Merge tag 'drm-fixes-2020-03-06-1' of git://anongit.freedesktop.org/drm/drm

2f501bb1 · Linus Torvalds <[email protected]> · 2020-03-06 16:08:48 -06:00

Pull vgacon fix from Daniel Vetter:
 "One vgacon input check for stable"

* tag 'drm-fixes-2020-03-06-1' of git://anongit.freedesktop.org/drm/drm:
  vgacon: Fix a UAF in vgacon_invert_region

Commit: 2f501bb1802dbbf1467e7999954588da31f635ad
Parents: 30fe0d07 · 513dc792

Merge commit. Changes below are compared with the first parent: 30fe0d07.

Changes

1 files changed · +3 −0

File	Status	Add	Del	Content
drivers/video/console/vgacon.c	modified	+3	−0	View file

drivers/video/console/vgacon.c

View file

diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index de7b838..998b0de 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -1316,6 +1316,9 @@ static int vgacon_font_get(struct vc_data *c, struct console_font *font)
 static int vgacon_resize(struct vc_data *c, unsigned int width,
 			 unsigned int height, unsigned int user)
 {
+	if ((width << 1) * height > vga_vram_size)
+		return -EINVAL;
+
 	if (width % 2 || width > screen_info.orig_video_cols ||
 	    height > (screen_info.orig_video_lines * vga_default_font_height)/
 	    c->vc_font.height)