2
0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-24 13:13:57 +08:00
linux-next/drivers/tty/vt
Tetsuo Handa ffb324e6f8 tty: vt: always invoke vc->vc_sw->con_resize callback
syzbot is reporting OOB write at vga16fb_imageblit() [1], for
resize_screen() from ioctl(VT_RESIZE) returns 0 without checking whether
requested rows/columns fit the amount of memory reserved for the graphical
screen if current mode is KD_GRAPHICS.

----------
  #include <sys/types.h>
  #include <sys/stat.h>
  #include <fcntl.h>
  #include <sys/ioctl.h>
  #include <linux/kd.h>
  #include <linux/vt.h>

  int main(int argc, char *argv[])
  {
        const int fd = open("/dev/char/4:1", O_RDWR);
        struct vt_sizes vt = { 0x4100, 2 };

        ioctl(fd, KDSETMODE, KD_GRAPHICS);
        ioctl(fd, VT_RESIZE, &vt);
        ioctl(fd, KDSETMODE, KD_TEXT);
        return 0;
  }
----------

Allow framebuffer drivers to return -EINVAL, by moving vc->vc_mode !=
KD_GRAPHICS check from resize_screen() to fbcon_resize().

Link: https://syzkaller.appspot.com/bug?extid=1f29e126cf461c4de3b3 [1]
Reported-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-05-15 08:12:12 -07:00
..
.gitignore .gitignore: prefix local generated files with a slash 2021-05-02 00:43:35 +09:00
conmakehash.c tty: vt: move conmakehash to drivers/tty/vt/ from scripts/ 2019-12-17 14:42:46 +01:00
consolemap.c vt/consolemap: do font sum unsigned 2021-01-07 16:17:31 +01:00
cp437.uni tty: fix up a few remaining files without SPDX identifiers 2019-04-04 18:48:43 +02:00
defkeymap.c_shipped vt: keyboard, defkeymap.c_shipped, approach the unicode table 2021-01-07 16:17:31 +01:00
defkeymap.map tty: fix up a few remaining files without SPDX identifiers 2019-04-04 18:48:43 +02:00
keyboard.c vt: keyboard, Fix typo in the doc for vt_get_shift_state() 2021-03-23 10:39:27 +01:00
Makefile kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
selection.c vc: propagate "viewed as bool" from screenpos up 2020-08-18 13:45:20 +02:00
vc_screen.c Revert "vc_screen: extract vcs_read_buf_header" 2020-08-24 19:51:56 +02:00
vt_ioctl.c vt: Fix character height handling with VT_RESIZEX 2021-05-13 11:00:18 -07:00
vt.c tty: vt: always invoke vc->vc_sw->con_resize callback 2021-05-15 08:12:12 -07:00