lkml.org 
[lkml]   [2022]   [Jul]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.18 222/231] vt: fix memory overlapping when deleting chars in the buffer
    Date
    From: Yangxi Xiang <xyangxi5@gmail.com>

    commit 39cdb68c64d84e71a4a717000b6e5de208ee60cc upstream.

    A memory overlapping copy occurs when deleting a long line. This memory
    overlapping copy can cause data corruption when scr_memcpyw is optimized
    to memcpy because memcpy does not ensure its behavior if the destination
    buffer overlaps with the source buffer. The line buffer is not always
    broken, because the memcpy utilizes the hardware acceleration, whose
    result is not deterministic.

    Fix this problem by using replacing the scr_memcpyw with scr_memmovew.

    Fixes: 81732c3b2fed ("tty vt: Fix line garbage in virtual console on command line edition")
    Cc: stable <stable@kernel.org>
    Signed-off-by: Yangxi Xiang <xyangxi5@gmail.com>
    Link: https://lore.kernel.org/r/20220628093322.5688-1-xyangxi5@gmail.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/tty/vt/vt.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/tty/vt/vt.c
    +++ b/drivers/tty/vt/vt.c
    @@ -855,7 +855,7 @@ static void delete_char(struct vc_data *
    unsigned short *p = (unsigned short *) vc->vc_pos;

    vc_uniscr_delete(vc, nr);
    - scr_memcpyw(p, p + nr, (vc->vc_cols - vc->state.x - nr) * 2);
    + scr_memmovew(p, p + nr, (vc->vc_cols - vc->state.x - nr) * 2);
    scr_memsetw(p + vc->vc_cols - vc->state.x - nr, vc->vc_video_erase_char,
    nr * 2);
    vc->vc_need_wrap = 0;

    \
     
     \ /
      Last update: 2022-07-19 15:12    [W:4.149 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site