On Wed, Oct 04, 2017 at 10:12:38AM -0400, Meng Xu wrote: > In con_font_set(), when we need to guess font height (for > compat reasons?), the current approach uses multiple userspace > fetches, i.e., get_user(tmp, &charmap[32*i+h-1]), to derive > the height. This has two drawbacks: > > 1. performance: accessing userspace memory is less efficient than > directly de-reference the byte > > 2. security: a more critical problem is that the height derived > might not match with the actual font.data. This is because a user > thread might race condition to change the memory of op->data after > the op->height guessing but before the second fetch: font.data = > memdup_user(op->data, size). Leaving font.height = 32 while the > actual height is 1 or vice-versa. > > This patch tries to resolve both issues by re-locating the height > guessing part after the font.data is fetched in. In this way, the > userspace data is fetched in one shot and we directly dereference > the font.data in kernel space to probe for the height. > > Signed-off-by: Meng Xu <mengxu.gat...@gmail.com> > --- > drivers/tty/vt/vt.c | 48 ++++++++++++++++++++++++++++-------------------- > 1 file changed, 28 insertions(+), 20 deletions(-)
Is this a v2 patch? If so, please mark it as such and say what changed below the --- line. The kernel documenation says how to do this correctly. thanks, greg k-h
