Re: [syzbot] KASAN: vmalloc-out-of-bounds Write in imageblit (2)

[Khalid Masum]

On 7/31/22 21:39, Helge Deller wrote:
> On 7/31/22 15:55, Khalid Masum wrote:
> > On 7/30/22 23:25, Helge Deller wrote:
> > > On 7/29/22 08:51, Khalid Masum wrote:
> > > > Here is a simplified reproducer for the issue:
> > > >
> > > > https://gist.githubusercontent.com/Labnann/923d6b9b3a19848fc129637b839b8a55/raw/a68271fcc724569735fe27f80817e561b3ff629a/reproducer.c
> > >
> > > The reproducer does this:
> > > ioctl(3, TIOCLINUX, TIOCL_SETSEL, selection: xs:3  ys:0  xe:0 ye:0 mode:0)  = 0
> > > -> sets the text selection area
> > > ioctl(4, KDFONTOP)  with op=0 (con_font_set), charcount=512  width=8  height=32, 0x20000000) = 0
> > > -> changes the font size.
> > >
> > > It does not crash with current Linus' head (v5.19-rc8).
> > > Kernel v5.16, which was used by this KASAN report, hasn't received backports
> > > since months, so I tried stable kernel v5.15.58 instead, and this
> > > kernel crashed with the reproducer.
> > >
> > > The reproducer brings up two issues with current code:
> > > 1. The reproducer uses ioctl(TIOCLINUX, TIOCL_SETSEL) and hands over (invalid)
> > > zero-values for ys and ye for the starting lines.
> > > This is wrong, since the API seems to expect a "1" as the very first line for the selection.
> >
> > Why do you think that API expects a 1?
>
> because the code in drivers/tty/vt/selection.c indicates this:
> See:
> static int vc_selection(struct vc_data *vc, struct tiocl_selection *v, struct tty_struct *tty)
> {
>          int ps, pe;
> ...
>          v->xs = min_t(u16, v->xs - 1, vc->vc_cols - 1);
>          v->ys = min_t(u16, v->ys - 1, vc->vc_rows - 1);
>          v->xe = min_t(u16, v->xe - 1, vc->vc_cols - 1);
>          v->ye = min_t(u16, v->ye - 1, vc->vc_rows - 1);
> ...
>          ps = v->ys * vc->vc_size_row + (v->xs << 1);
>          pe = v->ye * vc->vc_size_row + (v->xe << 1);
>
> The userspace-provided xs,ys,xe and ye values are decremented by one
> before ps and pe (the pointers into the text screen array) are calculated.
> So, for the xs...ye values in the range from 1..max-screen-lines/columns
> are expected.

Oh. I got it. It is pretty simple. Thanks again for explaining.

> Helge

Khalid Masum