Tetsuo Handa 7cecdf9655 vt: Reject zero-sized screen buffer size. ... commit ce684552a2 upstream. syzbot is reporting general protection fault in do_con_write() [1] caused by vc->vc_screenbuf == ZERO_SIZE_PTR caused by vc->vc_screenbuf_size == 0 caused by vc->vc_cols == vc->vc_rows == vc->vc_size_row == 0 caused by fb_set_var() from ioctl(FBIOPUT_VSCREENINFO) on /dev/fb0 , for gotoxy(vc, 0, 0) from reset_terminal() from vc_init() from vc_allocate() from con_install() from tty_init_dev() from tty_open() on such console causes vc->vc_pos == 0x10000000e due to ((unsigned long) ZERO_SIZE_PTR) + -1U * 0 + (-1U << 1). I don't think that a console with 0 column or 0 row makes sense. And it seems that vc_do_resize() does not intend to allow resizing a console to 0 column or 0 row due to new_cols = (cols ? cols : vc->vc_cols); new_rows = (lines ? lines : vc->vc_rows); exception. Theoretically, cols and rows can be any range as long as 0 < cols * rows * 2 <= KMALLOC_MAX_SIZE is satisfied (e.g. cols == 1048576 && rows == 2 is possible) because of vc->vc_size_row = vc->vc_cols << 1; vc->vc_screenbuf_size = vc->vc_rows * vc->vc_size_row; in visual_init() and kzalloc(vc->vc_screenbuf_size) in vc_allocate(). Since we can detect cols == 0 or rows == 0 via screenbuf_size = 0 in visual_init(), we can reject kzalloc(0). Then, vc_allocate() will return an error, and con_write() will not be called on a console with 0 column or 0 row. We need to make sure that integer overflow in visual_init() won't happen. Since vc_do_resize() restricts cols <= 32767 and rows <= 32767, applying 1 <= cols <= 32767 and 1 <= rows <= 32767 restrictions to vc_allocate() will be practically fine. This patch does not touch con_init(), for returning -EINVAL there does not help when we are not returning -ENOMEM. [1] https://syzkaller.appspot.com/bug?extid=017265e8553724e514e8 Reported-and-tested-by: syzbot <syzbot+017265e8553724e514e8@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200712111013.11881-1-penguin-kernel@I-love.SAKURA.ne.jp Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-07-29 07:42:57 +02:00
..
hvc	Revert "tty: hvc: Fix data abort due to race in hvc_open"	2020-06-30 15:38:10 -04:00
ipwireless	tty: ipwireless: Fix potential NULL pointer dereference	2020-01-27 14:46:15 +01:00
serdev	serdev: ttyport: restore client ops on deregistration	2020-02-28 16:36:12 +01:00
serial	serial: 8250_mtk: Fix high-speed baud rates clamping	2020-07-29 07:42:57 +02:00
vt	vt: Reject zero-sized screen buffer size.	2020-07-29 07:42:57 +02:00
amiserial.c
bfin_jtag_comm.c
cyclades.c
ehv_bytechan.c	tty: evh_bytechan: Fix out of bounds accesses	2020-04-24 08:01:23 +02:00
goldfish.c
isicom.c
Kconfig
Makefile
metag_da.c
mips_ejtag_fdc.c
moxa.c
moxa.h
mxser.c
mxser.h
n_gsm.c	tty: n_gsm: Fix bogus i++ in gsm_data_kick	2020-06-25 15:41:53 +02:00
n_hdlc.c	tty: Don't block on IO when ldisc change is pending	2019-12-17 20:38:37 +01:00
n_null.c
n_r3964.c	tty: Don't block on IO when ldisc change is pending	2019-12-17 20:38:37 +01:00
n_tracerouter.c
n_tracesink.c
n_tracesink.h
n_tty.c	tty: Don't block on IO when ldisc change is pending	2019-12-17 20:38:37 +01:00
nozomi.c
pty.c	pty: fix compat ioctls	2019-12-01 09:13:17 +01:00
rocket.c	tty: rocket, avoid OOB access	2020-05-02 17:24:30 +02:00
rocket.h
rocket_int.h
synclink.c
synclink_gt.c	tty: synclink_gt: Adjust indentation in several functions	2020-02-28 16:36:03 +01:00
synclinkmp.c	tty: synclinkmp: Adjust indentation in several functions	2020-02-28 16:36:03 +01:00
sysrq.c	sysrq: Remove duplicated sysrq message	2020-03-11 18:02:46 +01:00
tty_audit.c
tty_baudrate.c
tty_buffer.c
tty_io.c
tty_ioctl.c
tty_jobctrl.c
tty_ldisc.c	tty: Don't block on IO when ldisc change is pending	2019-12-17 20:38:37 +01:00
tty_ldsem.c	tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop	2019-08-16 10:13:55 +02:00
tty_mutex.c
tty_port.c	serdev: ttyport: restore client ops on deregistration	2020-02-28 16:36:12 +01:00
vcc.c