diff options
| author | Helge Deller <deller@gmx.de> | 2022-06-02 23:06:28 +0300 |
|---|---|---|
| committer | Helge Deller <deller@gmx.de> | 2022-06-20 13:12:27 +0300 |
| commit | cad564ca557f8d3bb3b1fa965d9a2b3f6490ec69 (patch) | |
| tree | 4b127d4df3c66cb760d21e59a8fa45fdeb07488d /drivers/video | |
| parent | 3866cba87dcd0162fb41e9b3b653d0af68fad5ec (diff) | |
| download | linux-cad564ca557f8d3bb3b1fa965d9a2b3f6490ec69.tar.xz | |
fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters
The user may use the fbcon=vc:<n1>-<n2> option to tell fbcon to take
over the given range (n1...n2) of consoles. The value for n1 and n2
needs to be a positive number and up to (MAX_NR_CONSOLES - 1).
The given values were not fully checked against those boundaries yet.
To fix the issue, convert first_fb_vc and last_fb_vc to unsigned
integers and check them against the upper boundary, and make sure that
first_fb_vc is smaller than last_fb_vc.
Cc: stable@vger.kernel.org # v4.19+
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Helge Deller <deller@gmx.de>
Link: https://patchwork.freedesktop.org/patch/msgid/YpkYRMojilrtZIgM@p100
Diffstat (limited to 'drivers/video')
| -rw-r--r-- | drivers/video/fbdev/core/fbcon.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index cb8d94d7feba..1be8aa9f8074 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -125,8 +125,8 @@ static int logo_lines; enums. */ static int logo_shown = FBCON_LOGO_CANSHOW; /* console mappings */ -static int first_fb_vc; -static int last_fb_vc = MAX_NR_CONSOLES - 1; +static unsigned int first_fb_vc; +static unsigned int last_fb_vc = MAX_NR_CONSOLES - 1; static int fbcon_is_default = 1; static int primary_device = -1; static int fbcon_has_console_bind; @@ -440,10 +440,12 @@ static int __init fb_console_setup(char *this_opt) options += 3; if (*options) first_fb_vc = simple_strtoul(options, &options, 10) - 1; - if (first_fb_vc < 0) + if (first_fb_vc >= MAX_NR_CONSOLES) first_fb_vc = 0; if (*options++ == '-') last_fb_vc = simple_strtoul(options, &options, 10) - 1; + if (last_fb_vc < first_fb_vc || last_fb_vc >= MAX_NR_CONSOLES) + last_fb_vc = MAX_NR_CONSOLES - 1; fbcon_is_default = 0; continue; } |