Re: [PATCH] video: fbdev: vga16fb: fix OOB write in vga16fb_imageblit()

2021-05-17 Thread Daniel Vetter
On Mon, May 17, 2021 at 3:07 PM Daniel Vetter wrote: > > On Fri, May 14, 2021 at 10:33 PM Linus Torvalds > wrote: > > > > On Fri, May 14, 2021 at 1:25 PM Maciej W. Rozycki wrote: > > > > > > Overall I think it does make sense to resize the text console at any > > > time, even if the visible con

Re: [PATCH] video: fbdev: vga16fb: fix OOB write in vga16fb_imageblit()

2021-05-17 Thread Daniel Vetter
On Fri, May 14, 2021 at 10:33 PM Linus Torvalds wrote: > > On Fri, May 14, 2021 at 1:25 PM Maciej W. Rozycki wrote: > > > > Overall I think it does make sense to resize the text console at any > > time, even if the visible console (VT) chosen is in the graphics mode, > > It might make sense, but

Re: [PATCH] video: fbdev: vga16fb: fix OOB write in vga16fb_imageblit()

2021-05-15 Thread Maciej W. Rozycki
On Fri, 14 May 2021, Linus Torvalds wrote: > > Overall I think it does make sense to resize the text console at any > > time, even if the visible console (VT) chosen is in the graphics mode, > > It might make sense, but only if we call the function to update the > low-level data. > > Not callin

Re: [PATCH] video: fbdev: vga16fb: fix OOB write in vga16fb_imageblit()

2021-05-14 Thread Tetsuo Handa
On 2021/05/15 5:25, Maciej W. Rozycki wrote: > NB for fbcon the usual ioctl to resize the console is FBIOPUT_VSCREENINFO > rather than VT_RESIZEX; fbset(8) uses it, and I actually experimented with > it and a TGA-like (SFB+) framebuffer when at my lab last time, as Linux is > kind enough to kno

Re: [PATCH] video: fbdev: vga16fb: fix OOB write in vga16fb_imageblit()

2021-05-14 Thread Linus Torvalds
On Fri, May 14, 2021 at 1:32 PM Linus Torvalds wrote: > > Another alternative would be to just delay the resize to when vcmode > is put back to text mode again. That sounds somewhat reasonable to me, > but it's a pretty big thing. Actually thinking more about that option, it sounds horrible. It w

Re: [PATCH] video: fbdev: vga16fb: fix OOB write in vga16fb_imageblit()

2021-05-14 Thread Linus Torvalds
On Fri, May 14, 2021 at 1:25 PM Maciej W. Rozycki wrote: > > Overall I think it does make sense to resize the text console at any > time, even if the visible console (VT) chosen is in the graphics mode, It might make sense, but only if we call the function to update the low-level data. Not call

Re: [PATCH] video: fbdev: vga16fb: fix OOB write in vga16fb_imageblit()

2021-05-14 Thread Maciej W. Rozycki
On Fri, 14 May 2021, Linus Torvalds wrote: > > Currently it is impossible to control upper limit of rows/columns values > > based on amount of memory reserved for the graphical screen, for > > resize_screen() calls vc->vc_sw->con_resize() only if vc->vc_mode is not > > already KD_GRAPHICS > > Hon

Re: [PATCH] video: fbdev: vga16fb: fix OOB write in vga16fb_imageblit()

2021-05-14 Thread Linus Torvalds
On Fri, May 14, 2021 at 10:37 AM Linus Torvalds wrote: > > IOW, something like this would seem fairly simple and straightforward: Proper patch in case syzbot can test this.. Linus From b33ca195cecea478768de353b3ae976c07a65615 Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date:

Re: [PATCH] video: fbdev: vga16fb: fix OOB write in vga16fb_imageblit()

2021-05-14 Thread Linus Torvalds
On Fri, May 14, 2021 at 10:29 AM Linus Torvalds wrote: > > So why not just say "that clearly already doesn't work, so make it > explicitly not permitted"? IOW, something like this would seem fairly simple and straightforward: diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 01645

Re: [PATCH] video: fbdev: vga16fb: fix OOB write in vga16fb_imageblit()

2021-05-14 Thread Linus Torvalds
On Fri, May 14, 2021 at 9:20 AM Tetsuo Handa wrote: > > Currently it is impossible to control upper limit of rows/columns values > based on amount of memory reserved for the graphical screen, for > resize_screen() calls vc->vc_sw->con_resize() only if vc->vc_mode is not > already KD_GRAPHICS Hone

[PATCH] video: fbdev: vga16fb: fix OOB write in vga16fb_imageblit()

2021-05-14 Thread Tetsuo Handa
syzbot is reporting that a local user with the framebuffer console can crash the kernel [1], for ioctl(VT_RESIZE) allows a TTY to set arbitrary rows/columns values regardless of amount of memory reserved for the graphical screen. -- #include #include #include #include #include #includ