All of lore.kernel.org
 help / color / mirror / Atom feed
From: "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>
To: "tcs_kernel(腾讯云内核开发者)" <tcs_kernel@tencent.com>
Cc: Sam Ravnborg <sam@ravnborg.org>,
	"daniel.vetter@ffwll.ch" <daniel.vetter@ffwll.ch>,
	"yepeilin.cs@gmail.com" <yepeilin.cs@gmail.com>,
	"penguin-kernel@I-love.SAKURA.ne.jp" 
	<penguin-kernel@i-love.sakura.ne.jp>,
	"tzimmermann@suse.de" <tzimmermann@suse.de>,
	"george.kennedy@oracle.com" <george.kennedy@oracle.com>,
	"ducheng2@gmail.com" <ducheng2@gmail.com>,
	"dri-devel@lists.freedesktop.org"
	<dri-devel@lists.freedesktop.org>,
	"linux-fbdev@vger.kernel.org" <linux-fbdev@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [Internet]Re: [PATCH] fbcon: Out-Of-Bounds write in sys_imageblit, add range check
Date: Tue, 27 Jul 2021 07:35:28 +0200	[thread overview]
Message-ID: <YP+bINav7znIU6xF@kroah.com> (raw)
In-Reply-To: <28F2D8E8-B519-40F6-B6CD-98A0FAD67CD7@tencent.com>

On Tue, Jul 27, 2021 at 01:53:13AM +0000, tcs_kernel(腾讯云内核开发者) wrote:
> yres and vyres can be controlled by user mode paramaters, and cause p->vrows to become a negative value. While this value be passed to real_y function, the ypos will be out of screen range.
> This is an out-of-bounds write bug.
> I think updatescrollmode is the right place to validate values supplied by a user ioctl, because only here makes --operation,and 0 is a legal value before that.

Please wrap your changelog text.

> 
> Signed-off-by: Tencent Cloud System tcs_kernel@tencent.com

That is not the name of a person :(

And the format isn't correct, so there's nothing we can do with this
patch, and the patch itself is corrupted and could not be applied :(

Also, what about checking these values earlier?  How can the value be 0
earlier and be acceptable?  Putting bounds on the user-provided values
would be much easier, right?

thanks,

greg k-h

WARNING: multiple messages have this Message-ID (diff)
From: "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>
To: "tcs_kernel(腾讯云内核开发者)" <tcs_kernel@tencent.com>
Cc: "linux-fbdev@vger.kernel.org" <linux-fbdev@vger.kernel.org>,
	"ducheng2@gmail.com" <ducheng2@gmail.com>,
	"penguin-kernel@I-love.SAKURA.ne.jp"
	<penguin-kernel@i-love.sakura.ne.jp>,
	"daniel.vetter@ffwll.ch" <daniel.vetter@ffwll.ch>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"dri-devel@lists.freedesktop.org"
	<dri-devel@lists.freedesktop.org>,
	"george.kennedy@oracle.com" <george.kennedy@oracle.com>,
	"tzimmermann@suse.de" <tzimmermann@suse.de>,
	Sam Ravnborg <sam@ravnborg.org>,
	"yepeilin.cs@gmail.com" <yepeilin.cs@gmail.com>
Subject: Re: [Internet]Re: [PATCH] fbcon: Out-Of-Bounds write in sys_imageblit, add range check
Date: Tue, 27 Jul 2021 07:35:28 +0200	[thread overview]
Message-ID: <YP+bINav7znIU6xF@kroah.com> (raw)
In-Reply-To: <28F2D8E8-B519-40F6-B6CD-98A0FAD67CD7@tencent.com>

On Tue, Jul 27, 2021 at 01:53:13AM +0000, tcs_kernel(腾讯云内核开发者) wrote:
> yres and vyres can be controlled by user mode paramaters, and cause p->vrows to become a negative value. While this value be passed to real_y function, the ypos will be out of screen range.
> This is an out-of-bounds write bug.
> I think updatescrollmode is the right place to validate values supplied by a user ioctl, because only here makes --operation,and 0 is a legal value before that.

Please wrap your changelog text.

> 
> Signed-off-by: Tencent Cloud System tcs_kernel@tencent.com

That is not the name of a person :(

And the format isn't correct, so there's nothing we can do with this
patch, and the patch itself is corrupted and could not be applied :(

Also, what about checking these values earlier?  How can the value be 0
earlier and be acceptable?  Putting bounds on the user-provided values
would be much easier, right?

thanks,

greg k-h

  reply	other threads:[~2021-07-27  5:35 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-26 11:32 [PATCH] fbcon: Out-Of-Bounds write in sys_imageblit, add range check tcs_kernel(腾讯云内核开发者)
2021-07-26 11:32 ` tcs_kernel(腾讯云内核开发者)
2021-07-26 13:00 ` gregkh
2021-07-26 13:00   ` gregkh
2021-07-26 13:45 ` Sam Ravnborg
2021-07-27  1:53   ` [Internet]Re: " tcs_kernel(腾讯云内核开发者)
2021-07-27  1:53     ` tcs_kernel(腾讯云内核开发者)
2021-07-27  5:35     ` gregkh [this message]
2021-07-27  5:35       ` gregkh

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YP+bINav7znIU6xF@kroah.com \
    --to=gregkh@linuxfoundation.org \
    --cc=daniel.vetter@ffwll.ch \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=ducheng2@gmail.com \
    --cc=george.kennedy@oracle.com \
    --cc=linux-fbdev@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=penguin-kernel@i-love.sakura.ne.jp \
    --cc=sam@ravnborg.org \
    --cc=tcs_kernel@tencent.com \
    --cc=tzimmermann@suse.de \
    --cc=yepeilin.cs@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.