All of lore.kernel.org
 help / color / mirror / Atom feed
From: Helge Deller <deller@gmx.de>
To: Khalid Masum <khalid.masum.92@gmail.com>,
	syzbot <syzbot+14b0e8f3fd1612e35350@syzkaller.appspotmail.com>,
	dri-devel@lists.freedesktop.org, linux-fbdev@vger.kernel.org,
	linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Jiri Slaby <jirislaby@kernel.org>
Subject: [PATCH] vt: Clear selection before changing the font
Date: Sat, 30 Jul 2022 20:50:18 +0200	[thread overview]
Message-ID: <YuV9apZGNmGfjcor@p100> (raw)
In-Reply-To: <eb4a26aa-da30-ceee-7d27-c1e902dd4218@gmx.de>

When changing the console font with ioctl(KDFONTOP) the new font size
can be bigger than the previous font. A previous selection may thus now
be outside of the new screen size and thus trigger out-of-bounds
accesses to graphics memory if the selection is removed in
vc_do_resize().

Prevent such out-of-memory accesses by dropping the selection before the
various con_font_set() console handlers are called.

Signed-off-by: Helge Deller <deller@gmx.de>
Reported-by: syzbot+14b0e8f3fd1612e35350@syzkaller.appspotmail.com

diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index dfc1f4b445f3..3f09205185a4 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -4662,9 +4662,11 @@ static int con_font_set(struct vc_data *vc, struct console_font_op *op)
 	console_lock();
 	if (vc->vc_mode != KD_TEXT)
 		rc = -EINVAL;
-	else if (vc->vc_sw->con_font_set)
+	else if (vc->vc_sw->con_font_set) {
+		if (vc_is_sel(vc))
+			clear_selection();
 		rc = vc->vc_sw->con_font_set(vc, &font, op->flags);
-	else
+	} else
 		rc = -ENOSYS;
 	console_unlock();
 	kfree(font.data);
@@ -4691,9 +4693,11 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op)
 		console_unlock();
 		return -EINVAL;
 	}
-	if (vc->vc_sw->con_font_default)
+	if (vc->vc_sw->con_font_default) {
+		if (vc_is_sel(vc))
+			clear_selection();
 		rc = vc->vc_sw->con_font_default(vc, &font, s);
-	else
+	} else
 		rc = -ENOSYS;
 	console_unlock();
 	if (!rc) {

  parent reply	other threads:[~2022-07-30 18:50 UTC|newest]

Thread overview: 28+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-11-19  9:18 [syzbot] KASAN: vmalloc-out-of-bounds Write in imageblit (2) syzbot
2022-01-20 22:58 ` syzbot
2022-01-21  1:48 ` syzbot
2022-07-29  6:51 ` Khalid Masum
2022-07-30 17:25   ` Helge Deller
2022-07-30 18:49     ` [PATCH] tty: vt: selection: Add check for valid tiocl_selection values Helge Deller
2022-08-04  5:47       ` Jiri Slaby
2022-08-04  7:15         ` Helge Deller
2022-08-04  8:44           ` Helge Deller
2022-08-04  9:22             ` Jiri Slaby
2022-08-05 11:13               ` Adam Borowski
2022-08-05 11:13                 ` Adam Borowski
2022-07-30 18:50     ` Helge Deller [this message]
2022-07-31 11:32       ` [PATCH] vt: Clear selection before changing the font Khalid Masum
2022-07-31 10:03     ` [syzbot] KASAN: vmalloc-out-of-bounds Write in imageblit (2) Khalid Masum
2022-07-31 10:54       ` Helge Deller
2022-07-31 10:54         ` Helge Deller
2022-07-31 11:23         ` Khalid Masum
2022-07-31 11:23           ` Khalid Masum
2022-07-31 13:55     ` Khalid Masum
2022-07-31 15:39       ` Helge Deller
2022-08-01  4:09         ` Khalid Masum
2022-07-30  8:12 ` Khalid Masum
2022-07-30 10:55   ` syzbot
2022-08-01 10:43   ` Dan Carpenter
2022-08-01 14:06     ` Khalid Masum
2022-07-30 11:45 ` Khalid Masum
2022-07-30 15:39   ` syzbot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YuV9apZGNmGfjcor@p100 \
    --to=deller@gmx.de \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=jirislaby@kernel.org \
    --cc=khalid.masum.92@gmail.com \
    --cc=linux-fbdev@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzbot+14b0e8f3fd1612e35350@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.