diff options
| author | Tetsuo Handa <[email protected]> | 2020-07-30 19:47:14 +0900 |
|---|---|---|
| committer | Daniel Vetter <[email protected]> | 2020-08-04 07:37:23 +0200 |
| commit | d88ca7e1a27eb2df056bbf37ddef62e1c73d37ea (patch) | |
| tree | ab5c93efc1288a746ebeeb3ad98edf1fe022beb3 /lib/memory-notifier-error-inject.c | |
| parent | f369bc3f9096f5d355e8b80540bc30ac9a602912 (diff) | |
fbmem: pull fbcon_update_vcs() out of fb_set_var()
syzbot is reporting OOB read bug in vc_do_resize() [1] caused by memcpy()
based on outdated old_{rows,row_size} values, for resize_screen() can
recurse into vc_do_resize() which changes vc->vc_{cols,rows} that outdates
old_{rows,row_size} values which were saved before calling resize_screen().
Daniel Vetter explained that resize_screen() should not recurse into
fbcon_update_vcs() path due to FBINFO_MISC_USEREVENT being still set
when calling resize_screen().
Instead of masking FBINFO_MISC_USEREVENT before calling fbcon_update_vcs(),
we can remove FBINFO_MISC_USEREVENT by calling fbcon_update_vcs() only if
fb_set_var() returned 0. This change assumes that it is harmless to call
fbcon_update_vcs() when fb_set_var() returned 0 without reaching
fb_notifier_call_chain().
[1] https://syzkaller.appspot.com/bug?id=c70c88cfd16dcf6e1d3c7f0ab8648b3144b5b25e
Reported-and-tested-by: syzbot <[email protected]>
Suggested-by: Daniel Vetter <[email protected]>
Signed-off-by: Tetsuo Handa <[email protected]>
Reported-by: kernel test robot <[email protected]> for missing #include
Signed-off-by: Daniel Vetter <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
Diffstat (limited to 'lib/memory-notifier-error-inject.c')
0 files changed, 0 insertions, 0 deletions