Add virtual screen size check to drm_fb_helper_check_var() in
order to validate userspace input.
Found by Linux Verification Center (linuxtesting.org) with syzkaller.
Signed-off-by: Andrey Strachuk <[email protected]>
Fixes: 785b93ef8c30 ("drm/kms: move driver specific fb common code to helper functions (v2)")
---
drivers/gpu/drm/drm_fb_helper.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 2d4cee6a10ff..5c8b211769eb 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -1355,6 +1355,12 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
(drm_format_info_block_height(fb->format, 0) > 1))
return -EINVAL;
+ /* verify that virtual resolution >= physical resolution */
+ if (var->xres_virtual < var->xres)
+ var->xres_virtual = var->xres;
+ if (var->yres_virtual < var->yres)
+ var->yres_virtual = var->yres;
+
/*
* Changes struct fb_var_screeninfo are currently not pushed back
* to KMS, hence fail if different settings are requested.
--
2.25.1
Hi Andrey,
On Thu, Aug 11, 2022 at 4:49 PM Andrey Strachuk <[email protected]> wrote:
> Add virtual screen size check to drm_fb_helper_check_var() in
> order to validate userspace input.
>
> Found by Linux Verification Center (linuxtesting.org) with syzkaller.
>
> Signed-off-by: Andrey Strachuk <[email protected]>
Thanks for the update!
> Fixes: 785b93ef8c30 ("drm/kms: move driver specific fb common code to helper functions (v2)")
I'd drop the Fixes tag completely, as the bug was present in the
intel and radeon drivers before. But probably it doesn't matter, as no one
is gonna backport this to v2.6.31 and earlier ;-)
Reviewed-by: Geert Uytterhoeven <[email protected]>
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- [email protected]
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
For v2 I would suggest to update description to something like this:
Make sure that virtual screen size is not less than physical screen one.
and comment to:
/* make sure that virtual resolution >= physical resolution */
--
Alexey
On 11.08.2022 17:54, Geert Uytterhoeven wrote:
> Hi Andrey,
>
> On Thu, Aug 11, 2022 at 4:49 PM Andrey Strachuk <[email protected]> wrote:
>> Add virtual screen size check to drm_fb_helper_check_var() in
>> order to validate userspace input.
>>
>> Found by Linux Verification Center (linuxtesting.org) with syzkaller.
>>
>> Signed-off-by: Andrey Strachuk <[email protected]>
>
> Thanks for the update!
>
>> Fixes: 785b93ef8c30 ("drm/kms: move driver specific fb common code to helper functions (v2)")
>
> I'd drop the Fixes tag completely, as the bug was present in the
> intel and radeon drivers before. But probably it doesn't matter, as no one
> is gonna backport this to v2.6.31 and earlier ;-)
>
> Reviewed-by: Geert Uytterhoeven <[email protected]>
>
> Gr{oetje,eeting}s,
>
> Geert
>
> --
> Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- [email protected]
>
> In personal conversations with technical people, I call myself a hacker. But
> when I'm talking to journalists I just say "programmer" or something like that.
> -- Linus Torvalds
>
> _______________________________________________
> ldv-project mailing list
> [email protected]
> http://linuxtesting.org/cgi-bin/mailman/listinfo/ldv-project
>
On Thu, Aug 11, 2022 at 11:59:00PM +0300, Alexey Khoroshilov wrote:
> For v2 I would suggest to update description to something like this:
>
> Make sure that virtual screen size is not less than physical screen one.
>
> and comment to:
> /* make sure that virtual resolution >= physical resolution */
Did this land somewhere? If not please resend with r-b tags and
everything.
Thanks, Daniel
>
> --
> Alexey
>
>
> On 11.08.2022 17:54, Geert Uytterhoeven wrote:
> > Hi Andrey,
> >
> > On Thu, Aug 11, 2022 at 4:49 PM Andrey Strachuk <[email protected]> wrote:
> >> Add virtual screen size check to drm_fb_helper_check_var() in
> >> order to validate userspace input.
> >>
> >> Found by Linux Verification Center (linuxtesting.org) with syzkaller.
> >>
> >> Signed-off-by: Andrey Strachuk <[email protected]>
> >
> > Thanks for the update!
> >
> >> Fixes: 785b93ef8c30 ("drm/kms: move driver specific fb common code to helper functions (v2)")
> >
> > I'd drop the Fixes tag completely, as the bug was present in the
> > intel and radeon drivers before. But probably it doesn't matter, as no one
> > is gonna backport this to v2.6.31 and earlier ;-)
> >
> > Reviewed-by: Geert Uytterhoeven <[email protected]>
> >
> > Gr{oetje,eeting}s,
> >
> > Geert
> >
> > --
> > Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- [email protected]
> >
> > In personal conversations with technical people, I call myself a hacker. But
> > when I'm talking to journalists I just say "programmer" or something like that.
> > -- Linus Torvalds
> >
> > _______________________________________________
> > ldv-project mailing list
> > [email protected]
> > http://linuxtesting.org/cgi-bin/mailman/listinfo/ldv-project
> >
>
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
On 06.09.2022 22:54, Daniel Vetter wrote:
> On Thu, Aug 11, 2022 at 11:59:00PM +0300, Alexey Khoroshilov wrote:
>> For v2 I would suggest to update description to something like this:
>>
>> Make sure that virtual screen size is not less than physical screen one.
>>
>> and comment to:
>> /* make sure that virtual resolution >= physical resolution */
> Did this land somewhere?
As far as I can see it is not.
> If not please resend with r-b tags and
> everything.
The final version (v3) was resent Fri, 12 Aug 2022 04:32:12 -0700:
https://www.mail-archive.com/[email protected]/msg407965.html
--
Alexey