
2020-08-19 08:14:51 +02:00
nuc900fb.c
…
nuc900fb.h
…
ocfb.c
…
offb.c
video: offb: Deallocate the color map
2018-03-12 17:06:54 +01:00
p9100.c
video: fbdev: Convert to using %pOF instead of full_name
2017-08-07 17:22:13 +02:00
platinumfb.c
…
platinumfb.h
…
pm2fb.c
fbdev: pm2fb: fix missing pci_disable_device()
2023-01-18 11:30:29 +01:00
pm3fb.c
video: fbdev: pm3fb: constify pci_device_id.
2017-08-01 17:20:45 +02:00
pmag-aa-fb.c
video: fbdev: make fb_var_screeninfo const
2017-09-04 16:00:50 +02:00
pmag-ba-fb.c
video: fbdev: make fb_var_screeninfo const
2017-09-04 16:00:50 +02:00
pmagb-b-fb.c
video: fbdev: make fb_var_screeninfo const
2017-09-04 16:00:50 +02:00
ps3fb.c
video: fbdev: annotate fb_fix_screeninfo with const and __initconst
2017-09-04 16:00:49 +02:00
pvr2fb.c
video: fbdev: pvr2fb: initialize variables
2020-11-05 11:08:39 +01:00
pxa3xx-gcu.c
video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write
2022-09-28 11:02:53 +02:00
pxa3xx-gcu.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
pxa168fb.c
pxa168fb: Fix the function used to release some memory in an error handling path
2020-02-24 08:34:36 +01:00
pxa168fb.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
pxafb.c
video: pxafb: Fix the function used to balance a 'dma_alloc_coherent()' call
2020-08-19 08:14:54 +02:00
pxafb.h
video: fbdev: pxafb: Add support for lcd-supply regulator
2018-07-24 19:11:26 +02:00
q40fb.c
video: fbdev: make fb_var_screeninfo const
2017-09-04 16:00:50 +02:00
s1d13xxxfb.c
fbdev: s1d13xxxfb: remove m32r specific hacks
2018-03-26 15:56:46 +02:00
s3c2410fb.c
…
s3c2410fb.h
…
s3c-fb.c
video: fbdev: s3c-fb: remove dead platform code for Exynos and S5PV210 platforms
2018-03-28 16:34:29 +02:00
s3fb.c
video: fbdev: s3fb: Check the size of screen before memset_io()
2022-08-25 11:15:27 +02:00
sa1100fb.c
video: sa1100fb: move pseudo palette into sa1100fb_info structure
2017-10-17 16:01:13 +02:00
sa1100fb.h
video: sa1100fb: move pseudo palette into sa1100fb_info structure
2017-10-17 16:01:13 +02:00
sbuslib.c
fbdev: sbuslib: integer overflow in sbusfb_ioctl_helper()
2019-11-24 08:20:36 +01:00
sbuslib.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
sh7760fb.c
…
sh_mobile_lcdcfb.c
video: fbdev: sh_mobile_lcdcfb: remove unused MERAM support
2018-05-14 15:47:30 +02:00
sh_mobile_lcdcfb.h
video: fbdev: sh_mobile_lcdcfb: remove unused MERAM support
2018-05-14 15:47:30 +02:00
simplefb.c
video: fbdev: simplefb: Stop including <linux/clk-provider.h>
2018-07-03 17:43:09 +02:00
skeletonfb.c
docs: fix broken references with multiple hints
2018-06-15 18:10:01 -03:00
sm501fb.c
video: sm501fb: Improve a size determination in sm501fb_probe()
2018-04-26 12:24:18 +02:00
sm712.h
fbdev: sm712fb: use 1024x768 by default on non-MIPS, fix garbled display
2019-05-25 18:23:36 +02:00
sm712fb.c
video: fbdev: sm712fb: Fix crash in smtcfb_write()
2022-04-15 14:14:56 +02:00
smscufx.c
fbdev: smscufx: Fix several use-after-free bugs
2022-11-03 23:52:28 +09:00
ssd1307fb.c
video: ssd1307fb: Start page range at page_offset
2019-10-07 18:56:30 +02:00
sstfb.c
…
sticore.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
stifb.c
fbdev: stifb: Fix info entry in sti_struct on error path
2023-06-09 10:23:58 +02:00
sunxvr500.c
video: fbdev: sunxvr500: constify pci_device_id.
2017-08-01 17:20:43 +02:00
sunxvr1000.c
video: fbdev: Convert to using %pOF instead of full_name
2017-08-07 17:22:13 +02:00
sunxvr2500.c
video: fbdev: sunxvr2500: constify pci_device_id.
2017-08-01 17:20:41 +02:00
tcx.c
video: fbdev: Convert to using %pOF instead of full_name
2017-08-07 17:22:13 +02:00
tdfxfb.c
video: fbdev: mark expected switch fall-throughs
2018-07-24 19:11:28 +02:00
tgafb.c
fbdev: tgafb: Fix potential divide by zero
2023-04-05 11:15:39 +02:00
tmiofb.c
…
tridentfb.c
video: fbdev: tridentfb: remove deadcode on unreachable case statement
2018-07-24 19:11:28 +02:00
udlfb.c
video: fbdev: udlfb: replace snprintf in show functions with sysfs_emit
2022-04-15 14:14:55 +02:00
uvesafb.c
fbdev: uvesafb: Fixes an error handling path in uvesafb_probe()
2023-01-18 11:30:29 +01:00
valkyriefb.c
…
valkyriefb.h
…
vesafb.c
…
vfb.c
vfb: fix video mode and line_length being set when loaded
2018-01-04 16:53:50 +01:00
vga16fb.c
video: fbdev: vga16fb: fix setting of pixclock because a pass-by-value error
2020-10-29 09:55:09 +01:00
vt8500lcdfb.c
video/fbdev/vt8500lcdfb: Delete an error message for a failed memory allocation in vt8500lcd_probe()
2017-12-29 19:48:44 +01:00
vt8500lcdfb.h
…
vt8623fb.c
video: fbdev: vt8623fb: Check the size of screen before memset_io()
2022-08-25 11:15:26 +02:00
w100fb.c
video: fbdev: w100fb: Reset global state
2022-04-15 14:14:55 +02:00
w100fb.h
…
wm8505fb_regs.h
…
wm8505fb.c
video/fbdev/wm8505fb: Delete an error message for a failed memory allocation in wm8505fb_probe()
2017-12-29 19:48:43 +01:00
wmt_ge_rops.c
…
wmt_ge_rops.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
xen-fbfront.c
treewide: Use array_size() in vmalloc()
2018-06-12 16:19:22 -07:00
xilinxfb.c
video: fbdev: Fix multiple style issues in xilinxfb
2017-08-21 16:49:57 +02:00