Tetsuo Handa
ffb324e6f8
tty: vt: always invoke vc->vc_sw->con_resize callback
syzbot is reporting OOB write at vga16fb_imageblit() [1], for
resize_screen() from ioctl(VT_RESIZE) returns 0 without checking whether
requested rows/columns fit the amount of memory reserved for the graphical
screen if current mode is KD_GRAPHICS.
----------
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <linux/kd.h>
#include <linux/vt.h>
int main(int argc, char *argv[])
{
const int fd = open("/dev/char/4:1", O_RDWR);
struct vt_sizes vt = { 0x4100, 2 };
ioctl(fd, KDSETMODE, KD_GRAPHICS);
ioctl(fd, VT_RESIZE, &vt);
ioctl(fd, KDSETMODE, KD_TEXT);
return 0;
}
----------
Allow framebuffer drivers to return -EINVAL, by moving vc->vc_mode !=
KD_GRAPHICS check from resize_screen() to fbcon_resize().
Link: https://syzkaller.appspot.com/bug?extid=1f29e126cf461c4de3b3 [1]
Reported-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-05-15 08:12:12 -07:00
..
2021-04-26 11:20:10 -07:00
2021-05-13 20:39:58 +02:00
2021-04-27 13:42:11 -07:00
2021-05-05 13:24:11 -07:00
2021-05-07 16:01:08 -07:00
2021-05-07 00:26:34 -07:00
2021-05-10 19:14:01 +02:00
2021-04-18 09:36:56 +03:00
2021-05-07 11:35:12 -07:00
2021-04-29 11:57:23 -07:00
2021-04-26 12:11:52 -07:00
2021-05-12 22:36:50 +03:00
2021-05-05 13:24:11 -07:00
2021-05-01 10:14:08 -07:00
2021-04-15 09:26:25 +02:00
2021-05-10 13:22:39 +02:00
2021-05-01 10:14:08 -07:00
2021-04-16 18:21:56 -07:00
2021-05-04 11:24:46 -07:00
2021-04-28 15:59:13 -07:00
2021-04-26 09:43:16 -07:00
2021-05-07 12:11:05 -07:00
2021-04-26 12:11:52 -07:00
2021-05-05 12:39:29 -07:00
2021-05-14 09:20:04 +10:00
2021-04-16 07:26:50 +02:00
2021-04-29 21:47:22 +02:00
2021-04-16 00:14:49 +02:00
2021-04-27 18:09:44 -07:00
2021-05-12 18:53:11 -07:00
2021-05-01 10:14:08 -07:00
2021-04-30 13:01:02 -07:00
2021-04-24 22:21:01 +02:00
2021-04-26 16:32:11 -07:00
2021-05-07 11:35:12 -07:00
2021-05-06 23:37:55 -07:00
2021-04-27 10:16:46 -07:00
2021-05-05 13:24:11 -07:00
2021-05-01 10:14:08 -07:00
2021-05-06 19:24:11 -07:00
2021-05-03 12:23:03 -07:00
2021-04-13 09:16:12 -06:00
2021-04-16 23:57:51 +10:00
2021-04-28 16:10:33 -07:00
2021-05-07 00:34:51 -07:00
2021-05-07 00:34:51 -07:00
2021-05-02 00:43:35 +09:00
2021-04-26 11:08:23 +02:00
2021-04-28 15:59:13 -07:00
2021-05-01 09:33:00 -07:00
2021-04-28 15:56:51 -07:00
2021-04-26 11:14:21 -07:00
2021-05-04 18:08:40 -07:00
2021-05-08 08:31:46 -07:00
2021-04-13 14:50:57 -07:00
2021-05-06 19:24:11 -07:00
2021-05-04 09:39:26 +02:00
2021-05-03 13:57:56 -05:00
2021-05-07 00:26:34 -07:00
2021-05-06 14:39:50 -07:00
2021-05-01 10:14:08 -07:00
2021-04-29 11:57:23 -07:00
2021-05-09 00:29:45 +09:00
2021-05-07 14:49:18 -07:00
2021-04-28 15:43:58 -07:00
2021-04-26 11:20:10 -07:00
2021-05-01 10:14:08 -07:00
2021-05-05 12:53:16 -07:00
2021-04-28 15:59:13 -07:00
2021-05-04 11:13:33 -07:00
2021-05-05 13:24:11 -07:00
2021-05-03 12:15:21 -07:00
2021-05-07 11:35:12 -07:00
2021-05-08 10:44:36 -07:00
2021-04-26 09:43:16 -07:00
2021-05-01 09:33:00 -07:00
2021-04-30 12:48:14 -07:00
2021-04-30 12:44:02 -07:00
2021-05-08 10:44:36 -07:00
2021-04-26 12:11:52 -07:00
2021-05-05 12:46:48 -07:00
2021-05-15 08:12:12 -07:00
2021-04-28 17:22:10 -07:00
2021-05-03 04:55:54 -04:00
2021-05-01 09:33:00 -07:00
2021-05-05 13:31:39 -07:00
2021-05-15 08:12:12 -07:00
2021-04-29 19:06:49 +02:00
2021-05-04 04:19:59 -04:00
2021-04-28 15:59:13 -07:00
2021-05-04 10:58:49 -07:00
2021-04-15 09:26:25 +02:00
2021-05-05 13:31:39 -07:00