Thread (3 messages) 3 messages, 2 authors, 2017-08-27

[PATCH] vgacon, x86/boot: Prevent faulty bootparams.screeninfo from causing harm

flat view
STALE3335d

From: Jan H. Schönherr <hidden>
Date: 2017-08-27 13:56:46
Subsystem: console subsystem, framebuffer layer, the rest, x86 architecture (32-bit and 64-bit) · Maintainers: Greg Kroah-Hartman, Helge Deller, Linus Torvalds, Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen

If a zero for the number of colums or rows manages to slip through,
gotoxy() will underflow vc->vc_pos, causing the next action on the
referenced memory to end with a page fault.

Make the check in vgacon more pessimistic to prevent that. Also change
a similar check in the x86 boot code with a similar problem.

Signed-off-by: Jan H. Schönherr <redacted>
---
Let me know, if I should split this into two patches.

 arch/x86/boot/compressed/misc.c | 3 +--
 drivers/video/console/vgacon.c  | 5 ++---
 2 files changed, 3 insertions(+), 5 deletions(-)
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index a0838ab..c14217c 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -116,8 +116,7 @@ void __putstr(const char *s)
 		}
 	}
 
-	if (boot_params->screen_info.orig_video_mode = 0 &&
-	    lines = 0 && cols = 0)
+	if (lines = 0 || cols = 0)
 		return;
 
 	x = boot_params->screen_info.orig_x;
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index dc06cb6..445b1dc 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -398,9 +398,8 @@ static const char *vgacon_startup(void)
 #endif
 	}
 
-	/* boot_params.screen_info initialized? */
-	if ((screen_info.orig_video_mode  = 0) &&
-	    (screen_info.orig_video_lines = 0) &&
+	/* boot_params.screen_info reasonably initialized? */
+	if ((screen_info.orig_video_lines = 0) ||
 	    (screen_info.orig_video_cols  = 0))
 		goto no_vga;
 
-- 
2.3.1.dirty
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help