Tetsuo Handa
eb46907f99
tty: vt: always invoke vc->vc_sw->con_resize callback ...
commit ffb324e6f874121f7dce5bdae5e05d02baae7269 upstream.
syzbot is reporting OOB write at vga16fb_imageblit() [1], for
resize_screen() from ioctl(VT_RESIZE) returns 0 without checking whether
requested rows/columns fit the amount of memory reserved for the graphical
screen if current mode is KD_GRAPHICS.
----------
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <linux/kd.h>
#include <linux/vt.h>
int main(int argc, char *argv[])
{
const int fd = open("/dev/char/4:1", O_RDWR);
struct vt_sizes vt = { 0x4100, 2 };
ioctl(fd, KDSETMODE, KD_GRAPHICS);
ioctl(fd, VT_RESIZE, &vt);
ioctl(fd, KDSETMODE, KD_TEXT);
return 0;
}
----------
Allow framebuffer drivers to return -EINVAL, by moving vc->vc_mode !=
KD_GRAPHICS check from resize_screen() to fbcon_resize().
Link: https://syzkaller.appspot.com/bug?extid=1f29e126cf461c4de3b3 [1]
Reported-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-05-26 12:06:56 +02:00
2020-09-27 14:17:43 +02:00
2020-09-04 18:08:16 +02:00
2021-05-26 12:06:52 +02:00
2021-05-26 12:06:56 +02:00
2021-05-14 09:49:55 +02:00
2020-07-16 12:35:15 -07:00
2020-07-16 12:35:15 -07:00
2020-06-14 01:57:21 +09:00
2020-08-23 17:36:59 -05:00
2021-05-14 09:49:56 +02:00
2020-06-27 16:21:20 +02:00
2020-05-15 14:47:05 +02:00
2021-05-11 14:47:21 +02:00
2021-03-04 11:37:36 +01:00
2021-03-04 11:37:36 +01:00
2021-03-04 11:37:36 +01:00
2021-03-04 11:37:36 +01:00
2021-03-04 11:37:36 +01:00
2021-03-07 12:34:16 +01:00
2020-09-04 18:10:30 +02:00
2020-04-27 09:33:21 +02:00
2020-09-04 18:07:22 +02:00
2020-08-18 13:51:18 +02:00
2020-08-18 13:51:18 +02:00
2020-10-02 14:56:06 +02:00
2020-08-18 13:51:18 +02:00
2020-08-18 13:51:18 +02:00
2021-05-14 09:50:18 +02:00
2021-05-14 09:50:19 +02:00
2020-12-04 17:39:58 +01:00
2020-08-18 13:51:18 +02:00
2020-04-28 14:38:54 +02:00
eb46907f99