Received: by 2002:a25:ca44:0:0:0:0:0 with SMTP id a65csp1096415ybg;
        Wed, 29 Jul 2020 05:54:15 -0700 (PDT)
X-Google-Smtp-Source: ABdhPJx9LSHmHf5cqV0it4tYCYyQRAi9rnnx7R5njzlAfS4otV1C8gCENuxHThn8KVA8brVdxBIJ
X-Received: by 2002:a05:6402:896:: with SMTP id e22mr657377edy.3.1596027255816;
        Wed, 29 Jul 2020 05:54:15 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1596027255; cv=none;
        d=google.com; s=arc-20160816;
        b=Zafu+GXL5borenlSkUKyYpI6pzH1M5Znv0Yvr7d3qBVHUcPjMAP2WbSSzW2l6DnrXk
         dGzfjriFkLRoIu7lB81c+R6iqDIjGjsotVmzDq+68oS1YZv4gUzgezwTyspYkwXV7j6D
         bjX0hUUEXCl3mtWY57Jw5mA6PLdD3l42THiZ4zvgRc95h6QUf7dCP5jNBmjzQWkRlbcb
         1J2T1i6kD1weEFSIJyFMMAxDNn+8np+tGeZgWRWYpVtAuCk7JtPAiThI2yLdBEt4G76O
         JGVmBQGk9bF8+4HiOQCfklu1ZmMIm+/ttYNv1EW8osSH8cz4nFY1OKfxz3FT/zdOYyWI
         8FSQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=list-id:precedence:sender:in-reply-to:content-disposition
         :mime-version:references:message-id:subject:cc:to:from:date
         :dkim-signature;
        bh=Iexvaqw+SafobBB0QyD3TQAo8Xjgg+1v1qR+efYtE4M=;
        b=wxNoC4rs2CFj6hNFVbEt/wdNr1P1piJMZxoa5MJ1nbOCbrqoTiiZqNcYWTXraQec3s
         ++BkBwlrXhn247C9qkhy2YrQWlZ1jeDbsp7I1caXntlxJyqSUBpBThuHIrtuvPlJrjnL
         LSLYltWZ34nsFqsfapyqbxWvlE0QS90BMyQdmyeHqZMq89ujKNKAooFpoxH7RTtk6TAN
         AZ/78MFJxKj1npw11QcMsTG4+PFKxRdbkuEqXG0muLqslk/Gzw3IzDpJWEKheXFfK8wn
         pfxl3WWoh6PfLgSAsWp9eRLq26/vru0SN3NuVnMCDPnZ2Sx1Bo0Z9Ggf5dsAcvFeW/qJ
         FGFA==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@kernel.org header.s=default header.b="W0O/Ko7N";
       spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18])
        by mx.google.com with ESMTP id i2si991558ejg.240.2020.07.29.05.53.52;
        Wed, 29 Jul 2020 05:54:15 -0700 (PDT)
Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@kernel.org header.s=default header.b="W0O/Ko7N";
       spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1726876AbgG2MxX (ORCPT <rfc822;dexuan.linux@gmail.com>
        + 99 others); Wed, 29 Jul 2020 08:53:23 -0400
Received: from mail.kernel.org ([198.145.29.99]:41774 "EHLO mail.kernel.org"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1726353AbgG2MxW (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
        Wed, 29 Jul 2020 08:53:22 -0400
Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107])
        (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
        (No client certificate requested)
        by mail.kernel.org (Postfix) with ESMTPSA id BC2AA206D4;
        Wed, 29 Jul 2020 12:53:20 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;
        s=default; t=1596027201;
        bh=iojlClZWVh0dh0Rl11AjHfrnNEiiNUT82pdn+efYjxk=;
        h=Date:From:To:Cc:Subject:References:In-Reply-To:From;
        b=W0O/Ko7N1kTAjJJpl5QFrAO4uwdCTKZtEBxfZE6qdc9d5G1bAGHfRQJA3v+MWKXbm
         Yo7RjNnw3nDN01VKNhVRgXxx0j3GwJy3a1QY447c22amen6+k7fRePEjxYiVj1wDH0
         Qlwg+M7hT3094fhR8f8EauHkUKqMJFm9TzF4Qt5Y=
Date:   Wed, 29 Jul 2020 14:53:11 +0200
From:   Greg KH <gregkh@linuxfoundation.org>
To:     George Kennedy <george.kennedy@oracle.com>
Cc:     jslaby@suse.com, ebiggers@google.com, linux-kernel@vger.kernel.org,
        dan.carpenter@oracle.com, dhaval.giani@oracle.com
Subject: Re: [PATCH 1/1] vt_ioctl: prevent VT_RESIZEX font height change from
 causing potential out-of-bounds access
Message-ID: <20200729125311.GA2912372@kroah.com>
References: <1596026381-5013-1-git-send-email-george.kennedy@oracle.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1596026381-5013-1-git-send-email-george.kennedy@oracle.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Wed, Jul 29, 2020 at 08:39:41AM -0400, George Kennedy wrote:
> Add a VT_RESIZEX check to ensure that changing the font height will not
> cause a potential out-of-bounds access. The candidate font height contained
> in "v_clin", though below the max, could still result in accesses beyond
> the allocated font data size.
> 
> Signed-off-by: George Kennedy <george.kennedy@oracle.com>
> Reported-by: syzbot+38a3699c7eaf165b97a6@syzkaller.appspotmail.com

Did syzbot also test this that it fixes the reported issue?

What commit does this fix?  Should it go back farther to stable releases
too?

thanks,

greg k-h