lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 9 Nov 2008 20:25:37 +0100 From: Bruno Prémont <bonbons@...ux-vserver.org> To: JosephChan@....com.tw, Andrew Morton <akpm@...ux-foundation.org> Cc: <linux-fbdev-devel@...ts.sourceforge.net>, <linux-kernel@...r.kernel.org> Subject: [PATCH] Fix crash in viafb due to 4k stack overflow The function viafb_cursor() uses 2 stack-variables of CURSOR_SIZE bits; CURSOR_SIZE is defined as (8 * 1024). Using up twice 1k on stack is too much for 4k-stack (though it works with 8k-stacks). Make those two variables kzalloc'ed to preserve stack space. Signed-off-by: Bruno Prémont <bonbons@...ux-vserver.org> --- --- linux-2.6.28-rc3.orig/drviers/video/via/viafbdev.c 2008-11-09 19:22:15.000000000 +0100 +++ linux-2.6.28-rc3/drivers/video/via/viafbdev.c 2008-11-09 19:36:15.000000000 +0100 @@ -1052,10 +1052,8 @@ static void viafb_imageblit(struct fb_in static int viafb_cursor(struct fb_info *info, struct fb_cursor *cursor) { - u8 data[CURSOR_SIZE / 8]; - u32 data_bak[CURSOR_SIZE / 32]; u32 temp, xx, yy, bg_col = 0, fg_col = 0; - int size, i, j = 0; + int i, j = 0; static int hw_cursor; struct viafb_par *p_viafb_par; @@ -1178,10 +1176,15 @@ static int viafb_cursor(struct fb_info * } if (cursor->set & FB_CUR_SETSHAPE) { - size = + u8 *data = kzalloc(CURSOR_SIZE / 8, GFP_KERNEL); + u32 *data_bak = kzalloc(CURSOR_SIZE / 32, GFP_KERNEL); + int size = ((viacursor.image.width + 7) >> 3) * viacursor.image.height; + if (data == NULL || data_bak == NULL) + goto out; + if (MAX_CURS == 32) { for (i = 0; i < (CURSOR_SIZE / 32); i++) { data_bak[i] = 0x0; @@ -1231,6 +1234,9 @@ static int viafb_cursor(struct fb_info * memcpy(((struct viafb_par *)(info->par))->fbmem_virt + ((struct viafb_par *)(info->par))->cursor_start, data_bak, CURSOR_SIZE); +out: + kfree(data); + kfree(data_bak); } if (viacursor.enable) -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists