| Message ID | 20190128100435.759-1-martink@posteo.de (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | fbdev: fbmem: fix memory access if logo is bigger than the screen | expand |
On 01/28/2019 11:04 AM, Martin Kepplinger wrote: > From: Manfred Schlaegl <manfred.schlaegl@ginzinger.com> > > There is no clipping on the x or y axis for logos larger that the framebuffer > size. Therefore: a logo bigger than screen size leads to invalid memory access: > > [ 1.254664] Backtrace: > [ 1.254728] [<c02714e0>] (cfb_imageblit) from [<c026184c>] (fb_show_logo+0x620/0x684) > [ 1.254763] r10:00000003 r9:00027fd8 r8:c6a40000 r7:c6a36e50 r6:00000000 r5:c06b81e4 > [ 1.254774] r4:c6a3e800 > [ 1.254810] [<c026122c>] (fb_show_logo) from [<c026c1e4>] (fbcon_switch+0x3fc/0x46c) > [ 1.254842] r10:c6a3e824 r9:c6a3e800 r8:00000000 r7:c6a0c000 r6:c070b014 r5:c6a3e800 > [ 1.254852] r4:c6808c00 > [ 1.254889] [<c026bde8>] (fbcon_switch) from [<c029c8f8>] (redraw_screen+0xf0/0x1e8) > [ 1.254918] r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:c070d5a0 r5:00000080 > [ 1.254928] r4:c6808c00 > [ 1.254961] [<c029c808>] (redraw_screen) from [<c029d264>] (do_bind_con_driver+0x194/0x2e4) > [ 1.254991] r9:00000000 r8:00000000 r7:00000014 r6:c070d5a0 r5:c070d5a0 r4:c070d5a0 > > So prevent displaying a logo bigger than screen size and avoid invalid > memory access. > > Signed-off-by: Manfred Schlaegl <manfred.schlaegl@ginzinger.com> > Signed-off-by: Martin Kepplinger <martin.kepplinger@ginzinger.com> Patch queued for v5.1, thanks. Best regards, -- Bartlomiej Zolnierkiewicz Samsung R&D Institute Poland Samsung Electronics
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c index cb43a2258c51..4721491e6c8c 100644 --- a/drivers/video/fbdev/core/fbmem.c +++ b/drivers/video/fbdev/core/fbmem.c @@ -431,6 +431,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image, { unsigned int x; + if (image->width > info->var.xres || image->height > info->var.yres) + return; + if (rotate == FB_ROTATE_UR) { for (x = 0; x < num && image->dx + image->width <= info->var.xres;