lkml.org 
[lkml]   [2022]   [Jul]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH] vt: Clear selection before changing the font
    When changing the console font with ioctl(KDFONTOP) the new font size
    can be bigger than the previous font. A previous selection may thus now
    be outside of the new screen size and thus trigger out-of-bounds
    accesses to graphics memory if the selection is removed in
    vc_do_resize().

    Prevent such out-of-memory accesses by dropping the selection before the
    various con_font_set() console handlers are called.

    Signed-off-by: Helge Deller <deller@gmx.de>
    Reported-by: syzbot+14b0e8f3fd1612e35350@syzkaller.appspotmail.com

    diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
    index dfc1f4b445f3..3f09205185a4 100644
    --- a/drivers/tty/vt/vt.c
    +++ b/drivers/tty/vt/vt.c
    @@ -4662,9 +4662,11 @@ static int con_font_set(struct vc_data *vc, struct console_font_op *op)
    console_lock();
    if (vc->vc_mode != KD_TEXT)
    rc = -EINVAL;
    - else if (vc->vc_sw->con_font_set)
    + else if (vc->vc_sw->con_font_set) {
    + if (vc_is_sel(vc))
    + clear_selection();
    rc = vc->vc_sw->con_font_set(vc, &font, op->flags);
    - else
    + } else
    rc = -ENOSYS;
    console_unlock();
    kfree(font.data);
    @@ -4691,9 +4693,11 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op)
    console_unlock();
    return -EINVAL;
    }
    - if (vc->vc_sw->con_font_default)
    + if (vc->vc_sw->con_font_default) {
    + if (vc_is_sel(vc))
    + clear_selection();
    rc = vc->vc_sw->con_font_default(vc, &font, s);
    - else
    + } else
    rc = -ENOSYS;
    console_unlock();
    if (!rc) {
    \
     
     \ /
      Last update: 2022-07-30 20:50    [W:4.863 / U:0.048 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site