Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-10-01 Thread Peilin Ye
On Wed, Sep 30, 2020 at 01:52:11PM +0200, Greg Kroah-Hartman wrote: > On Wed, Sep 30, 2020 at 01:25:14PM +0200, Daniel Vetter wrote: > > On Wed, Sep 30, 2020 at 12:56 PM Peilin Ye wrote: > > > Yes, and built-in fonts don't use refcount. Or maybe we can let > > > find_font() and get_default_font()

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-10-01 Thread Peilin Ye
On Wed, Sep 30, 2020 at 11:53:17AM +0200, Daniel Vetter wrote: > On Wed, Sep 30, 2020 at 03:11:51AM -0400, Peilin Ye wrote: > > On Tue, Sep 29, 2020 at 04:38:49PM +0200, Daniel Vetter wrote: > > > On Tue, Sep 29, 2020 at 2:34 PM Peilin Ye wrote: > > > > Ah, and speaking of built-in fonts, see fbco

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-30 Thread Greg Kroah-Hartman
On Wed, Sep 30, 2020 at 01:25:14PM +0200, Daniel Vetter wrote: > On Wed, Sep 30, 2020 at 12:56 PM Peilin Ye wrote: > > > > On Wed, Sep 30, 2020 at 11:53:17AM +0200, Daniel Vetter wrote: > > > On Wed, Sep 30, 2020 at 03:11:51AM -0400, Peilin Ye wrote: > > > > On Tue, Sep 29, 2020 at 04:38:49PM +020

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-30 Thread Daniel Vetter
On Wed, Sep 30, 2020 at 12:56 PM Peilin Ye wrote: > > On Wed, Sep 30, 2020 at 11:53:17AM +0200, Daniel Vetter wrote: > > On Wed, Sep 30, 2020 at 03:11:51AM -0400, Peilin Ye wrote: > > > On Tue, Sep 29, 2020 at 04:38:49PM +0200, Daniel Vetter wrote: > > > > On Tue, Sep 29, 2020 at 2:34 PM Peilin Ye

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-30 Thread Daniel Vetter
On Wed, Sep 30, 2020 at 03:11:51AM -0400, Peilin Ye wrote: > On Tue, Sep 29, 2020 at 04:38:49PM +0200, Daniel Vetter wrote: > > On Tue, Sep 29, 2020 at 2:34 PM Peilin Ye wrote: > > > It seems that users don't use `console_font` directly, they use > > > `console_font_op`. Then, in TTY: > > > > Wow

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-30 Thread Peilin Ye
On Tue, Sep 29, 2020 at 11:09:45AM +0200, Daniel Vetter wrote: > If you want to follow along a bit I think would be good to subscribe to > the dri-devel mailing list. At least for all the fbcon/fbdev/gpu stuff. > > I don't think there's a dedicated list for vt/console stuff, aside from > Greg's in

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-30 Thread Peilin Ye
On Tue, Sep 29, 2020 at 04:38:49PM +0200, Daniel Vetter wrote: > On Tue, Sep 29, 2020 at 2:34 PM Peilin Ye wrote: > > It seems that users don't use `console_font` directly, they use > > `console_font_op`. Then, in TTY: > > Wow, this is a maze :-/ > > > (drivers/tty/vt/vt.c) > > int con_font_op(s

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-30 Thread Peilin Ye
On Fri, Sep 25, 2020 at 03:25:51PM +0200, Daniel Vetter wrote: > I think the only way to make this work is that we have one place which > takes in the userspace uapi struct, and then converts it once into a > kernel_console_font. With all the error checking. Hi Daniel, It seems that users don't u

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-30 Thread Peilin Ye
On Wed, Sep 30, 2020 at 07:26:52AM +0200, Jiri Slaby wrote: > On 29. 09. 20, 14:34, Peilin Ye wrote: > > the work in general? I couldn't think of how do we clean up subsystems > > one by one, while keeping a `console_font` in `struct vc_data`. > > Hi, > > feel free to change struct vc_data's cont

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-29 Thread Jiri Slaby
On 29. 09. 20, 14:34, Peilin Ye wrote: > the work in general? I couldn't think of how do we clean up subsystems > one by one, while keeping a `console_font` in `struct vc_data`. Hi, feel free to change struct vc_data's content as you need, of course. Only the UAPI _definitions_ have to be preserv

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-29 Thread Daniel Vetter
On Tue, Sep 29, 2020 at 2:34 PM Peilin Ye wrote: > > On Fri, Sep 25, 2020 at 03:25:51PM +0200, Daniel Vetter wrote: > > I think the only way to make this work is that we have one place which > > takes in the userspace uapi struct, and then converts it once into a > > kernel_console_font. With all

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-29 Thread Daniel Vetter
On Fri, Sep 25, 2020 at 11:35:09AM -0400, Peilin Ye wrote: > On Fri, Sep 25, 2020 at 03:25:51PM +0200, Daniel Vetter wrote: > > I think the only way to make this work is that we have one place which > > takes in the userspace uapi struct, and then converts it once into a > > kernel_console_font. Wi

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-28 Thread Peilin Ye
On Fri, Sep 25, 2020 at 03:25:51PM +0200, Daniel Vetter wrote: > I think the only way to make this work is that we have one place which > takes in the userspace uapi struct, and then converts it once into a > kernel_console_font. With all the error checking. Ah, I didn't think of that! When trying

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-28 Thread Peilin Ye
Hi all! On Fri, Sep 25, 2020 at 08:46:04AM +0200, Jiri Slaby wrote: > > In order to perform a reliable range check, fbcon_get_font() needs to know > > `FONTDATAMAX` for each built-in font under lib/fonts/. Unfortunately, we > > do not keep that information in our font descriptor, > > `struct conso

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-25 Thread Daniel Vetter
On Fri, Sep 25, 2020 at 06:13:00AM -0400, Peilin Ye wrote: > Hi all! > > On Fri, Sep 25, 2020 at 08:46:04AM +0200, Jiri Slaby wrote: > > > In order to perform a reliable range check, fbcon_get_font() needs to know > > > `FONTDATAMAX` for each built-in font under lib/fonts/. Unfortunately, we > > >

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-25 Thread Daniel Vetter
On Thu, Sep 24, 2020 at 04:09:37PM +0200, Greg Kroah-Hartman wrote: > On Thu, Sep 24, 2020 at 09:38:22AM -0400, Peilin Ye wrote: > > Hi all, > > > > syzbot has reported [1] a global out-of-bounds read issue in > > fbcon_get_font(). A malicious user may resize `vc_font.height` to a large > > value

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-25 Thread Peilin Ye
On Thu, Sep 24, 2020 at 04:09:37PM +0200, Greg Kroah-Hartman wrote: > On Thu, Sep 24, 2020 at 09:38:22AM -0400, Peilin Ye wrote: > > Peilin Ye (3): > > fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h > > Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts > > fbcon: F

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-25 Thread Peilin Ye
On Thu, Sep 24, 2020 at 06:45:16PM +0300, Dan Carpenter wrote: > Smatch has a tool to show where struct members are set. > > `~/smatch/smatch_data/db/smdb.py where console_font height` > > It's not perfect and this output comes from allmodconfig on yesterday's > linux-next. > > regards, > dan ca

RE: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-25 Thread David Laight
> On Thu, Sep 24, 2020 at 09:38:22AM -0400, Peilin Ye wrote: > > Hi all, > > > > syzbot has reported [1] a global out-of-bounds read issue in > > fbcon_get_font(). A malicious user may resize `vc_font.height` to a large > > value in vt_ioctl(), causing fbcon_get_font() to overflow our built-in > >

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-25 Thread Peilin Ye
Hi! On Thu, Sep 24, 2020 at 02:42:18PM +, David Laight wrote: > > On Thu, Sep 24, 2020 at 09:38:22AM -0400, Peilin Ye wrote: > > > Hi all, > > > > > > syzbot has reported [1] a global out-of-bounds read issue in > > > fbcon_get_font(). A malicious user may resize `vc_font.height` to a large >

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-24 Thread Jiri Slaby
On 24. 09. 20, 15:38, Peilin Ye wrote: > Hi all, > > syzbot has reported [1] a global out-of-bounds read issue in > fbcon_get_font(). A malicious user may resize `vc_font.height` to a large > value in vt_ioctl(), causing fbcon_get_font() to overflow our built-in > font data buffers, declared in li

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-24 Thread Dan Carpenter
Smatch has a tool to show where struct members are set. `~/smatch/smatch_data/db/smdb.py where console_font height` It's not perfect and this output comes from allmodconfig on yesterday's linux-next. regards, dan carpenter drivers/video/console/vgacon.c | vgacon_init| (struc

Re: [PATCH 0/3] Prevent out-of-bounds access for built-in font data buffers

2020-09-24 Thread Greg Kroah-Hartman
On Thu, Sep 24, 2020 at 09:38:22AM -0400, Peilin Ye wrote: > Hi all, > > syzbot has reported [1] a global out-of-bounds read issue in > fbcon_get_font(). A malicious user may resize `vc_font.height` to a large > value in vt_ioctl(), causing fbcon_get_font() to overflow our built-in > font data buf