linux-kernel - Re: Text mode VGA-console scrolling is broken in upstream & stable trees

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a1d0172f-5f3c-4f3e-9362-d9de0192e8b2@kernel.org>
Date: Thu, 31 Jul 2025 09:22:31 +0200
From: Jiri Slaby <jirislaby@...nel.org>
To: Jari Ruusu <jariruusu@...tonmail.com>, Yi Yang <yiyang13@...wei.com>,
 GONG Ruiqi <gongruiqi1@...wei.com>, Helge Deller <deller@....de>,
 Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
 Sasha Levin <sashal@...nel.org>,
 Linus Torvalds <torvalds@...ux-foundation.org>
Cc: "stable@...r.kernel.org" <stable@...r.kernel.org>,
 "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: Text mode VGA-console scrolling is broken in upstream & stable
 trees

On 30. 07. 25, 16:06, Jari Ruusu wrote:
> The patch that broke text mode VGA-console scrolling is this one:
> "vgacon: Add check for vc_origin address range in vgacon_scroll()"
> commit 864f9963ec6b4b76d104d595ba28110b87158003 upstream.
> 
> How to preproduce:
> (1) boot a kernel that is configured to use text mode VGA-console
> (2) type commands:  ls -l /usr/bin | less -S
> (3) scroll up/down with cursor-down/up keys
> 
> Above mentioned patch seems to have landed in upstream and all
> kernel.org stable trees with zero testing. Even minimal testing
> would have shown that it breaks text mode VGA-console scrolling.

At the time this was posted (privately and on security@), I commented:

=====

 > --- a/drivers/video/console/vgacon.c
 > +++ b/drivers/video/console/vgacon.c
 > @@ -1168,7 +1168,7 @@ static bool vgacon_scroll(struct vc_data *c, 
unsigned int t, unsigned int b,
 >                                    c->vc_screenbuf_size - delta);
 >                       c->vc_origin = vga_vram_end - c->vc_screenbuf_size;
 >                       vga_rolled_over = 0;
 > -             } else
 > +             } else if (oldo - delta >= (unsigned long)c->vc_screenbuf)
 >                       c->vc_origin -= delta;

IMO you should also add:
    else
      c->vc_origin = c->vc_screenbuf;

Or clamp 'delta' beforehand and don't add the 'if'.

=====

That did not happen, AFAICS. Care to test the above suggestion?

thanks,
-- 
js
suse labs