linux/drivers/tty/vt
Tetsuo Handa 988d076336 vt_ioctl: make VT_RESIZEX behave like VT_RESIZE
syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2], for
vt_resizex() from ioctl(VT_RESIZEX) allows setting font height larger than
actual font height calculated by con_font_set() from ioctl(PIO_FONT).
Since fbcon_set_font() from con_font_set() allocates minimal amount of
memory based on actual font height calculated by con_font_set(),
use of vt_resizex() can cause UAF/OOB read for font data.

VT_RESIZEX was introduced in Linux 1.3.3, but it is unclear that what
comes to the "+ more" part, and I couldn't find a user of VT_RESIZEX.

  #define VT_RESIZE   0x5609 /* set kernel's idea of screensize */
  #define VT_RESIZEX  0x560A /* set kernel's idea of screensize + more */

So far we are not aware of syzbot reports caused by setting non-zero value
to v_vlin parameter. But given that it is possible that nobody is using
VT_RESIZEX, we can try removing support for v_clin and v_vlin parameters.

Therefore, this patch effectively makes VT_RESIZEX behave like VT_RESIZE,
with emitting a message if somebody is still using v_clin and/or v_vlin
parameters.

[1] https://syzkaller.appspot.com/bug?id=32577e96d88447ded2d3b76d71254fb855245837
[2] https://syzkaller.appspot.com/bug?id=6b8355d27b2b94fb5cedf4655e3a59162d9e48e3

Reported-by: syzbot <syzbot+b308f5fd049fbbc6e74f@syzkaller.appspotmail.com>
Reported-by: syzbot <syzbot+16469b5e8e5a72e9131e@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/4933b81b-9b1a-355b-df0e-9b31e8280ab9@i-love.sakura.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-27 14:17:43 +02:00
..
.gitignore tty: vt: move conmakehash to drivers/tty/vt/ from scripts/ 2019-12-17 14:42:46 +01:00
conmakehash.c tty: vt: move conmakehash to drivers/tty/vt/ from scripts/ 2019-12-17 14:42:46 +01:00
consolemap.c tty: vt, fix kernel-doc 2020-08-18 13:51:18 +02:00
cp437.uni tty: fix up a few remaining files without SPDX identifiers 2019-04-04 18:48:43 +02:00
defkeymap.c_shipped tty: fix up a few remaining files without SPDX identifiers 2019-04-04 18:48:43 +02:00
defkeymap.map tty: fix up a few remaining files without SPDX identifiers 2019-04-04 18:48:43 +02:00
keyboard.c TTY/Serial patches for 5.9-rc1 2020-08-06 14:56:11 -07:00
Makefile kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
selection.c vc: propagate "viewed as bool" from screenpos up 2020-08-18 13:45:20 +02:00
vc_screen.c Revert "vc_screen: extract vcs_read_buf_header" 2020-08-24 19:51:56 +02:00
vt_ioctl.c vt_ioctl: make VT_RESIZEX behave like VT_RESIZE 2020-09-27 14:17:43 +02:00
vt.c Linux 5.9-rc3 2020-08-31 07:19:25 +02:00