syzbot is reporting OOB read bug in vc_do_resize() [1] caused by memcpy() based on outdated old_{rows,row_size} values, for resize_screen() can recurse into vc_do_resize() which changes vc->vc_{cols,rows} that outdates old_{rows,row_size} values which were saved before calling resize_screen(). Daniel Vetter explained that resize_screen() should not recurse into fbcon_update_vcs() path due to FBINFO_MISC_USEREVENT being still set when calling resize_screen(). Instead of masking FBINFO_MISC_USEREVENT before calling fbcon_update_vcs(), we can remove FBINFO_MISC_USEREVENT by calling fbcon_update_vcs() only if fb_set_var() returned 0. This change assumes that it is harmless to call fbcon_update_vcs() when fb_set_var() returned 0 without reaching fb_notifier_call_chain(). [1] https://syzkaller.appspot.com/bug?id=c70c88cfd16dcf6e1d3c7f0ab8648b3144b5b25e
Showing the changes to include/linux (1 of 4 files). Show all
Unified · Split
| @@ -400,8 +400,6 @@ struct fb_tile_ops { · 399 unmodified lines | |||
| 400 | #define FBINFO_HWACCEL_YPAN 0x2000 /* optional */ | 400 | #define FBINFO_HWACCEL_YPAN 0x2000 /* optional */ |
| 401 | #define FBINFO_HWACCEL_YWRAP 0x4000 /* optional */ | 401 | #define FBINFO_HWACCEL_YWRAP 0x4000 /* optional */ |
| 402 | 402 | ||
| 403 | #define FBINFO_MISC_USEREVENT 0x10000 /* event request | ||
| 404 | from userspace */ | ||
| 405 | #define FBINFO_MISC_TILEBLITTING 0x20000 /* use tile blitting */ | 403 | #define FBINFO_MISC_TILEBLITTING 0x20000 /* use tile blitting */ |
| 406 | 404 | ||
| 407 | /* A driver may set this flag to indicate that it does want a set_par to be | 405 | /* A driver may set this flag to indicate that it does want a set_par to be |