[SRU Focal PATCH 1/3] fbcon: Disallow setting font bigger than screen size

[Cengiz Can]

From: Helge Deller <deller at gmx.de>

commit 65a01e601dbba8b7a51a2677811f70f783766682 upstream.

Prevent that users set a font size which is bigger than the physical screen.
It's unlikely this may happen (because screens are usually much larger than the
fonts and each font char is limited to 32x32 pixels), but it may happen on
smaller screens/LCD displays.

Signed-off-by: Helge Deller <deller at gmx.de>
Reviewed-by: Daniel Vetter <daniel.vetter at ffwll.ch>
Reviewed-by: Geert Uytterhoeven <geert at linux-m68k.org>
Cc: stable at vger.kernel.org # v4.14+
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
CVE-2021-33655
(cherry picked from commit 4f34f380f952289e818c76617bbb5c9a3a9a9dd0 linux-5.4.y)
Signed-off-by: Cengiz Can <cengiz.can at canonical.com>
---
 drivers/video/fbdev/core/fbcon.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 75b7705140673..539feac301547 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2490,6 +2490,11 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font,
 	if (charcount != 256 && charcount != 512)
 		return -EINVAL;
 
+	/* font bigger than screen resolution ? */
+	if (w > FBCON_SWAP(info->var.rotate, info->var.xres, info->var.yres) ||
+	    h > FBCON_SWAP(info->var.rotate, info->var.yres, info->var.xres))
+		return -EINVAL;
+
 	/* Make sure drawing engine can handle the font */
 	if (!(info->pixmap.blit_x & (1 << (font->width - 1))) ||
 	    !(info->pixmap.blit_y & (1 << (font->height - 1))))
-- 
2.34.1