Re: [PATCH] fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.

On 2020/07/15 2:15, George Kennedy wrote: > Can you try the a.out built from the original Syzkaller modified repro C > program? It walks 0-7 through xres and yres of the fb_var_screeninfo struct. I'm not familiar with exploit code. What do you want to explain via this program? > struct fb_var

Re: [PATCH] fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.

On 2020/07/14 19:27, Tetsuo Handa wrote: > On 2020/07/14 16:22, Bartlomiej Zolnierkiewicz wrote: >> How does this patch relate to: >> >> https://marc.info/?l=linux-fbdev&m=159415024816722&w=2 >> >> ? >> >> It seems to address the same issue, I've added George and Dan to Cc:. > > George Kenned

Re: [PATCH] fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.

On 2020/07/14 16:22, Bartlomiej Zolnierkiewicz wrote: > How does this patch relate to: > > https://marc.info/?l=linux-fbdev&m=159415024816722&w=2 > > ? > > It seems to address the same issue, I've added George and Dan to Cc:. George Kennedy's patch does not help for my case. You can try

Re: [PATCH] fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.

[ Please Cc: fbdev Maintainer (happens to be me :) on fbdev patches, thanks. ] Hi, On 7/12/20 1:10 PM, Tetsuo Handa wrote: > I found that > > const int fd = open("/dev/fb0", O_ACCMODE); > struct fb_var_screeninfo var = { }; > ioctl(fd, FBIOGET_VSCREENINFO, &var); > var.xres = var.yres

[PATCH] fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.

I found that const int fd = open("/dev/fb0", O_ACCMODE); struct fb_var_screeninfo var = { }; ioctl(fd, FBIOGET_VSCREENINFO, &var); var.xres = var.yres = 1; ioctl(fd, FBIOPUT_VSCREENINFO, &var); causes general protection fault in bitfill_aligned(), for vc_do_resize() updates vc->vc_{cols