Messages in this thread | | | Date | Mon, 1 Aug 2022 10:09:45 +0600 | Subject | Re: [syzbot] KASAN: vmalloc-out-of-bounds Write in imageblit (2) | From | Khalid Masum <> |
| |
On 7/31/22 21:39, Helge Deller wrote: > On 7/31/22 15:55, Khalid Masum wrote: >> On 7/30/22 23:25, Helge Deller wrote: >>> On 7/29/22 08:51, Khalid Masum wrote: >>>> Here is a simplified reproducer for the issue: >>>> >>>> https://gist.githubusercontent.com/Labnann/923d6b9b3a19848fc129637b839b8a55/raw/a68271fcc724569735fe27f80817e561b3ff629a/reproducer.c >>> >>> The reproducer does this: >>> ioctl(3, TIOCLINUX, TIOCL_SETSEL, selection: xs:3 ys:0 xe:0 ye:0 mode:0) = 0 >>> -> sets the text selection area >>> ioctl(4, KDFONTOP) with op=0 (con_font_set), charcount=512 width=8 height=32, 0x20000000) = 0 >>> -> changes the font size. >>> >>> It does not crash with current Linus' head (v5.19-rc8). >>> Kernel v5.16, which was used by this KASAN report, hasn't received backports >>> since months, so I tried stable kernel v5.15.58 instead, and this >>> kernel crashed with the reproducer. >>> >>> The reproducer brings up two issues with current code: >>> 1. The reproducer uses ioctl(TIOCLINUX, TIOCL_SETSEL) and hands over (invalid) >>> zero-values for ys and ye for the starting lines. >>> This is wrong, since the API seems to expect a "1" as the very first line for the selection. >> >> Why do you think that API expects a 1? > > because the code in drivers/tty/vt/selection.c indicates this: > See: > static int vc_selection(struct vc_data *vc, struct tiocl_selection *v, struct tty_struct *tty) > { > int ps, pe; > ... > v->xs = min_t(u16, v->xs - 1, vc->vc_cols - 1); > v->ys = min_t(u16, v->ys - 1, vc->vc_rows - 1); > v->xe = min_t(u16, v->xe - 1, vc->vc_cols - 1); > v->ye = min_t(u16, v->ye - 1, vc->vc_rows - 1); > ... > ps = v->ys * vc->vc_size_row + (v->xs << 1); > pe = v->ye * vc->vc_size_row + (v->xe << 1); > > The userspace-provided xs,ys,xe and ye values are decremented by one > before ps and pe (the pointers into the text screen array) are calculated. > So, for the xs...ye values in the range from 1..max-screen-lines/columns > are expected.
Oh. I got it. It is pretty simple. Thanks again for explaining.
> > Helge
Khalid Masum
| |