lkml.org 
[lkml]   [2021]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [Internet]Re: [PATCH] fbcon: Out-Of-Bounds write in sys_imageblit, add range check
    On Tue, Jul 27, 2021 at 01:53:13AM +0000, tcs_kernel(腾讯云内核开发者) wrote:
    > yres and vyres can be controlled by user mode paramaters, and cause p->vrows to become a negative value. While this value be passed to real_y function, the ypos will be out of screen range.
    > This is an out-of-bounds write bug.
    > I think updatescrollmode is the right place to validate values supplied by a user ioctl, because only here makes --operation,and 0 is a legal value before that.

    Please wrap your changelog text.

    >
    > Signed-off-by: Tencent Cloud System tcs_kernel@tencent.com

    That is not the name of a person :(

    And the format isn't correct, so there's nothing we can do with this
    patch, and the patch itself is corrupted and could not be applied :(

    Also, what about checking these values earlier? How can the value be 0
    earlier and be acceptable? Putting bounds on the user-provided values
    would be much easier, right?

    thanks,

    greg k-h

    \
     
     \ /
      Last update: 2021-07-27 07:36    [W:19.593 / U:21.928 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site