UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity
OpenCloudOS-Kernel/drivers/tty
History
Tetsuo Handa ffb324e6f8 tty: vt: always invoke vc->vc_sw->con_resize callback 
syzbot is reporting OOB write at vga16fb_imageblit() [1], for
resize_screen() from ioctl(VT_RESIZE) returns 0 without checking whether
requested rows/columns fit the amount of memory reserved for the graphical
screen if current mode is KD_GRAPHICS.

----------
  #include <sys/types.h>
  #include <sys/stat.h>
  #include <fcntl.h>
  #include <sys/ioctl.h>
  #include <linux/kd.h>
  #include <linux/vt.h>

  int main(int argc, char *argv[])
  {
        const int fd = open("/dev/char/4:1", O_RDWR);
        struct vt_sizes vt = { 0x4100, 2 };

        ioctl(fd, KDSETMODE, KD_GRAPHICS);
        ioctl(fd, VT_RESIZE, &vt);
        ioctl(fd, KDSETMODE, KD_TEXT);
        return 0;
  }
----------

Allow framebuffer drivers to return -EINVAL, by moving vc->vc_mode !=
KD_GRAPHICS check from resize_screen() to fbcon_resize().

Link: https://syzkaller.appspot.com/bug?extid=1f29e126cf461c4de3b3 [1]
Reported-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 		2021-05-15 08:12:12 -07:00
..
hvc tty: hvc: make symbol 'hvc_udbg_dev' static 2021-04-10 10:41:40 +02:00
ipwireless tty: make everyone's write_room return >= 0 2021-03-10 09:34:09 +01:00
serdev tty: serdev: core: Provide missing description for 'owner' 2020-11-06 10:49:27 +01:00
serial Power management updates for 5.13-rc1 2021-04-26 15:10:25 -07:00
vt tty: vt: always invoke vc->vc_sw->con_resize callback 2021-05-15 08:12:12 -07:00
Kconfig tty: pti: Remove Kconfig leftovers 2021-04-09 17:00:32 +02:00
Makefile tty: rocket, remove the driver 2021-03-10 09:34:06 +01:00
amiserial.c tty: amiserial: add missing TIOCSSERIAL jiffies conversions 2021-04-07 17:22:07 +02:00
ehv_bytechan.c tty: evh_bytechan: Fix out of bounds accesses 2020-03-17 23:40:31 +11:00
goldfish.c tty: goldfish: use __raw_writel()/__raw_readl() 2020-10-28 13:44:43 +01:00
mips_ejtag_fdc.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
moxa.c tty: moxa: fix TIOCSSERIAL implementation 2021-04-07 17:22:07 +02:00
moxa.h tty: fix spelling mistake 2020-06-27 16:21:20 +02:00
mxser.c tty: mxser: drop low-latency workaround 2021-04-22 12:09:24 +02:00
mxser.h
…
n_gsm.c tty: clean include/linux/tty.h up 2021-04-15 10:32:17 +02:00
n_hdlc.c tty: clean include/linux/tty.h up 2021-04-15 10:32:17 +02:00
n_null.c tty: remove TTY_LDISC_MAGIC 2021-03-10 09:34:06 +01:00
n_r3964.c tty: remove TTY_LDISC_MAGIC 2021-03-10 09:34:06 +01:00
n_tty.c tty: create internal tty.h file 2021-04-15 10:22:17 +02:00
nozomi.c tty: nozomi, remove useless debug prints 2021-03-10 09:34:08 +01:00
pty.c tty: create internal tty.h file 2021-04-15 10:22:17 +02:00
synclink_gt.c tty: synclink_gt: remove redundant initialization of variable count 2021-04-22 12:01:59 +02:00
sysrq.c tty/sysrq: Fix issues of code indent should use tabs 2021-04-10 10:33:00 +02:00
tty.h tty: clean include/linux/tty.h up 2021-04-15 10:32:17 +02:00
tty_audit.c tty: audit: move some local functions out of tty.h 2021-04-15 10:24:58 +02:00
tty_baudrate.c tty: clean include/linux/tty.h up 2021-04-15 10:32:17 +02:00
tty_buffer.c tty: move some internal tty lock enums and functions out of tty.h 2021-04-15 10:26:58 +02:00
tty_io.c tty: make tty_release_redirect() static 2021-04-15 10:28:30 +02:00
tty_ioctl.c tty: move some tty-only functions to drivers/tty/tty.h 2021-04-15 10:30:18 +02:00
tty_jobctrl.c tty: create internal tty.h file 2021-04-15 10:22:17 +02:00
tty_ldisc.c tty: create internal tty.h file 2021-04-15 10:22:17 +02:00
tty_ldsem.c
…
tty_mutex.c tty: move some internal tty lock enums and functions out of tty.h 2021-04-15 10:26:58 +02:00
tty_port.c tty: create internal tty.h file 2021-04-15 10:22:17 +02:00
ttynull.c Revert "init/console: Use ttynull as a fallback when there is no console" 2021-01-08 11:02:18 -08:00
vcc.c tty: make everyone's write_room return >= 0 2021-03-10 09:34:09 +01:00