kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-31 05:15:34 +00:00
Code Issues Releases Packages Activity
linux/drivers/video/fbdev/core
History
Qianqiang Liu f7fb5dda55 fbcon: Fix a NULL pointer dereference issue in fbcon_putcs 
[ Upstream commit 5b97eebcce ]

syzbot has found a NULL pointer dereference bug in fbcon.
Here is the simplified C reproducer:

struct param {
	uint8_t type;
	struct tiocl_selection ts;
};

int main()
{
	struct fb_con2fbmap con2fb;
	struct param param;

	int fd = open("/dev/fb1", 0, 0);

	con2fb.console = 0x19;
	con2fb.framebuffer = 0;
	ioctl(fd, FBIOPUT_CON2FBMAP, &con2fb);

	param.type = 2;
	param.ts.xs = 0; param.ts.ys = 0;
	param.ts.xe = 0; param.ts.ye = 0;
	param.ts.sel_mode = 0;

	int fd1 = open("/dev/tty1", O_RDWR, 0);
	ioctl(fd1, TIOCLINUX, &param);

	con2fb.console = 1;
	con2fb.framebuffer = 0;
	ioctl(fd, FBIOPUT_CON2FBMAP, &con2fb);

	return 0;
}

After calling ioctl(fd1, TIOCLINUX, &param), the subsequent ioctl(fd, FBIOPUT_CON2FBMAP, &con2fb)
causes the kernel to follow a different execution path:

 set_con2fb_map
  -> con2fb_init_display
   -> fbcon_set_disp
    -> redraw_screen
     -> hide_cursor
      -> clear_selection
       -> highlight
        -> invert_screen
         -> do_update_region
          -> fbcon_putcs
           -> ops->putcs

Since ops->putcs is a NULL pointer, this leads to a kernel panic.
To prevent this, we need to call set_blitting_type() within set_con2fb_map()
to properly initialize ops->putcs.

Reported-by: syzbot+3d613ae53c031502687a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3d613ae53c031502687a
Tested-by: syzbot+3d613ae53c031502687a@syzkaller.appspotmail.com
Signed-off-by: Qianqiang Liu <qianqiang.liu@163.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2024-10-17 15:24:21 +02:00
..
bitblit.c fbcon: Fix null-ptr-deref in soft_cursor 2023-05-27 19:18:59 +02:00
cfbcopyarea.c fbdev: core: cfbcopyarea: fix sloppy typing 2023-10-16 23:22:53 +02:00
cfbfillrect.c fbdev: move fbdev core files to separate directory 2014-04-17 08:10:19 +03:00
cfbimgblt.c fbdev: Fix cfb_imageblit() for arbitrary image widths 2022-03-25 09:55:54 +10:00
fb_backlight.c fbdev/core: Move framebuffer and backlight helpers into separate files 2023-06-27 09:58:51 +02:00
fb_chrdev.c fbdev/core: Move file-I/O code into separate file 2023-06-27 09:58:51 +02:00
fb_cmdline.c fbdev: Handle video= parameter in video/cmdline.c 2023-02-20 14:56:48 +01:00
fb_ddc.c fb_ddc: Allow I2C adapters without SCL read capability 2015-09-30 10:46:55 +03:00
fb_defio.c fbdev: fix incorrect address computation in deferred IO 2024-05-02 16:32:46 +02:00
fb_draw.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
fb_info.c fbdev: Document that framebuffer_alloc() returns zero'ed data 2023-07-24 16:50:39 +02:00
fb_internal.h fbdev: Make support for userspace interfaces configurable 2023-06-27 09:58:51 +02:00
fb_io_fops.c fbdev: Provide I/O-memory helpers as module 2024-06-12 11:11:56 +02:00
fb_notify.c video: fbdev: core: Fix kernel-doc warnings in fbmon + fb_notify 2020-12-08 18:31:56 +01:00
fb_procfs.c fbdev/core: Move procfs code to separate file 2023-06-27 09:58:51 +02:00
fb_sys_fops.c fbdev: Validate info->screen_{base, buffer} in fb_ops implementations 2023-05-08 15:28:34 +02:00
fbcmap.c fbdev: zero-fill colormap in fbcmap.c 2021-04-10 11:12:08 +02:00
fbcon.c fbcon: Fix a NULL pointer dereference issue in fbcon_putcs 2024-10-17 15:24:21 +02:00
fbcon.h fbcon: Replace FBCON_FLAGS_INIT with a boolean 2022-04-07 16:52:13 +02:00
fbcon_ccw.c fbcon: Add option to enable legacy hardware acceleration 2022-02-02 15:16:26 +01:00
fbcon_cw.c fbcon: Add option to enable legacy hardware acceleration 2022-02-02 15:16:26 +01:00
fbcon_rotate.c fbcon: Drop EXPORT_SYMBOL 2020-11-17 11:00:43 +01:00
fbcon_rotate.h fbcon: Add option to enable legacy hardware acceleration 2022-02-02 15:16:26 +01:00
fbcon_ud.c fbcon: Add option to enable legacy hardware acceleration 2022-02-02 15:16:26 +01:00
fbcvt.c video: fbdev: fbcvt.c: fix printing in fb_cvt_print_name() 2022-01-30 21:19:22 +01:00
fbmem.c fbdev/core: Rework fb init code 2023-06-27 09:58:51 +02:00
fbmon.c fbmon: prevent division by zero in fb_videomode_from_videomode() 2024-04-13 13:07:40 +02:00
fbsysfs.c fbdev/core: Use list_for_each_entry() helper 2023-08-31 22:54:34 +02:00
Kconfig drm/omapdrm: Fix console with deferred ops 2024-06-12 11:11:56 +02:00
Makefile fbdev: Provide I/O-memory helpers as module 2024-06-12 11:11:56 +02:00
modedb.c fbdev/core: Use list_for_each_entry() helper 2023-08-31 22:54:34 +02:00
softcursor.c fbcon: Drop EXPORT_SYMBOL 2020-11-17 11:00:43 +01:00
svgalib.c drm/i915: Move abs_diff() to math.h 2023-08-18 10:18:59 -07:00
syscopyarea.c fbdev: core: syscopyarea: fix sloppy typing 2023-10-16 23:22:53 +02:00
sysfillrect.c fbdev: Improve performance of sys_fillrect() 2022-03-02 20:20:34 +01:00
sysimgblt.c fbdev: fix potential OOB read in fast_imageblit() 2023-06-24 21:55:11 +02:00
tileblit.c Revert "fbdev: Garbage collect fbdev scrolling acceleration, part 1 (from TODO list)" 2022-02-02 15:14:56 +01:00