OpenCloudOS-Kernel/drivers/tty/vt
Meng Xu 8ffb82094b tty: vt: remove multi-fetch, derive font.height from font.data
In con_font_set(), when we need to guess font height (for
compat reasons?), the current approach uses multiple userspace
fetches, i.e., get_user(tmp, &charmap[32*i+h-1]), to derive
the height. This has two drawbacks:

1. performance: accessing userspace memory is less efficient than
directly de-reference the byte

2. security: a more critical problem is that the height derived
might not match with the actual font.data. This is because a user
thread might race condition to change the memory of op->data after
the op->height guessing but before the second fetch: font.data =
memdup_user(op->data, size). Leaving font.height = 32 while the
actual height is 1 or vice-versa.

This patch tries to resolve both issues by re-locating the height
guessing part after the font.data is fetched in. In this way, the
userspace data is fetched in one shot and we directly dereference
the font.data in kernel space to probe for the height.

Signed-off-by: Meng Xu <mengxu.gatech@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-10-20 14:06:45 +02:00
..
.gitignore
Makefile tty: vt/Makefile: set the variables to static 2013-01-15 21:52:24 -08:00
consolemap.c vt: use memdup_user in PIO_UNIMAP ioctl 2017-06-09 11:07:36 +02:00
cp437.uni
defkeymap.c_shipped
defkeymap.map
keyboard.c tty/vt/keyboard: Remove AVR32 bits from the driver 2017-05-18 16:34:55 +02:00
selection.c vt: make mouse selection of non-ASCII consistent 2017-04-11 21:39:15 +02:00
vc_screen.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
vt.c tty: vt: remove multi-fetch, derive font.height from font.data 2017-10-20 14:06:45 +02:00
vt_ioctl.c vt: drop access_ok() calls in unimap ioctls 2017-06-09 11:07:36 +02:00