LKML Archive on lore.kernel.org
 help / color / Atom feed
From: Pavel Machek <pavel@ucw.cz>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: fbcon scrollback broken was Re: Linux 5.9-rc6
Date: Wed, 23 Sep 2020 14:03:47 +0200
Message-ID: <20200923120347.GA23810@duo.ucw.cz> (raw)
In-Reply-To: <20200923113914.GA18149@duo.ucw.cz>


[-- Attachment #1: Type: text/plain, Size: 2601 bytes --]

Hi!

> > The one thing that does show up in the diffstat is the softscroll
> > removal (both fbcon and vgacon), and there are people who want to save
> > that, but we'll see if some maintainer steps up. I'm not willing to
> > resurrect it in the broken form it was in, so I doubt that will happen
> > in 5.9, but we'll see what happens.
> 
> Could you... like try not to make the job harder by merging miriad of
> "let's kill the documentation" patches?
> 
> I needed the feature twice already this month, once during fsck, and
> then five minutes ago, when oops scrolled by me during system
> shutdown. Unfortunately, shift-pageup was not available to take a look
> what is going on there.
> 
> Unfortunately, Greg backported your "fix" to all the stable releases,
> so resulting damage will not be easy to repair.
> 
> For the record, making the security problem unexploitable should be as
> simple as patch below.
> 
> Unfortunately, Linus' changelog does not exactly tell me what all the
> known problems are. Willy Tarreau pointed me to
> https://www.openwall.com/lists/oss-security/2020/09/15/2 , which has
> some information, but all I can reproduce are transient screen
> artefacts. If someone has more detailed information, that would be
> helpful.

I can now reproduce it. C code from
https://www.openwall.com/lists/oss-security/2020/09/15/2 + this patch
makes the issue easy to see.

Best regards,
								Pavel

diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 5f1183b0b89d..5a8a43c0b546 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -1209,6 +1209,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
 	rlth = min(old_row_size, new_row_size);
 	rrem = new_row_size - rlth;
 	old_origin = vc->vc_origin;
+	vc->vc_origin = NULL;
 	new_origin = (long) newscreen;
 	new_scr_end = new_origin + new_screen_size;
 
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 75ebbbf0a1fb..6ceae7ea1ccc 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2818,6 +2818,11 @@ static void fbcon_scrolldelta(struct vc_data *vc, int lines)
 	struct display *disp = &fb_display[fg_console];
 	int offset, limit, scrollback_old;
 
+	if (!vc->vc_origin) {
+		printk("scrolldelta races with resize?!\n");
+		return;
+	}
+
 	if (softback_top) {
 		if (vc->vc_num != fg_console)
 			return;

-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

      reply index

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-09-20 23:55 Linus Torvalds
2020-09-21  1:06 ` Robert Gadsdon
2020-09-21 15:50   ` Linus Torvalds
2020-09-23 11:39 ` fbcon scrollback broken was " Pavel Machek
2020-09-23 12:03   ` Pavel Machek [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200923120347.GA23810@duo.ucw.cz \
    --to=pavel@ucw.cz \
    --cc=linux-kernel@vger.kernel.org \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git
	git clone --mirror https://lore.kernel.org/lkml/8 lkml/git/8.git
	git clone --mirror https://lore.kernel.org/lkml/9 lkml/git/9.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git