Received: by 2002:a05:6a10:22f:0:0:0:0 with SMTP id 15csp3301984pxk; Mon, 21 Sep 2020 10:05:25 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwBZk8J39YDWdavrYZifpCOr88jF6DKoMUDPBAsTMSyL2wspdvW33STH6eIR7X7xc3ELBEb X-Received: by 2002:a50:abc3:: with SMTP id u61mr609442edc.129.1600707925465; Mon, 21 Sep 2020 10:05:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1600707925; cv=none; d=google.com; s=arc-20160816; b=qIonXOSWzTLgabNn8fvOb4h07NqfZyKqFsEGV3yhr93KK8xEb79D09+PeP6RPsPtOP Kw2E+5zLWBDn5aRg16pGvFGwk4JX8wfHwgFbJU+lKEiBYsTqYGen/8vghn6ZD/XxLLpU E6j3HTREx3qWc0DjPAyPJlrns1GJESmpa2mA0UcmLvzq8il+ofNETFdLO/uZJ2yYskEa PEjIRWoyhCv0Xs2CUljKEq1SwsNV2lhYCOh7drLLLd6tz1cTmbKHnmrWf6WON/OqSncR Xl6mK79quC1Xad7e65vyncnRDk8iRtU3vv/xJ3sIje3+2dfikTjPkyVWSfGb5DsqzWek bX3A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=Gcgc/Am5rChfVdg+xoEFaYlLDjdZtqXXuJH0b28Zgis=; b=LrTJMk1ylNUIlwXVkaMnyaWwcCIGNyOICZHu5DIOBx1OBw54Ok3dFppc9dy2doQxfM d7FnJWeriRBCT204OlmjQYS4cC2SJYZq1QJ0Z3gaJzryz8C9x9JbJ5LQcLW68dlt7sYL A9UoMU5YVKwsD8VuyfOUznYVV1DW2d5NsoNdhVd/eYW/t7KVns/D7QIa8zNGUxsHEk6P t65Uxvzx8+opU5ISfiwKbcmG2hCjTqrVLLOZiHlWOyGV5sFVrBYvRSdIJlTw444kVK2E qWTq/rwmM1c6n6qIfdR1u/BSBX+z482OWiML+Y8edWUFJT5cq+UhqcW2C43c2aERHKEO Ro4A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=zw6qimoB; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id ga23si8186658ejb.691.2020.09.21.10.05.00; Mon, 21 Sep 2020 10:05:25 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=zw6qimoB; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729307AbgIURB5 (ORCPT + 99 others); Mon, 21 Sep 2020 13:01:57 -0400 Received: from mail.kernel.org ([198.145.29.99]:39946 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729188AbgIUQin (ORCPT ); Mon, 21 Sep 2020 12:38:43 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0F598239D1; Mon, 21 Sep 2020 16:38:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1600706321; bh=/6ABPznMbPJMPHwQ9dNfrnIj4B/bBpl7xDMTEHxTExI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zw6qimoBsr/FPurID+ol1Vt3OHjSwovTSgAS5ZHWJhWBrcIYKI2sGuMGI2I9K1+WN UMy8tXAZoha4kuuMfTfeigHTTSqo++XklGS5inX31BxeSwsewHMM0CjlPObhhqt1vg d0kEA6bHTq0aWtvzvd/l0b6ugnWRL8EWNra7+T1U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot , Tetsuo Handa Subject: [PATCH 4.14 52/94] video: fbdev: fix OOB read in vga_8planes_imageblit() Date: Mon, 21 Sep 2020 18:27:39 +0200 Message-Id: <20200921162037.950110055@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200921162035.541285330@linuxfoundation.org> References: <20200921162035.541285330@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tetsuo Handa commit bd018a6a75cebb511bb55a0e7690024be975fe93 upstream. syzbot is reporting OOB read at vga_8planes_imageblit() [1], for "cdat[y] >> 4" can become a negative value due to "const char *cdat". [1] https://syzkaller.appspot.com/bug?id=0d7a0da1557dcd1989e00cb3692b26d4173b4132 Reported-by: syzbot Signed-off-by: Tetsuo Handa Cc: stable Link: https://lore.kernel.org/r/90b55ec3-d5b0-3307-9f7c-7ff5c5fd6ad3@i-love.sakura.ne.jp Signed-off-by: Greg Kroah-Hartman --- drivers/video/fbdev/vga16fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/video/fbdev/vga16fb.c +++ b/drivers/video/fbdev/vga16fb.c @@ -1122,7 +1122,7 @@ static void vga_8planes_imageblit(struct char oldop = setop(0); char oldsr = setsr(0); char oldmask = selectmask(); - const char *cdat = image->data; + const unsigned char *cdat = image->data; u32 dx = image->dx; char __iomem *where; int y;