On Mon, 22 Sep 2025, Jani Nikula <[email protected]> wrote: > On Fri, 12 Sep 2025, Samasth Norway Ananda <[email protected]> > wrote: >> Fix integer overflow vulnerabilities in fbcon_do_set_font() where font >> size calculations could overflow when handling user-controlled font >> parameters. >> >> The vulnerabilities occur when: >> 1. CALC_FONTSZ(h, pitch, charcount) performs h * pith * charcount >> multiplication with user-controlled values that can overflow. >> 2. FONT_EXTRA_WORDS * sizeof(int) + size addition can also overflow >> 3. This results in smaller allocations than expected, leading to buffer >> overflows during font data copying. >> >> Add explicit overflow checking using check_mul_overflow() and >> check_add_overflow() kernel helpers to safety validate all size >> calculations before allocation. >> >> Signed-off-by: Samasth Norway Ananda <[email protected]> >> --- >> drivers/video/fbdev/core/fbcon.c | 11 +++++++++-- >> 1 file changed, 9 insertions(+), 2 deletions(-) >> >> diff --git a/drivers/video/fbdev/core/fbcon.c >> b/drivers/video/fbdev/core/fbcon.c >> index 55f5731e94c3..a507d05f8fea 100644 >> --- a/drivers/video/fbdev/core/fbcon.c >> +++ b/drivers/video/fbdev/core/fbcon.c >> @@ -2531,9 +2531,16 @@ static int fbcon_set_font(struct vc_data *vc, const >> struct console_font *font, >> if (fbcon_invalid_charcount(info, charcount)) >> return -EINVAL; >> >> - size = CALC_FONTSZ(h, pitch, charcount); >> + /* Check for integer overflow in font size calculation */ >> + if (check_mul_overflow(h, pitch, &size) || >> + check_mul_overflow(size, charcount, &size)) >> + return -EINVAL; >> + >> + /* Check for overflow in allocation size calculation */ >> + if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &size)) > > This change stores the intermediate value into size, but fails to take > into account that size is used just a bit later in the function, > expecting the original size: > > new_data += FONT_EXTRA_WORDS * sizeof(int); > FNTSIZE(new_data) = size; > REFCOUNT(new_data) = 0; /* usage counter */ > for (i=0; i< charcount; i++) { > memcpy(new_data + i*h*pitch, data + i*vpitch*pitch, h*pitch); > } > > /* Since linux has a nice crc32 function use it for counting font > * checksums. */ > csum = crc32(0, new_data, size); > > What was supposed to address an unlikely integer overflow seems to have > caused a real buffer overflow [1].
The overflow of 16 bytes matches FONT_EXTRA_WORDS * sizeof(int): memcmp: detected buffer overflow: 8208 byte read of buffer size 8192 > BR, > Jani. > > > [1] https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15020 > >> + return -EINVAL; >> >> - new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER); >> + new_data = kmalloc(size, GFP_USER); >> >> if (!new_data) >> return -ENOMEM; -- Jani Nikula, Intel
