Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 1 Aug 2022 13:43:43 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Khalid Masum <khalid.masum.92@gmail.com>
Cc:     linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
        syzbot+14b0e8f3fd1612e35350@syzkaller.appspotmail.com,
        khalid.masum@aol.com
Subject: Re: [syzbot] KASAN: vmalloc-out-of-bounds Write in imageblit (2)
Message-ID: <20220801104343.GA3438@kadam>
References: <000000000000bbdd0405d120c155@google.com>
 <20220730081246.4567-1-khalid.masum.92@gmail.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20220730081246.4567-1-khalid.masum.92@gmail.com>
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?cr9N+5ShtzNtWmMcZMH1523aL0Hci22v0mDCJ4mPQv9ogeeEt8WpSYJajCjV?=
 =?us-ascii?Q?5UX0ZdwfKZNIjKZU0lH0Pptrg5Gjk3/W7HwpWqzSC2y+A1ULX5KalvcLAihF?=
 =?us-ascii?Q?4mftFlExsWt9AHib0H5GefrHhBsdJHrS/kntZoPMPIuDu5TCiGfwG2OG/e5H?=
 =?us-ascii?Q?Jv2LuiEnO10ceOC8am7dE4gzRgnulPzGi9BoE9NAHaBvVh2jGkq+2dBBVy9W?=
 =?us-ascii?Q?swrJkDRngnEwZXTWgX8ptSyAt2zBdtwADqsXSeYpZatTpr9L9a/IeZvVF0bT?=
 =?us-ascii?Q?/iNu54oelYBCX+MdzxUfDFPjlt6+9/1RMdEeJMJxu2X4reXq0Zd3OvHpRHPy?=
 =?us-ascii?Q?MRMAOBuLsXrdlSuk8b9At8vYmDSPwf8nv/ganDELvPlWo3MXm4nCEKynTTwp?=
 =?us-ascii?Q?8/LvSEJ9xoBU9wF7lY5TOgw1+EM2rz6Bq0+gDZhebYMBp3N96eR4DQTQBYUo?=
 =?us-ascii?Q?uJHk0oHizZaesqAy8cNck885lCM6ePzfjJ4iuca/f9EtU38+ZOigCK+mfZfj?=
 =?us-ascii?Q?oUYlR0qQTpr+nTfL2XCqosRBg7Yhhiu6l52ophC/TUXwlfRbJEGysXHFQi2c?=
 =?us-ascii?Q?25M9o5S7Z90tA4U/N2KzRxfKV+tlThm7mR1Tl5Xnjp2c2L+AdokviS53mNte?=
 =?us-ascii?Q?rIFgbVCR9YxqtyWABO2YAMmDR4kLuBq0yS3knacJ5SeHHxAgDETcTgaYRA8d?=
 =?us-ascii?Q?Sm4qtPrrAaazxwiuftp7bDVe3tI1fPOEiGPShhLYo0ehxCzdjdsKOa+Q28Sd?=
 =?us-ascii?Q?oDZLoVkM4YN/c5d4jGLJVqbPtnNf8x9GHYNhc/cbDAPDTWLkkiTeDpaoYeMx?=
 =?us-ascii?Q?+TA7ObsHNpR/mejtk+bLWPptbHwcZuJFGpEiAgB/7KGB/iLAbZZX1XFjGbx+?=
 =?us-ascii?Q?WNAhuGm+Qx1c83F55q9DLzzGxCGdwWXrNYPqPzbcGvDmCAZ1b2fLY2a2VhJD?=
 =?us-ascii?Q?/3SXTl/LXEEbW5Pv/oClBpbiJvotSlW3uXm4mgkms0Nn0kMM7StGExjmExmd?=
 =?us-ascii?Q?cRK2tJV43L+dKZeYVY6yvtI8Su44mrNVqwayVIg0T4oJxjsGH/BWyxbW99yI?=
 =?us-ascii?Q?tHzJ8RlLTq3dOIjnoaO7I0Hb0LkhV7Lyl/F/A5C4OC3MZqy//zIM7aschLn/?=
 =?us-ascii?Q?93mSIDQCvZ/7VUOPJji7kj/Yb2OqBNE51q3lbXc2gA8hv/zes7lfz/gmle1R?=
 =?us-ascii?Q?uj+T1H8+6VKpK/n9E4EA8GH0t+xfzA5c3zP6u2xhw1IpsbMkA3ugTtew0vXy?=
 =?us-ascii?Q?ytLrnv08jTrBvuD2kw0zk/PAh1T3EVLHRzfDjcAmebVqI1tbPWEzysRNJJIt?=
 =?us-ascii?Q?g/79AEh45Nc2MTXmBeByPhejKCOPR6JiX3I2b03s+Ctx540tC93nIVkx7wsF?=
 =?us-ascii?Q?TYMn2sIDR+4yYiXyG/DuWO2H+alE2wDpdJxO/HWNghmu3mNdZJLhqAZMJASu?=
 =?us-ascii?Q?GYfR37d+KpMFBqhMS0RLlTKQKkkdXLIGq5GqxWrtgHAcKm+2KmYUMECmzKSL?=
 =?us-ascii?Q?ZIbCLwp86P5u5rjUjD4o/mOk02//VRCkzeSTaWV2w/vTQgaErJGLw+7itShr?=
 =?us-ascii?Q?39MFKCpXQ0nfCtHfjlXP41c8z8IUtS8g63p6aBS547UrymQRzVsHN2tyJO9J?=
 =?us-ascii?Q?KQ=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 959c43fe-f33f-41cf-3c93-08da73aabff5
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Aug 2022 10:44:04.0375
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: p0DFJL2Ta+XCOmuZafctp5Hu4Ea4XLbDX6XLp9gTerE8poSLHeHkN7pEMs3GO+NwymjQCcy5CaQVDSvKH939oBptVtE1SE3p0of5dvDDLZs=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5226
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.883,Hydra:6.0.517,FMLib:17.11.122.1
 definitions=2022-08-01_05,2022-08-01_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 mlxscore=0 suspectscore=0
 adultscore=0 bulkscore=0 malwarescore=0 mlxlogscore=999 phishscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2206140000
 definitions=main-2208010052
X-Proofpoint-ORIG-GUID: Aao-EZCokPxwS94RM_PeI0AkPVSssYmf
X-Proofpoint-GUID: Aao-EZCokPxwS94RM_PeI0AkPVSssYmf
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Sat, Jul 30, 2022 at 02:12:46PM +0600, Khalid Masum wrote:
> Currently the if block's condition has an unhandled case, where the
> result of ret might get greater than vc->vc_scr_end, and therefore
> the corresponding handler in else block never gets executed. Which
> eventually causes panic in fast_imageblit.
> 
> Add this extra check in the conditions to fix this breakage.
> 
> #syz-test: https://github.com/torvalds/linux.git e0dccc3b76fb 
> 
> ---
>  drivers/video/fbdev/core/fbcon.c | 13 ++++++-------
>  1 file changed, 6 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
> index 1a9aa12cf886..d026f3845b60 100644
> --- a/drivers/video/fbdev/core/fbcon.c
> +++ b/drivers/video/fbdev/core/fbcon.c
> @@ -2591,14 +2591,13 @@ static unsigned long fbcon_getxy(struct vc_data *vc, unsigned long pos,
>  {
>  	unsigned long ret;
>  	int x, y;
> +	unsigned long offset = (pos - vc->vc_origin) / 2;
> +	x = offset % vc->vc_cols;
> +	y = offset / vc->vc_cols;
> +	ret = pos + (vc->vc_cols - x) * 2;
>  
> -	if (pos >= vc->vc_origin && pos < vc->vc_scr_end) {
> -		unsigned long offset = (pos - vc->vc_origin) / 2;
> -
> -		x = offset % vc->vc_cols;
> -		y = offset / vc->vc_cols;
> -		ret = pos + (vc->vc_cols - x) * 2;
> -	} else {
> +	if (!pos >= vc->vc_origin || !pos < vc->vc_scr_end ||
> +	                             !ret < vc->vc_scr_end) {


These are precendence bugs.  The ! will be done before the >=.  Write it
as:

	if (pos < vc->vc_origin || pos >= vc->vc_scr_end ||
	    ret >= vc->vc_scr_end) {


>  		/* Should not happen */
>  		x = y = 0;
>  		ret = vc->vc_origin;

regards,
dan carpenter