mirror
/
linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
linux/drivers/video/fbdev/core
History
Tetsuo Handa ffb324e6f8 tty: vt: always invoke vc->vc_sw->con_resize callback 
syzbot is reporting OOB write at vga16fb_imageblit() [1], for
resize_screen() from ioctl(VT_RESIZE) returns 0 without checking whether
requested rows/columns fit the amount of memory reserved for the graphical
screen if current mode is KD_GRAPHICS.

----------
  #include <sys/types.h>
  #include <sys/stat.h>
  #include <fcntl.h>
  #include <sys/ioctl.h>
  #include <linux/kd.h>
  #include <linux/vt.h>

  int main(int argc, char *argv[])
  {
        const int fd = open("/dev/char/4:1", O_RDWR);
        struct vt_sizes vt = { 0x4100, 2 };

        ioctl(fd, KDSETMODE, KD_GRAPHICS);
        ioctl(fd, VT_RESIZE, &vt);
        ioctl(fd, KDSETMODE, KD_TEXT);
        return 0;
  }
----------

Allow framebuffer drivers to return -EINVAL, by moving vc->vc_mode !=
KD_GRAPHICS check from resize_screen() to fbcon_resize().

Link: https://syzkaller.appspot.com/bug?extid=1f29e126cf461c4de3b3 [1]
Reported-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 		2021-05-15 08:12:12 -07:00
..
Makefile fbdev: remove object duplication in Makefile 2020-01-15 17:31:52 +01:00
bitblit.c fbcon: Drop EXPORT_SYMBOL 2020-11-17 11:00:43 +01:00
cfbcopyarea.c
…
cfbfillrect.c
…
cfbimgblt.c
…
fb_cmdline.c video/fbdev: refactor video= cmdline parsing 2019-02-08 19:24:47 +01:00
fb_ddc.c
…
fb_defio.c fb_defio: Remove custom address_space_operations 2021-03-12 15:10:03 +01:00
fb_draw.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
fb_notify.c video: fbdev: core: Fix kernel-doc warnings in fbmon + fb_notify 2020-12-08 18:31:56 +01:00
fb_sys_fops.c
…
fbcmap.c fbdev: zero-fill colormap in fbcmap.c 2021-04-10 11:12:08 +02:00
fbcon.c tty: vt: always invoke vc->vc_sw->con_resize callback 2021-05-15 08:12:12 -07:00
fbcon.h drm-misc-fixes for v5.9: 2020-10-06 12:38:28 +10:00
fbcon_ccw.c fbcon: Drop EXPORT_SYMBOL 2020-11-17 11:00:43 +01:00
fbcon_cw.c fbcon: Drop EXPORT_SYMBOL 2020-11-17 11:00:43 +01:00
fbcon_rotate.c fbcon: Drop EXPORT_SYMBOL 2020-11-17 11:00:43 +01:00
fbcon_rotate.h fbcon: Make fbcon a built-time depency for fbdev 2017-08-01 17:32:07 +02:00
fbcon_ud.c fbcon: Drop EXPORT_SYMBOL 2020-11-17 11:00:43 +01:00
fbcvt.c
…
fbmem.c fbmem: fix horribly incorrect placement of __maybe_unused 2021-05-09 14:03:33 -07:00
fbmon.c video: fbdev: core: Fix kernel-doc warnings in fbmon + fb_notify 2020-12-08 18:31:56 +01:00
fbsysfs.c fbmem: pull fbcon_update_vcs() out of fb_set_var() 2020-08-04 07:37:23 +02:00
modedb.c fbdev: Ditch fb_edid_add_monspecs 2019-07-23 14:17:22 +02:00
softcursor.c fbcon: Drop EXPORT_SYMBOL 2020-11-17 11:00:43 +01:00
svgalib.c
…
syscopyarea.c
…
sysfillrect.c
…
sysimgblt.c
…
tileblit.c fbcon: Drop EXPORT_SYMBOL 2020-11-17 11:00:43 +01:00