lkml.org 
[lkml]   [2022]   [Jul]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [PATCH] vt: Clear selection before changing the font
    From
    On 7/31/22 00:50, Helge Deller wrote:
    > When changing the console font with ioctl(KDFONTOP) the new font size
    > can be bigger than the previous font. A previous selection may thus now
    > be outside of the new screen size and thus trigger out-of-bounds
    > accesses to graphics memory if the selection is removed in
    > vc_do_resize().
    >
    > Prevent such out-of-memory accesses by dropping the selection before the
    > various con_font_set() console handlers are called.
    >
    > Signed-off-by: Helge Deller <deller@gmx.de>

    Tested-by: Khalid Masum <khalid.masum.92@gmail.com>

    > Reported-by: syzbot+14b0e8f3fd1612e35350@syzkaller.appspotmail.com
    >
    > diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
    > index dfc1f4b445f3..3f09205185a4 100644
    > --- a/drivers/tty/vt/vt.c
    > +++ b/drivers/tty/vt/vt.c
    > @@ -4662,9 +4662,11 @@ static int con_font_set(struct vc_data *vc, struct console_font_op *op)
    > console_lock();
    > if (vc->vc_mode != KD_TEXT)
    > rc = -EINVAL;
    > - else if (vc->vc_sw->con_font_set)
    > + else if (vc->vc_sw->con_font_set) {
    > + if (vc_is_sel(vc))
    > + clear_selection();
    > rc = vc->vc_sw->con_font_set(vc, &font, op->flags);
    > - else
    > + } else
    > rc = -ENOSYS;
    > console_unlock();
    > kfree(font.data);
    > @@ -4691,9 +4693,11 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op)
    > console_unlock();
    > return -EINVAL;
    > }
    > - if (vc->vc_sw->con_font_default)
    > + if (vc->vc_sw->con_font_default) {
    > + if (vc_is_sel(vc))
    > + clear_selection();
    > rc = vc->vc_sw->con_font_default(vc, &font, s);
    > - else
    > + } else
    > rc = -ENOSYS;
    > console_unlock();
    > if (!rc) {

    \
     
     \ /
      Last update: 2022-07-31 13:33    [W:3.977 / U:0.296 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site