blit_x and blit_y are u32, so fbcon currently cannot support fonts
larger than 32x32.
The 32x32 case also needs shifting an unsigned int, to properly set bit
31, otherwise we get "UBSAN: shift-out-of-bounds in fbcon_set_font",
as reported on:
http://lore.kernel.org/all/IA1PR07MB98308653E259A6F2CE94A4AFABCE9@IA1PR07MB…
Kernel Branch: 6.2.0-rc5-next-20230124
Kernel config: https://drive.google.com/file/d/1F-LszDAizEEH0ZX0HcSR06v5q8FPl2Uv/view?usp=…
Reproducer: https://drive.google.com/file/d/1mP1jcLBY7vWCNM60OMf-ogw-urQRjNrm/view?usp=…
Reported-by: Sanan Hasanov <sanan.hasanov(a)Knights.ucf.edu>
Signed-off-by: Samuel Thibault <samuel.thibault(a)ens-lyon.org>
Fixes: 2d2699d98492 ("fbcon: font setting should check limitation of driver")
Cc: stable(a)vger.kernel.org
---
v1 -> v2:
- Use BIT macro instead of fixing bit test by hand.
- Add Fixes and Cc: stable headers.
Index: linux-6.0/drivers/video/fbdev/core/fbcon.c
===================================================================
--- linux-6.0.orig/drivers/video/fbdev/core/fbcon.c
+++ linux-6.0/drivers/video/fbdev/core/fbcon.c
@@ -2489,9 +2489,12 @@ static int fbcon_set_font(struct vc_data
h > FBCON_SWAP(info->var.rotate, info->var.yres, info->var.xres))
return -EINVAL;
+ if (font->width > 32 || font->height > 32)
+ return -EINVAL;
+
/* Make sure drawing engine can handle the font */
- if (!(info->pixmap.blit_x & (1 << (font->width - 1))) ||
- !(info->pixmap.blit_y & (1 << (font->height - 1))))
+ if (!(info->pixmap.blit_x & BIT(font->width - 1)) ||
+ !(info->pixmap.blit_y & BIT(font->height - 1)))
return -EINVAL;
/* Make sure driver can handle the font length */
This is the start of the stable review cycle for the 5.10.167 release.
There are 9 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 05 Feb 2023 10:09:58 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.167-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.167-rc1
Yan Zhai <yan(a)cloudflare.com>
net: fix NULL pointer in skb_segment_list
Soenke Huster <soenke.huster(a)eknoes.de>
Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt
Dave Hansen <dave.hansen(a)intel.com>
ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel systems
Hui Wang <hui.wang(a)canonical.com>
dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
Yu Kuai <yukuai3(a)huawei.com>
blk-cgroup: fix missing pd_online_fn() while activating policy
Hao Sun <sunhao.th(a)gmail.com>
bpf: Skip task with pid=1 in send_signal_common()
Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org>
arm64: dts: imx8mq-thor96: fix no-mmc property for SDHCI
Geert Uytterhoeven <geert+renesas(a)glider.be>
ARM: dts: vf610: Fix pca9548 i2c-mux node names
Geert Uytterhoeven <geert+renesas(a)glider.be>
ARM: dts: imx: Fix pca9547 i2c-mux node name
-------------
Diffstat:
Makefile | 4 ++--
arch/arm/boot/dts/imx53-ppd.dts | 2 +-
arch/arm/boot/dts/vf610-zii-dev-rev-b.dts | 2 +-
arch/arm/boot/dts/vf610-zii-dev-rev-c.dts | 2 +-
arch/arm64/boot/dts/freescale/imx8mq-thor96.dts | 4 ++--
block/blk-cgroup.c | 4 ++++
drivers/acpi/processor_idle.c | 23 ++++++++++++++++++++---
drivers/dma/imx-sdma.c | 4 +++-
kernel/trace/bpf_trace.c | 3 +++
net/bluetooth/hci_event.c | 13 +++++++++++++
net/core/skbuff.c | 5 ++---
11 files changed, 52 insertions(+), 14 deletions(-)
Dear.Friend
I am Mrs. Anain kaimova. I am sending this brief letter to solicit
your partnership to transfer a sum of 11.9 Million Dollars into your
reliable account as my business partner. However, it's my urgent need
for foreign partner that made me to contact you for this transaction.
Further details of the transfer will be forwarded to you if you are
ready to assist me.
Best Regards.
Mrs.Anain kaimova
The quilt patch titled
Subject: aio: fix mremap after fork null-deref
has been removed from the -mm tree. Its filename was
aio-fix-mremap-after-fork-null-deref.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Seth Jenkins <sethjenkins(a)google.com>
Subject: aio: fix mremap after fork null-deref
Date: Tue, 31 Jan 2023 12:25:55 -0500
Commit e4a0d3e720e7 ("aio: Make it possible to remap aio ring") introduced
a null-deref if mremap is called on an old aio mapping after fork as
mm->ioctx_table will be set to NULL.
[jmoyer(a)redhat.com: fix 80 column issue]
Link: https://lkml.kernel.org/r/x49sffq4nvg.fsf@segfault.boston.devel.redhat.com
Fixes: e4a0d3e720e7 ("aio: Make it possible to remap aio ring")
Signed-off-by: Seth Jenkins <sethjenkins(a)google.com>
Signed-off-by: Jeff Moyer <jmoyer(a)redhat.com>
Cc: Alexander Viro <viro(a)zeniv.linux.org.uk>
Cc: Benjamin LaHaise <bcrl(a)kvack.org>
Cc: Jann Horn <jannh(a)google.com>
Cc: Pavel Emelyanov <xemul(a)parallels.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/fs/aio.c~aio-fix-mremap-after-fork-null-deref
+++ a/fs/aio.c
@@ -361,6 +361,9 @@ static int aio_ring_mremap(struct vm_are
spin_lock(&mm->ioctx_lock);
rcu_read_lock();
table = rcu_dereference(mm->ioctx_table);
+ if (!table)
+ goto out_unlock;
+
for (i = 0; i < table->nr; i++) {
struct kioctx *ctx;
@@ -374,6 +377,7 @@ static int aio_ring_mremap(struct vm_are
}
}
+out_unlock:
rcu_read_unlock();
spin_unlock(&mm->ioctx_lock);
return res;
_
Patches currently in -mm which might be from sethjenkins(a)google.com are