aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorYunhai Zhang <[email protected]>2020-07-28 09:58:03 +0800
committerGreg Kroah-Hartman <[email protected]>2020-08-04 09:40:35 +0200
commitebfdfeeae8c01fcb2b3b74ffaf03876e20835d2d (patch)
treed3b9c6d35f30700d066311fdea467af89d2ce121
parent81f0f78965ebfe48c4997801050f64687cebea48 (diff)
vgacon: Fix for missing check in scrollback handling
vgacon_scrollback_update() always leaves enbough room in the scrollback buffer for the next call, but if the console size changed that room might not actually be enough, and so we need to re-check. The check should be in the loop since vgacon_scrollback_cur->tail is updated in the loop and count may be more than 1 when triggered by CSI M, as Jiri's PoC: #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/types.h> #include <sys/stat.h> #include <sys/ioctl.h> #include <fcntl.h> int main(int argc, char** argv) { int fd = open("/dev/tty1", O_RDWR); unsigned short size[3] = {25, 200, 0}; ioctl(fd, 0x5609, size); // VT_RESIZE write(fd, "\e[1;1H", 6); for (int i = 0; i < 30; i++) write(fd, "\e[10M", 5); } It leads to various crashes as vgacon_scrollback_update writes out of the buffer: BUG: unable to handle page fault for address: ffffc900001752a0 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page RIP: 0010:mutex_unlock+0x13/0x30 ... Call Trace: n_tty_write+0x1a0/0x4d0 tty_write+0x1a0/0x2e0 Or to KASAN reports: BUG: KASAN: slab-out-of-bounds in vgacon_scroll+0x57a/0x8ed This fixes CVE-2020-14331. Reported-by: 张云海 <[email protected]> Reported-by: Yang Yingliang <[email protected]> Reported-by: Kyungtae Kim <[email protected]> Fixes: 15bdab959c9b ([PATCH] vgacon: Add support for soft scrollback) Cc: [email protected] Cc: [email protected] Cc: Linus Torvalds <[email protected]> Cc: Solar Designer <[email protected]> Cc: "Srivatsa S. Bhat" <[email protected]> Cc: Anthony Liguori <[email protected]> Cc: Yang Yingliang <[email protected]> Cc: Bartlomiej Zolnierkiewicz <[email protected]> Cc: Jiri Slaby <[email protected]> Signed-off-by: Yunhai Zhang <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
-rw-r--r--drivers/video/console/vgacon.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index f0f3d573f848..a52bb3740073 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -251,6 +251,10 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count)
p = (void *) (c->vc_origin + t * c->vc_size_row);
while (count--) {
+ if ((vgacon_scrollback_cur->tail + c->vc_size_row) >
+ vgacon_scrollback_cur->size)
+ vgacon_scrollback_cur->tail = 0;
+
scr_memcpyw(vgacon_scrollback_cur->data +
vgacon_scrollback_cur->tail,
p, c->vc_size_row);