Skip to content

Commit 6735b46

Browse files
peilin-yedanvet
peilin-ye
authored and
danvet
committed
Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts
syzbot has reported an issue in the framebuffer layer, where a malicious user may overflow our built-in font data buffers. In order to perform a reliable range check, subsystems need to know `FONTDATAMAX` for each built-in font. Unfortunately, our font descriptor, `struct console_font` does not contain `FONTDATAMAX`, and is part of the UAPI, making it infeasible to modify it. For user-provided fonts, the framebuffer layer resolves this issue by reserving four extra words at the beginning of data buffers. Later, whenever a function needs to access them, it simply uses the following macros: Recently we have gathered all the above macros to <linux/font.h>. Let us do the same thing for built-in fonts, prepend four extra words (including `FONTDATAMAX`) to their data buffers, so that subsystems can use these macros for all fonts, no matter built-in or user-provided. This patch depends on patch "fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h". Cc: stable@vger.kernel.org Link: https://syzkaller.appspot.com/bug?id=08b8be45afea11888776f897895aef9ad1c3ecfd Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/ef18af00c35fb3cc826048a5f70924ed6ddce95b.1600953813.git.yepeilin.cs@gmail.com
1 parent bb0890b commit 6735b46

13 files changed

Lines changed: 56 additions & 54 deletions

‎include/linux/font.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,4 +67,9 @@ extern const struct font_desc *get_default_font(int xres, int yres,
6767

6868
#define FONT_EXTRA_WORDS 4
6969

70+
struct font_data {
71+
unsigned int extra[FONT_EXTRA_WORDS];
72+
const unsigned char data[];
73+
} __packed;
74+
7075
#endif /* _VIDEO_FONT_H */

‎lib/fonts/font_10x18.c‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@
88

99
#define FONTDATAMAX 9216
1010

11-
static const unsigned char fontdata_10x18[FONTDATAMAX] = {
12-
11+
static struct font_data fontdata_10x18 = {
12+
{ 0, 0, FONTDATAMAX, 0 }, {
1313
/* 0 0x00 '^@' */
1414
0x00, 0x00, /* 0000000000 */
1515
0x00, 0x00, /* 0000000000 */
@@ -5129,16 +5129,15 @@ static const unsigned char fontdata_10x18[FONTDATAMAX] = {
51295129
0x00, 0x00, /* 0000000000 */
51305130
0x00, 0x00, /* 0000000000 */
51315131
0x00, 0x00, /* 0000000000 */
5132-
5133-
};
5132+
} };
51345133

51355134

51365135
const struct font_desc font_10x18 = {
51375136
.idx = FONT10x18_IDX,
51385137
.name = "10x18",
51395138
.width = 10,
51405139
.height = 18,
5141-
.data = fontdata_10x18,
5140+
.data = fontdata_10x18.data,
51425141
#ifdef __sparc__
51435142
.pref = 5,
51445143
#else

‎lib/fonts/font_6x10.c‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
// SPDX-License-Identifier: GPL-2.0
22
#include <linux/font.h>
33

4-
static const unsigned char fontdata_6x10[] = {
4+
#define FONTDATAMAX 2560
55

6+
static struct font_data fontdata_6x10 = {
7+
{ 0, 0, FONTDATAMAX, 0 }, {
68
/* 0 0x00 '^@' */
79
0x00, /* 00000000 */
810
0x00, /* 00000000 */
@@ -3074,14 +3076,13 @@ static const unsigned char fontdata_6x10[] = {
30743076
0x00, /* 00000000 */
30753077
0x00, /* 00000000 */
30763078
0x00, /* 00000000 */
3077-
3078-
};
3079+
} };
30793080

30803081
const struct font_desc font_6x10 = {
30813082
.idx = FONT6x10_IDX,
30823083
.name = "6x10",
30833084
.width = 6,
30843085
.height = 10,
3085-
.data = fontdata_6x10,
3086+
.data = fontdata_6x10.data,
30863087
.pref = 0,
30873088
};

‎lib/fonts/font_6x11.c‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@
99

1010
#define FONTDATAMAX (11*256)
1111

12-
static const unsigned char fontdata_6x11[FONTDATAMAX] = {
13-
12+
static struct font_data fontdata_6x11 = {
13+
{ 0, 0, FONTDATAMAX, 0 }, {
1414
/* 0 0x00 '^@' */
1515
0x00, /* 00000000 */
1616
0x00, /* 00000000 */
@@ -3338,16 +3338,15 @@ static const unsigned char fontdata_6x11[FONTDATAMAX] = {
33383338
0x00, /* 00000000 */
33393339
0x00, /* 00000000 */
33403340
0x00, /* 00000000 */
3341-
3342-
};
3341+
} };
33433342

33443343

33453344
const struct font_desc font_vga_6x11 = {
33463345
.idx = VGA6x11_IDX,
33473346
.name = "ProFont6x11",
33483347
.width = 6,
33493348
.height = 11,
3350-
.data = fontdata_6x11,
3349+
.data = fontdata_6x11.data,
33513350
/* Try avoiding this font if possible unless on MAC */
33523351
.pref = -2000,
33533352
};

‎lib/fonts/font_7x14.c‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@
88

99
#define FONTDATAMAX 3584
1010

11-
static const unsigned char fontdata_7x14[FONTDATAMAX] = {
12-
11+
static struct font_data fontdata_7x14 = {
12+
{ 0, 0, FONTDATAMAX, 0 }, {
1313
/* 0 0x00 '^@' */
1414
0x00, /* 0000000 */
1515
0x00, /* 0000000 */
@@ -4105,15 +4105,14 @@ static const unsigned char fontdata_7x14[FONTDATAMAX] = {
41054105
0x00, /* 0000000 */
41064106
0x00, /* 0000000 */
41074107
0x00, /* 0000000 */
4108-
4109-
};
4108+
} };
41104109

41114110

41124111
const struct font_desc font_7x14 = {
41134112
.idx = FONT7x14_IDX,
41144113
.name = "7x14",
41154114
.width = 7,
41164115
.height = 14,
4117-
.data = fontdata_7x14,
4116+
.data = fontdata_7x14.data,
41184117
.pref = 0,
41194118
};

‎lib/fonts/font_8x16.c‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@
1010

1111
#define FONTDATAMAX 4096
1212

13-
static const unsigned char fontdata_8x16[FONTDATAMAX] = {
14-
13+
static struct font_data fontdata_8x16 = {
14+
{ 0, 0, FONTDATAMAX, 0 }, {
1515
/* 0 0x00 '^@' */
1616
0x00, /* 00000000 */
1717
0x00, /* 00000000 */
@@ -4619,16 +4619,15 @@ static const unsigned char fontdata_8x16[FONTDATAMAX] = {
46194619
0x00, /* 00000000 */
46204620
0x00, /* 00000000 */
46214621
0x00, /* 00000000 */
4622-
4623-
};
4622+
} };
46244623

46254624

46264625
const struct font_desc font_vga_8x16 = {
46274626
.idx = VGA8x16_IDX,
46284627
.name = "VGA8x16",
46294628
.width = 8,
46304629
.height = 16,
4631-
.data = fontdata_8x16,
4630+
.data = fontdata_8x16.data,
46324631
.pref = 0,
46334632
};
46344633
EXPORT_SYMBOL(font_vga_8x16);

‎lib/fonts/font_8x8.c‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@
99

1010
#define FONTDATAMAX 2048
1111

12-
static const unsigned char fontdata_8x8[FONTDATAMAX] = {
13-
12+
static struct font_data fontdata_8x8 = {
13+
{ 0, 0, FONTDATAMAX, 0 }, {
1414
/* 0 0x00 '^@' */
1515
0x00, /* 00000000 */
1616
0x00, /* 00000000 */
@@ -2570,15 +2570,14 @@ static const unsigned char fontdata_8x8[FONTDATAMAX] = {
25702570
0x00, /* 00000000 */
25712571
0x00, /* 00000000 */
25722572
0x00, /* 00000000 */
2573-
2574-
};
2573+
} };
25752574

25762575

25772576
const struct font_desc font_vga_8x8 = {
25782577
.idx = VGA8x8_IDX,
25792578
.name = "VGA8x8",
25802579
.width = 8,
25812580
.height = 8,
2582-
.data = fontdata_8x8,
2581+
.data = fontdata_8x8.data,
25832582
.pref = 0,
25842583
};

‎lib/fonts/font_acorn_8x8.c‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,10 @@
33

44
#include <linux/font.h>
55

6-
static const unsigned char acorndata_8x8[] = {
6+
#define FONTDATAMAX 2048
7+
8+
static struct font_data acorndata_8x8 = {
9+
{ 0, 0, FONTDATAMAX, 0 }, {
710
/* 00 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* ^@ */
811
/* 01 */ 0x7e, 0x81, 0xa5, 0x81, 0xbd, 0x99, 0x81, 0x7e, /* ^A */
912
/* 02 */ 0x7e, 0xff, 0xbd, 0xff, 0xc3, 0xe7, 0xff, 0x7e, /* ^B */
@@ -260,14 +263,14 @@ static const unsigned char acorndata_8x8[] = {
260263
/* FD */ 0x38, 0x04, 0x18, 0x20, 0x3c, 0x00, 0x00, 0x00,
261264
/* FE */ 0x00, 0x00, 0x3c, 0x3c, 0x3c, 0x3c, 0x00, 0x00,
262265
/* FF */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
263-
};
266+
} };
264267

265268
const struct font_desc font_acorn_8x8 = {
266269
.idx = ACORN8x8_IDX,
267270
.name = "Acorn8x8",
268271
.width = 8,
269272
.height = 8,
270-
.data = acorndata_8x8,
273+
.data = acorndata_8x8.data,
271274
#ifdef CONFIG_ARCH_ACORN
272275
.pref = 20,
273276
#else

‎lib/fonts/font_mini_4x6.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,8 @@ __END__;
4343

4444
#define FONTDATAMAX 1536
4545

46-
static const unsigned char fontdata_mini_4x6[FONTDATAMAX] = {
47-
46+
static struct font_data fontdata_mini_4x6 = {
47+
{ 0, 0, FONTDATAMAX, 0 }, {
4848
/*{*/
4949
/* Char 0: ' ' */
5050
0xee, /*= [*** ] */
@@ -2145,14 +2145,14 @@ static const unsigned char fontdata_mini_4x6[FONTDATAMAX] = {
21452145
0xee, /*= [*** ] */
21462146
0x00, /*= [ ] */
21472147
/*}*/
2148-
};
2148+
} };
21492149

21502150
const struct font_desc font_mini_4x6 = {
21512151
.idx = MINI4x6_IDX,
21522152
.name = "MINI4x6",
21532153
.width = 4,
21542154
.height = 6,
2155-
.data = fontdata_mini_4x6,
2155+
.data = fontdata_mini_4x6.data,
21562156
.pref = 3,
21572157
};
21582158

‎lib/fonts/font_pearl_8x8.c‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@
1414

1515
#define FONTDATAMAX 2048
1616

17-
static const unsigned char fontdata_pearl8x8[FONTDATAMAX] = {
18-
17+
static struct font_data fontdata_pearl8x8 = {
18+
{ 0, 0, FONTDATAMAX, 0 }, {
1919
/* 0 0x00 '^@' */
2020
0x00, /* 00000000 */
2121
0x00, /* 00000000 */
@@ -2575,14 +2575,13 @@ static const unsigned char fontdata_pearl8x8[FONTDATAMAX] = {
25752575
0x00, /* 00000000 */
25762576
0x00, /* 00000000 */
25772577
0x00, /* 00000000 */
2578-
2579-
};
2578+
} };
25802579

25812580
const struct font_desc font_pearl_8x8 = {
25822581
.idx = PEARL8x8_IDX,
25832582
.name = "PEARL8x8",
25842583
.width = 8,
25852584
.height = 8,
2586-
.data = fontdata_pearl8x8,
2585+
.data = fontdata_pearl8x8.data,
25872586
.pref = 2,
25882587
};

0 commit comments

Comments
 (0)