Tetsuo Handa 23e8b741c8 vt: Reject zero-sized screen buffer size. ... commit ce684552a2 upstream. syzbot is reporting general protection fault in do_con_write() [1] caused by vc->vc_screenbuf == ZERO_SIZE_PTR caused by vc->vc_screenbuf_size == 0 caused by vc->vc_cols == vc->vc_rows == vc->vc_size_row == 0 caused by fb_set_var() from ioctl(FBIOPUT_VSCREENINFO) on /dev/fb0 , for gotoxy(vc, 0, 0) from reset_terminal() from vc_init() from vc_allocate() from con_install() from tty_init_dev() from tty_open() on such console causes vc->vc_pos == 0x10000000e due to ((unsigned long) ZERO_SIZE_PTR) + -1U * 0 + (-1U << 1). I don't think that a console with 0 column or 0 row makes sense. And it seems that vc_do_resize() does not intend to allow resizing a console to 0 column or 0 row due to new_cols = (cols ? cols : vc->vc_cols); new_rows = (lines ? lines : vc->vc_rows); exception. Theoretically, cols and rows can be any range as long as 0 < cols * rows * 2 <= KMALLOC_MAX_SIZE is satisfied (e.g. cols == 1048576 && rows == 2 is possible) because of vc->vc_size_row = vc->vc_cols << 1; vc->vc_screenbuf_size = vc->vc_rows * vc->vc_size_row; in visual_init() and kzalloc(vc->vc_screenbuf_size) in vc_allocate(). Since we can detect cols == 0 or rows == 0 via screenbuf_size = 0 in visual_init(), we can reject kzalloc(0). Then, vc_allocate() will return an error, and con_write() will not be called on a console with 0 column or 0 row. We need to make sure that integer overflow in visual_init() won't happen. Since vc_do_resize() restricts cols <= 32767 and rows <= 32767, applying 1 <= cols <= 32767 and 1 <= rows <= 32767 restrictions to vc_allocate() will be practically fine. This patch does not touch con_init(), for returning -EINVAL there does not help when we are not returning -ENOMEM. [1] https://syzkaller.appspot.com/bug?extid=017265e8553724e514e8 Reported-and-tested-by: syzbot <syzbot+017265e8553724e514e8@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200712111013.11881-1-penguin-kernel@I-love.SAKURA.ne.jp Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-07-29 10:18:43 +02:00
..
hvc	Revert "tty: hvc: Fix data abort due to race in hvc_open"	2020-06-30 15:37:13 -04:00
ipwireless	…
serdev	serdev: ttyport: restore client ops on deregistration	2020-02-28 17:22:19 +01:00
serial	serial: 8250_mtk: Fix high-speed baud rates clamping	2020-07-29 10:18:43 +02:00
vt	vt: Reject zero-sized screen buffer size.	2020-07-29 10:18:43 +02:00
Kconfig	…
Makefile	…
amiserial.c	…
cyclades.c	…
ehv_bytechan.c	tty: evh_bytechan: Fix out of bounds accesses	2020-04-23 10:36:44 +02:00
goldfish.c	…
isicom.c	tty/isicom: remove redundant assignment to variable word_count	2019-09-04 12:43:44 +02:00
mips_ejtag_fdc.c	…
moxa.c	…
moxa.h	…
mxser.c	…
mxser.h	…
n_gsm.c	tty: n_gsm: Fix bogus i++ in gsm_data_kick	2020-06-24 17:50:29 +02:00
n_hdlc.c	tty: n_hdlc: fix build on SPARC	2019-10-04 15:14:20 +02:00
n_null.c	…
n_r3964.c	…
n_tracerouter.c	…
n_tracesink.c	…
n_tracesink.h	…
n_tty.c	…
nozomi.c	tty: nozomi: Use dev_get_drvdata	2019-09-04 12:43:44 +02:00
pty.c	…
rocket.c	tty: rocket, avoid OOB access	2020-04-29 16:33:17 +02:00
rocket.h	…
rocket_int.h	…
synclink.c	…
synclink_gt.c	tty: synclink_gt: Adjust indentation in several functions	2020-02-24 08:36:47 +01:00
synclinkmp.c	tty: synclinkmp: Adjust indentation in several functions	2020-02-24 08:36:47 +01:00
sysrq.c	…
tty_audit.c	…
tty_baudrate.c	…
tty_buffer.c	…
tty_io.c	tty: fix compat TIOCGSERIAL checking wrong function ptr	2020-03-25 08:25:52 +01:00
tty_ioctl.c	…
tty_jobctrl.c	…
tty_ldisc.c	…
tty_ldsem.c	…
tty_mutex.c	…
tty_port.c	serdev: ttyport: restore client ops on deregistration	2020-02-28 17:22:19 +01:00
ttynull.c	…
vcc.c	…