This is a note to let you know that I've just added the patch titled fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters to the 4.19-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: fbcon-fix-boundary-checks-for-fbcon-vc-n1-n2-parameters.patch and it can be found in the queue-4.19 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From cad564ca557f8d3bb3b1fa965d9a2b3f6490ec69 Mon Sep 17 00:00:00 2001 From: Helge Deller <deller@xxxxxx> Date: Thu, 2 Jun 2022 22:06:28 +0200 Subject: fbcon: Fix boundary checks for fbcon=vc:n1-n2 parameters From: Helge Deller <deller@xxxxxx> commit cad564ca557f8d3bb3b1fa965d9a2b3f6490ec69 upstream. The user may use the fbcon=vc:<n1>-<n2> option to tell fbcon to take over the given range (n1...n2) of consoles. The value for n1 and n2 needs to be a positive number and up to (MAX_NR_CONSOLES - 1). The given values were not fully checked against those boundaries yet. To fix the issue, convert first_fb_vc and last_fb_vc to unsigned integers and check them against the upper boundary, and make sure that first_fb_vc is smaller than last_fb_vc. Cc: stable@xxxxxxxxxxxxxxx # v4.19+ Reviewed-by: Daniel Vetter <daniel.vetter@xxxxxxxx> Signed-off-by: Helge Deller <deller@xxxxxx> Link: https://patchwork.freedesktop.org/patch/msgid/YpkYRMojilrtZIgM@p100 Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/video/fbdev/core/fbcon.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -103,8 +103,8 @@ static int logo_lines; enums. */ static int logo_shown = FBCON_LOGO_CANSHOW; /* console mappings */ -static int first_fb_vc; -static int last_fb_vc = MAX_NR_CONSOLES - 1; +static unsigned int first_fb_vc; +static unsigned int last_fb_vc = MAX_NR_CONSOLES - 1; static int fbcon_is_default = 1; static int fbcon_has_exited; static int primary_device = -1; @@ -456,10 +456,12 @@ static int __init fb_console_setup(char options += 3; if (*options) first_fb_vc = simple_strtoul(options, &options, 10) - 1; - if (first_fb_vc < 0) + if (first_fb_vc >= MAX_NR_CONSOLES) first_fb_vc = 0; if (*options++ == '-') last_fb_vc = simple_strtoul(options, &options, 10) - 1; + if (last_fb_vc < first_fb_vc || last_fb_vc >= MAX_NR_CONSOLES) + last_fb_vc = MAX_NR_CONSOLES - 1; fbcon_is_default = 0; continue; } Patches currently in stable-queue which might be from deller@xxxxxx are queue-4.19/fbcon-fix-boundary-checks-for-fbcon-vc-n1-n2-parameters.patch