Hi, On Mon, Jul 26, 2021 at 11:32:37AM +0000, tcs_kernel(腾讯云内核开发者) wrote: > yres and vyres can be controlled by user mode paramaters, and cause p->vrows to become a negative value. While this value be passed to real_y function, the ypos will be out of screen range. > This is an out-of-bounds write bug. Please investigate if you can validate the user-supplied values for yres and vyres earlier so the code never reaches the below statements. This would also make it much more explicit what is going on. Sam > > > diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c > index 22bb3892f6bd..0970de46782f 100644 > --- a/drivers/video/fbdev/core/fbcon.c > +++ b/drivers/video/fbdev/core/fbcon.c > @@ -1956,11 +1956,12 @@ static void updatescrollmode(struct fbcon_display *p, > int yres = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres); > int vyres = FBCON_SWAP(ops->rotate, info->var.yres_virtual, > info->var.xres_virtual); > + int rows = vc->vc_rows; > > p->vrows = vyres/fh; > - if (yres > (fh * (vc->vc_rows + 1))) > - p->vrows -= (yres - (fh * vc->vc_rows)) / fh; > - if ((yres % fh) && (vyres % fh < yres % fh)) > + if ((yres > (fh * (rows + 1))) && (vyres >= (yres - (fh * rows))) && p->vrows) > + p->vrows -= (yres - (fh * rows)) / fh; > + if ((yres % fh) && (vyres % fh < yres % fh) && p->vrows) > p->vrows--; > } >
