Tetsuo Handa 376810e5e9 fbmem: pull fbcon_update_vcs() out of fb_set_var() ... [ Upstream commit d88ca7e1a2 ] syzbot is reporting OOB read bug in vc_do_resize() [1] caused by memcpy() based on outdated old_{rows,row_size} values, for resize_screen() can recurse into vc_do_resize() which changes vc->vc_{cols,rows} that outdates old_{rows,row_size} values which were saved before calling resize_screen(). Daniel Vetter explained that resize_screen() should not recurse into fbcon_update_vcs() path due to FBINFO_MISC_USEREVENT being still set when calling resize_screen(). Instead of masking FBINFO_MISC_USEREVENT before calling fbcon_update_vcs(), we can remove FBINFO_MISC_USEREVENT by calling fbcon_update_vcs() only if fb_set_var() returned 0. This change assumes that it is harmless to call fbcon_update_vcs() when fb_set_var() returned 0 without reaching fb_notifier_call_chain(). [1] https://syzkaller.appspot.com/bug?id=c70c88cfd16dcf6e1d3c7f0ab8648b3144b5b25e Reported-and-tested-by: syzbot <syzbot+c37a14770d51a085a520@syzkaller.appspotmail.com> Suggested-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Reported-by: kernel test robot <lkp@intel.com> for missing #include Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/075b7e37-3278-cd7d-31ab-c5073cfa8e92@i-love.sakura.ne.jp Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-09-03 11:27:09 +02:00
..
backlight	backlight: lp855x: Ensure regulators are disabled on probe failure	2020-06-24 17:50:09 +02:00
console	console: newport_con: fix an issue about leak related system resources	2020-08-19 08:16:06 +02:00
fbdev	fbmem: pull fbcon_update_vcs() out of fb_set_var()	2020-09-03 11:27:09 +02:00
logo	video/logo: do not generate unneeded logo C files	2019-10-05 15:29:49 +09:00
Kconfig	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
display_timing.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 428	2019-06-05 17:37:16 +02:00
hdmi.c	video/hdmi: Fix AVI bar unpack	2019-12-17 19:56:42 +01:00
of_display_timing.c	video: of: display_timing: Don't yell if no timing node is present	2019-07-26 16:32:26 +02:00
of_videomode.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 428	2019-06-05 17:37:16 +02:00
vgastate.c	Video: vgastate: fixed a spacing coding style	2018-10-08 12:57:35 +02:00
videomode.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 428	2019-06-05 17:37:16 +02:00