iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/tty
History
Tetsuo Handa ffb324e6f8 tty: vt: always invoke vc->vc_sw->con_resize callback 
syzbot is reporting OOB write at vga16fb_imageblit() [1], for
resize_screen() from ioctl(VT_RESIZE) returns 0 without checking whether
requested rows/columns fit the amount of memory reserved for the graphical
screen if current mode is KD_GRAPHICS.

----------
  #include <sys/types.h>
  #include <sys/stat.h>
  #include <fcntl.h>
  #include <sys/ioctl.h>
  #include <linux/kd.h>
  #include <linux/vt.h>

  int main(int argc, char *argv[])
  {
        const int fd = open("/dev/char/4:1", O_RDWR);
        struct vt_sizes vt = { 0x4100, 2 };

        ioctl(fd, KDSETMODE, KD_GRAPHICS);
        ioctl(fd, VT_RESIZE, &vt);
        ioctl(fd, KDSETMODE, KD_TEXT);
        return 0;
  }
----------

Allow framebuffer drivers to return -EINVAL, by moving vc->vc_mode !=
KD_GRAPHICS check from resize_screen() to fbcon_resize().

Link: https://syzkaller.appspot.com/bug?extid=1f29e126cf461c4de3b3 [1]
Reported-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-05-15 08:12:12 -07:00
..
hvc
tty: hvc: make symbol 'hvc_udbg_dev' static
2021-04-10 10:41:40 +02:00
ipwireless
tty: make everyone's write_room return >= 0
2021-03-10 09:34:09 +01:00
serdev
tty: serdev: core: Provide missing description for 'owner'
2020-11-06 10:49:27 +01:00
serial
Power management updates for 5.13-rc1
2021-04-26 15:10:25 -07:00
vt
tty: vt: always invoke vc->vc_sw->con_resize callback
2021-05-15 08:12:12 -07:00
amiserial.c
tty: amiserial: add missing TIOCSSERIAL jiffies conversions
2021-04-07 17:22:07 +02:00
ehv_bytechan.c
tty: evh_bytechan: Fix out of bounds accesses
2020-03-17 23:40:31 +11:00
goldfish.c
tty: goldfish: use __raw_writel()/__raw_readl()
2020-10-28 13:44:43 +01:00
Kconfig
tty: pti: Remove Kconfig leftovers
2021-04-09 17:00:32 +02:00
Makefile
tty: rocket, remove the driver
2021-03-10 09:34:06 +01:00
mips_ejtag_fdc.c
treewide: Use fallthrough pseudo-keyword
2020-08-23 17:36:59 -05:00
moxa.c
tty: moxa: fix TIOCSSERIAL implementation
2021-04-07 17:22:07 +02:00
moxa.h
tty: fix spelling mistake
2020-06-27 16:21:20 +02:00
mxser.c
tty: mxser: drop low-latency workaround
2021-04-22 12:09:24 +02:00
mxser.h
…
n_gsm.c
tty: clean include/linux/tty.h up
2021-04-15 10:32:17 +02:00
n_hdlc.c
tty: clean include/linux/tty.h up
2021-04-15 10:32:17 +02:00
n_null.c
tty: remove TTY_LDISC_MAGIC
2021-03-10 09:34:06 +01:00
n_r3964.c
tty: remove TTY_LDISC_MAGIC
2021-03-10 09:34:06 +01:00
n_tty.c
tty: create internal tty.h file
2021-04-15 10:22:17 +02:00
nozomi.c
tty: nozomi, remove useless debug prints
2021-03-10 09:34:08 +01:00
pty.c
tty: create internal tty.h file
2021-04-15 10:22:17 +02:00
synclink_gt.c
tty: synclink_gt: remove redundant initialization of variable count
2021-04-22 12:01:59 +02:00
sysrq.c
tty/sysrq: Fix issues of code indent should use tabs
2021-04-10 10:33:00 +02:00
tty_audit.c
tty: audit: move some local functions out of tty.h
2021-04-15 10:24:58 +02:00
tty_baudrate.c
tty: clean include/linux/tty.h up
2021-04-15 10:32:17 +02:00
tty_buffer.c
tty: move some internal tty lock enums and functions out of tty.h
2021-04-15 10:26:58 +02:00
tty_io.c
tty: make tty_release_redirect() static
2021-04-15 10:28:30 +02:00
tty_ioctl.c
tty: move some tty-only functions to drivers/tty/tty.h
2021-04-15 10:30:18 +02:00
tty_jobctrl.c
tty: create internal tty.h file
2021-04-15 10:22:17 +02:00
tty_ldisc.c
tty: create internal tty.h file
2021-04-15 10:22:17 +02:00
tty_ldsem.c
…
tty_mutex.c
tty: move some internal tty lock enums and functions out of tty.h
2021-04-15 10:26:58 +02:00
tty_port.c
tty: create internal tty.h file
2021-04-15 10:22:17 +02:00
tty.h
tty: clean include/linux/tty.h up
2021-04-15 10:32:17 +02:00
ttynull.c
Revert "init/console: Use ttynull as a fallback when there is no console"
2021-01-08 11:02:18 -08:00
vcc.c
tty: make everyone's write_room return >= 0
2021-03-10 09:34:09 +01:00