From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.5 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE, SPF_PASS,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 596C5C43460 for ; Fri, 17 Jul 2020 07:22:42 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id E821F207E8 for ; Fri, 17 Jul 2020 07:22:41 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E821F207E8 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=i-love.sakura.ne.jp Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=dri-devel-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 155006ED27; Fri, 17 Jul 2020 07:22:25 +0000 (UTC) Received: from www262.sakura.ne.jp (www262.sakura.ne.jp [202.181.97.72]) by gabe.freedesktop.org (Postfix) with ESMTPS id CCBBB6E196 for ; Thu, 16 Jul 2020 11:27:31 +0000 (UTC) Received: from fsav103.sakura.ne.jp (fsav103.sakura.ne.jp [27.133.134.230]) by www262.sakura.ne.jp (8.15.2/8.15.2) with ESMTP id 06GBRL97041795; Thu, 16 Jul 2020 20:27:21 +0900 (JST) (envelope-from penguin-kernel@i-love.sakura.ne.jp) Received: from www262.sakura.ne.jp (202.181.97.72) by fsav103.sakura.ne.jp (F-Secure/fsigk_smtp/550/fsav103.sakura.ne.jp); Thu, 16 Jul 2020 20:27:21 +0900 (JST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/fsav103.sakura.ne.jp) Received: from [192.168.1.9] (M106072142033.v4.enabler.ne.jp [106.72.142.33]) (authenticated bits=0) by www262.sakura.ne.jp (8.15.2/8.15.2) with ESMTPSA id 06GBRLEi041792 (version=TLSv1.2 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 16 Jul 2020 20:27:21 +0900 (JST) (envelope-from penguin-kernel@i-love.sakura.ne.jp) Subject: Re: [PATCH v2] fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins. To: Daniel Vetter References: <20200715015102.3814-1-penguin-kernel@I-love.SAKURA.ne.jp> <20200715094836.GD2571@kadam> <9e6eac10-c5c3-f518-36cc-9ea32fb5d7fe@i-love.sakura.ne.jp> <20200715151220.GE2571@kadam> <20200716100006.GN3278063@phenom.ffwll.local> From: Tetsuo Handa Message-ID: Date: Thu, 16 Jul 2020 20:27:21 +0900 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: <20200716100006.GN3278063@phenom.ffwll.local> Content-Language: en-US X-Mailman-Approved-At: Fri, 17 Jul 2020 07:22:00 +0000 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-fbdev@vger.kernel.org, Bartlomiej Zolnierkiewicz , Greg Kroah-Hartman , syzbot , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, George Kennedy , Dmitry Vyukov , Jiri Slaby , Dan Carpenter Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" On 2020/07/16 19:00, Daniel Vetter wrote: > On Thu, Jul 16, 2020 at 12:29:00AM +0900, Tetsuo Handa wrote: >> On 2020/07/16 0:12, Dan Carpenter wrote: >>> I've complained about integer overflows in fbdev for a long time... >>> >>> What I'd like to see is something like the following maybe. I don't >>> know how to get the vc_data in fbmem.c so it doesn't include your checks >>> for negative. >> >> Yes. Like I said "Thus, I consider that we need more sanity/constraints checks." at >> https://lore.kernel.org/lkml/b1e7dd6a-fc22-bba8-0abb-d3e779329bce@i-love.sakura.ne.jp/ , >> we want basic checks. That's a task for fbdev people who should be familiar with >> necessary constraints. > > I think the worldwide supply of people who understand fbdev and willing to > work on it is roughly 0. So if someone wants to fix this mess properly > (which likely means adding tons of over/underflow checks at entry points, > since you're never going to catch the driver bugs, there's too many and > not enough people who care) they need to fix this themselves. But I think we can enforce reasonable constraint which is much stricter than Dan's basic_checks() (which used INT_MAX). For example, do we need to accept var->{xres,yres} >= 1048576, for "32768 rows or cols" * "32 pixels per character" = 1045876 and vc_do_resize() accepts only rows and cols < 32768 ? > > Just to avoid confusion here. > >> Anyway, my two patches are small and low cost; can we apply these patches regardless >> of basic checks? > > Which two patches where? [PATCH v3] vt: Reject zero-sized screen buffer size. from https://lkml.kernel.org/r/20200712111013.11881-1-penguin-kernel@I-love.SAKURA.ne.jp [PATCH v2] fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins. from https://lkml.kernel.org/r/20200715015102.3814-1-penguin-kernel@I-love.SAKURA.ne.jp _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel