[PATCH] video: fbdev: vga16fb: fix OOB write in vga16fb_imageblit()

[Tetsuo Handa]

On 2021/05/15 5:25, Maciej W. Rozycki wrote:
>  NB for fbcon the usual ioctl to resize the console is FBIOPUT_VSCREENINFO 
> rather than VT_RESIZEX; fbset(8) uses it, and I actually experimented with 
> it and a TGA-like (SFB+) framebuffer when at my lab last time, as Linux is 
> kind enough to know how to fiddle with its clockchip.  It works just fine.

fbcon_update_vcs() from FBIOPUT_VSCREENINFO is no-op if vc->vc_mode != KD_TEXT
(which is equivalent to "if vc->vc_mode == KD_GRAPHICS" because KD_TEXT0/KD_TEXT1
are treated as KD_TEXT). Then, maybe it is OK to let resize_screen() return -EINVAL
in order to make vc_do_resize() request fail if vc->vc_mode == KD_GRAPHICS.

>  Overall I think it does make sense to resize the text console at any 
> time, even if the visible console (VT) chosen is in the graphics mode, as 
> my understanding (and experience at least with vgacon) is that resizing 
> the console applies globally across all the VTs.  So the intent of the 
> original change appears valid to me, and the choice not to reprogram the 
> visible console and only store the settings for a future use if it's in 
> the graphics mode correct.
>
>  Which means any bug triggered here needs to be fixed elsewhere rather 
> than by making the request fail.

Since syzbot does not trigger this problem with Linus's patch, I think we can
try Linus's patch with

  pr_info_once("Resizing text console while in graphical mode is ignored. Please report if you need this.\n");

added in order to see if somebody wants "only store the settings for a future use".