Hi, On Mon, Jul 26, 2021 at 11:32:37AM +0000, tcs_kernel(腾讯云内核开发者) wrote:
yres and vyres can be controlled by user mode paramaters, and cause p->vrows to become a negative value. While this value be passed to real_y function, the ypos will be out of screen range. This is an out-of-bounds write bug.
Please investigate if you can validate the user-supplied values for yres and vyres earlier so the code never reaches the below statements. This would also make it much more explicit what is going on.
Sam
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 22bb3892f6bd..0970de46782f 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -1956,11 +1956,12 @@ static void updatescrollmode(struct fbcon_display *p, int yres = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres); int vyres = FBCON_SWAP(ops->rotate, info->var.yres_virtual, info->var.xres_virtual);
int rows = vc->vc_rows; p->vrows = vyres/fh;
if (yres > (fh * (vc->vc_rows + 1)))p->vrows -= (yres - (fh * vc->vc_rows)) / fh;if ((yres % fh) && (vyres % fh < yres % fh))
if ((yres > (fh * (rows + 1))) && (vyres >= (yres - (fh * rows))) && p->vrows)p->vrows -= (yres - (fh * rows)) / fh;if ((yres % fh) && (vyres % fh < yres % fh) && p->vrows) p->vrows--;}