Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <3d33d2c6-ad56-a442-2458-5892138a4d9d@gmail.com>
Date:   Mon, 1 Aug 2022 10:09:45 +0600
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.11.0
Subject: Re: [syzbot] KASAN: vmalloc-out-of-bounds Write in imageblit (2)
Content-Language: en-US
To:     Helge Deller <deller@gmx.de>,
        syzbot <syzbot+14b0e8f3fd1612e35350@syzkaller.appspotmail.com>,
        dri-devel@lists.freedesktop.org, linux-fbdev@vger.kernel.org,
        linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Jiri Slaby <jirislaby@kernel.org>
References: <000000000000bbdd0405d120c155@google.com>
 <20220729065139.6529-1-khalid.masum.92@gmail.com>
 <eb4a26aa-da30-ceee-7d27-c1e902dd4218@gmx.de>
 <7973ec94-75ad-c133-032e-b83beeb2d397@gmail.com>
 <f15c9525-f21f-0599-3d5e-d9cbedc683df@gmx.de>
From:   Khalid Masum <khalid.masum.92@gmail.com>
In-Reply-To: <f15c9525-f21f-0599-3d5e-d9cbedc683df@gmx.de>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk

On 7/31/22 21:39, Helge Deller wrote:
> On 7/31/22 15:55, Khalid Masum wrote:
>> On 7/30/22 23:25, Helge Deller wrote:
>>> On 7/29/22 08:51, Khalid Masum wrote:
>>>> Here is a simplified reproducer for the issue:
>>>>
>>>> https://gist.githubusercontent.com/Labnann/923d6b9b3a19848fc129637b839b8a55/raw/a68271fcc724569735fe27f80817e561b3ff629a/reproducer.c
>>>
>>> The reproducer does this:
>>> ioctl(3, TIOCLINUX, TIOCL_SETSEL, selection: xs:3  ys:0  xe:0 ye:0 mode:0)  = 0
>>> -> sets the text selection area
>>> ioctl(4, KDFONTOP)  with op=0 (con_font_set), charcount=512  width=8  height=32, 0x20000000) = 0
>>> -> changes the font size.
>>>
>>> It does not crash with current Linus' head (v5.19-rc8).
>>> Kernel v5.16, which was used by this KASAN report, hasn't received backports
>>> since months, so I tried stable kernel v5.15.58 instead, and this
>>> kernel crashed with the reproducer.
>>>
>>> The reproducer brings up two issues with current code:
>>> 1. The reproducer uses ioctl(TIOCLINUX, TIOCL_SETSEL) and hands over (invalid)
>>> zero-values for ys and ye for the starting lines.
>>> This is wrong, since the API seems to expect a "1" as the very first line for the selection.
>>
>> Why do you think that API expects a 1?
> 
> because the code in drivers/tty/vt/selection.c indicates this:
> See:
> static int vc_selection(struct vc_data *vc, struct tiocl_selection *v, struct tty_struct *tty)
> {
>          int ps, pe;
> ...
>          v->xs = min_t(u16, v->xs - 1, vc->vc_cols - 1);
>          v->ys = min_t(u16, v->ys - 1, vc->vc_rows - 1);
>          v->xe = min_t(u16, v->xe - 1, vc->vc_cols - 1);
>          v->ye = min_t(u16, v->ye - 1, vc->vc_rows - 1);
> ...
>          ps = v->ys * vc->vc_size_row + (v->xs << 1);
>          pe = v->ye * vc->vc_size_row + (v->xe << 1);
> 
> The userspace-provided xs,ys,xe and ye values are decremented by one
> before ps and pe (the pointers into the text screen array) are calculated.
> So, for the xs...ye values in the range from 1..max-screen-lines/columns
> are expected.

Oh. I got it. It is pretty simple. Thanks again for explaining.

> 
> Helge

Khalid Masum