From: Adam Borowski <kilobyte@angband.pl> To: Jiri Slaby <jirislaby@kernel.org> Cc: Helge Deller <deller@gmx.de>, Khalid Masum <khalid.masum.92@gmail.com>, syzbot <syzbot+14b0e8f3fd1612e35350@syzkaller.appspotmail.com>, dri-devel@lists.freedesktop.org, linux-fbdev@vger.kernel.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, Greg Kroah-Hartman <gregkh@linuxfoundation.org> Subject: Re: [PATCH] tty: vt: selection: Add check for valid tiocl_selection values Date: Fri, 5 Aug 2022 13:13:15 +0200 [thread overview] Message-ID: <Yuz7S18rHNbHCHly@angband.pl> (raw) In-Reply-To: <2d4e82f9-e370-bb01-8656-fe0376c22a77@kernel.org> On Thu, Aug 04, 2022 at 11:22:26AM +0200, Jiri Slaby wrote: > On 04. 08. 22, 10:44, Helge Deller wrote: > > On 8/4/22 09:15, Helge Deller wrote: > > > On 8/4/22 07:47, Jiri Slaby wrote: > > > > On 30. 07. 22, 20:49, Helge Deller wrote: > > > > > The line and column numbers for the selection need to start at 1. > > > > > Add the checks to prevent invalid input. > > > > > --- a/drivers/tty/vt/selection.c > > > > > +++ b/drivers/tty/vt/selection.c > > > > > @@ -326,6 +326,9 @@ static int vc_selection(struct vc_data *vc, struct tiocl_selection *v, > > > > > + if (!v->xs || !v->ys || !v->xe || !v->ye) > > > > > + return -EINVAL; > > > > > > > > Hmm, I'm not sure about this. It potentially breaks userspace (by > > > > returning EINVAL now). > We can still do a trial and revert it if something breaks... It's just that > _noone_ knows with all this undocumented stuff ;). > > But in fact, 0 currently means full row/column. Isn't it on purpose? > > Today, we are out of luck, codesearch.debian.net gives no clue about users: > https://codesearch.debian.net/search?q=%5CbTIOCL_SETSEL%5Cb&literal=0 That's because the macro is undocumented. "man ioctl_console" says: TIOCLINUX, subcode=2 Set selection. argp points to a [...] thus everyone writes it as a number. You'd need to grep for TIOCLINUX; there's not that many references to check... Meow! -- ⢀⣴⠾⠻⢶⣦⠀ ⣾⠁⢠⠒⠀⣿⡁ Say what you want about Adolf, at least he was the man who ⢿⡄⠘⠷⠚⠋⠀ killed Hitler. Your turn, Vlad! ⠈⠳⣄⠀⠀⠀⠀
WARNING: multiple messages have this Message-ID (diff)
From: Adam Borowski <kilobyte@angband.pl> To: Jiri Slaby <jirislaby@kernel.org> Cc: linux-fbdev@vger.kernel.org, Khalid Masum <khalid.masum.92@gmail.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Helge Deller <deller@gmx.de>, syzkaller-bugs@googlegroups.com, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, syzbot <syzbot+14b0e8f3fd1612e35350@syzkaller.appspotmail.com> Subject: Re: [PATCH] tty: vt: selection: Add check for valid tiocl_selection values Date: Fri, 5 Aug 2022 13:13:15 +0200 [thread overview] Message-ID: <Yuz7S18rHNbHCHly@angband.pl> (raw) In-Reply-To: <2d4e82f9-e370-bb01-8656-fe0376c22a77@kernel.org> On Thu, Aug 04, 2022 at 11:22:26AM +0200, Jiri Slaby wrote: > On 04. 08. 22, 10:44, Helge Deller wrote: > > On 8/4/22 09:15, Helge Deller wrote: > > > On 8/4/22 07:47, Jiri Slaby wrote: > > > > On 30. 07. 22, 20:49, Helge Deller wrote: > > > > > The line and column numbers for the selection need to start at 1. > > > > > Add the checks to prevent invalid input. > > > > > --- a/drivers/tty/vt/selection.c > > > > > +++ b/drivers/tty/vt/selection.c > > > > > @@ -326,6 +326,9 @@ static int vc_selection(struct vc_data *vc, struct tiocl_selection *v, > > > > > + if (!v->xs || !v->ys || !v->xe || !v->ye) > > > > > + return -EINVAL; > > > > > > > > Hmm, I'm not sure about this. It potentially breaks userspace (by > > > > returning EINVAL now). > We can still do a trial and revert it if something breaks... It's just that > _noone_ knows with all this undocumented stuff ;). > > But in fact, 0 currently means full row/column. Isn't it on purpose? > > Today, we are out of luck, codesearch.debian.net gives no clue about users: > https://codesearch.debian.net/search?q=%5CbTIOCL_SETSEL%5Cb&literal=0 That's because the macro is undocumented. "man ioctl_console" says: TIOCLINUX, subcode=2 Set selection. argp points to a [...] thus everyone writes it as a number. You'd need to grep for TIOCLINUX; there's not that many references to check... Meow! -- ⢀⣴⠾⠻⢶⣦⠀ ⣾⠁⢠⠒⠀⣿⡁ Say what you want about Adolf, at least he was the man who ⢿⡄⠘⠷⠚⠋⠀ killed Hitler. Your turn, Vlad! ⠈⠳⣄⠀⠀⠀⠀
next prev parent reply other threads:[~2022-08-05 11:13 UTC|newest] Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-11-19 9:18 [syzbot] KASAN: vmalloc-out-of-bounds Write in imageblit (2) syzbot 2022-01-20 22:58 ` syzbot 2022-01-21 1:48 ` syzbot 2022-07-29 6:51 ` Khalid Masum 2022-07-30 17:25 ` Helge Deller 2022-07-30 18:49 ` [PATCH] tty: vt: selection: Add check for valid tiocl_selection values Helge Deller 2022-08-04 5:47 ` Jiri Slaby 2022-08-04 7:15 ` Helge Deller 2022-08-04 8:44 ` Helge Deller 2022-08-04 9:22 ` Jiri Slaby 2022-08-05 11:13 ` Adam Borowski [this message] 2022-08-05 11:13 ` Adam Borowski 2022-07-30 18:50 ` [PATCH] vt: Clear selection before changing the font Helge Deller 2022-07-31 11:32 ` Khalid Masum 2022-07-31 10:03 ` [syzbot] KASAN: vmalloc-out-of-bounds Write in imageblit (2) Khalid Masum 2022-07-31 10:54 ` Helge Deller 2022-07-31 10:54 ` Helge Deller 2022-07-31 11:23 ` Khalid Masum 2022-07-31 11:23 ` Khalid Masum 2022-07-31 13:55 ` Khalid Masum 2022-07-31 15:39 ` Helge Deller 2022-08-01 4:09 ` Khalid Masum 2022-07-30 8:12 ` Khalid Masum 2022-07-30 10:55 ` syzbot 2022-08-01 10:43 ` Dan Carpenter 2022-08-01 14:06 ` Khalid Masum 2022-07-30 11:45 ` Khalid Masum 2022-07-30 15:39 ` syzbot
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=Yuz7S18rHNbHCHly@angband.pl \ --to=kilobyte@angband.pl \ --cc=deller@gmx.de \ --cc=dri-devel@lists.freedesktop.org \ --cc=gregkh@linuxfoundation.org \ --cc=jirislaby@kernel.org \ --cc=khalid.masum.92@gmail.com \ --cc=linux-fbdev@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=syzbot+14b0e8f3fd1612e35350@syzkaller.appspotmail.com \ --cc=syzkaller-bugs@googlegroups.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.