lkml.org 
[lkml]   [2022]   [Sep]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 035/107] vt: Clear selection before changing the font
    Date
    From: Helge Deller <deller@gmx.de>

    commit 566f9c9f89337792070b5a6062dff448b3e7977f upstream.

    When changing the console font with ioctl(KDFONTOP) the new font size
    can be bigger than the previous font. A previous selection may thus now
    be outside of the new screen size and thus trigger out-of-bounds
    accesses to graphics memory if the selection is removed in
    vc_do_resize().

    Prevent such out-of-memory accesses by dropping the selection before the
    various con_font_set() console handlers are called.

    Reported-by: syzbot+14b0e8f3fd1612e35350@syzkaller.appspotmail.com
    Cc: stable <stable@kernel.org>
    Tested-by: Khalid Masum <khalid.masum.92@gmail.com>
    Signed-off-by: Helge Deller <deller@gmx.de>
    Link: https://lore.kernel.org/r/YuV9apZGNmGfjcor@p100
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/tty/vt/vt.c | 12 ++++++++----
    1 file changed, 8 insertions(+), 4 deletions(-)

    --- a/drivers/tty/vt/vt.c
    +++ b/drivers/tty/vt/vt.c
    @@ -4662,9 +4662,11 @@ static int con_font_set(struct vc_data *
    console_lock();
    if (vc->vc_mode != KD_TEXT)
    rc = -EINVAL;
    - else if (vc->vc_sw->con_font_set)
    + else if (vc->vc_sw->con_font_set) {
    + if (vc_is_sel(vc))
    + clear_selection();
    rc = vc->vc_sw->con_font_set(vc, &font, op->flags);
    - else
    + } else
    rc = -ENOSYS;
    console_unlock();
    kfree(font.data);
    @@ -4691,9 +4693,11 @@ static int con_font_default(struct vc_da
    console_unlock();
    return -EINVAL;
    }
    - if (vc->vc_sw->con_font_default)
    + if (vc->vc_sw->con_font_default) {
    + if (vc_is_sel(vc))
    + clear_selection();
    rc = vc->vc_sw->con_font_default(vc, &font, s);
    - else
    + } else
    rc = -ENOSYS;
    console_unlock();
    if (!rc) {

    \
     
     \ /
      Last update: 2022-09-06 15:53    [W:4.038 / U:0.636 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site