vgacon: Fix for missing check in scrollback handling

vgacon_scrollback_update() always leaves enbough room in the scrollback
buffer for the next call, but if the console size changed that room
might not actually be enough, and so we need to re-check.

The check should be in the loop since vgacon_scrollback_cur->tail is
updated in the loop and count may be more than 1 when triggered by CSI M,
as Jiri's PoC:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/ioctl.h>
#include <fcntl.h>

int main(int argc, char** argv)
{
        int fd = open("/dev/tty1", O_RDWR);
        unsigned short size[3] = {25, 200, 0};
        ioctl(fd, 0x5609, size); // VT_RESIZE

        write(fd, "\e[1;1H", 6);
        for (int i = 0; i < 30; i++)
                write(fd, "\e[10M", 5);
}

It leads to various crashes as vgacon_scrollback_update writes out of
the buffer:
 BUG: unable to handle page fault for address: ffffc900001752a0
 #PF: supervisor write access in kernel mode
 #PF: error_code(0x0002) - not-present page
 RIP: 0010:mutex_unlock+0x13/0x30
...
 Call Trace:
  n_tty_write+0x1a0/0x4d0
  tty_write+0x1a0/0x2e0

Or to KASAN reports:
BUG: KASAN: slab-out-of-bounds in vgacon_scroll+0x57a/0x8ed

This fixes CVE-2020-14331.

Reported-by: 张云海 <[email protected]>
Reported-by: Yang Yingliang <[email protected]>
Reported-by: Kyungtae Kim <[email protected]>
Fixes: 15bdab959c9b ([PATCH] vgacon: Add support for soft scrollback)
Cc: [email protected]
Cc: [email protected]
Cc: Linus Torvalds <[email protected]>
Cc: Solar Designer <[email protected]>
Cc: "Srivatsa S. Bhat" <[email protected]>
Cc: Anthony Liguori <[email protected]>
Cc: Yang Yingliang <[email protected]>
Cc: Bartlomiej Zolnierkiewicz <[email protected]>
Cc: Jiri Slaby <[email protected]>
Signed-off-by: Yunhai Zhang <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>

diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index f0f3d573f8485c121e37c5d207ac89dedd64915d..a52bb374007342370e003f3e624ff789c5863a6b 100644 (file)
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -251,6 +251,10 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count)
        p = (void *) (c->vc_origin + t * c->vc_size_row);
 
        while (count--) {
+               if ((vgacon_scrollback_cur->tail + c->vc_size_row) >
+                   vgacon_scrollback_cur->size)
+                       vgacon_scrollback_cur->tail = 0;
+
                scr_memcpyw(vgacon_scrollback_cur->data +
                            vgacon_scrollback_cur->tail,
                            p, c->vc_size_row);