Commit 52553ef9 authored by Nicolas Pitre's avatar Nicolas Pitre Committed by Xiang Yang
Browse files

vt: fix unicode buffer corruption when deleting characters 

stable inclusion
from stable-v5.10.215
commit 1ce408f75ccf1e25b3fddef75cca878b55f2ac90
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q994
CVE: CVE-2024-35823

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1ce408f75ccf1e25b3fddef75cca878b55f2ac90



--------------------------------

commit 1581dafaf0d34bc9c428a794a22110d7046d186d upstream.

This is the same issue that was fixed for the VGA text buffer in commit
39cdb68c ("vt: fix memory overlapping when deleting chars in the
buffer"). The cure is also the same i.e. replace memcpy() with memmove()
due to the overlaping buffers.

Signed-off-by: default avatarNicolas Pitre <nico@fluxnic.net>
Fixes: 81732c3b ("tty vt: Fix line garbage in virtual console on command line edition")
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/sn184on2-3p0q-0qrq-0218-895349s4753o@syhkavp.arg


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarXiang Yang <xiangyang3@huawei.com>
parent db8faa59

drivers/tty/vt/vt.c

+1 −1
Original line number Diff line number Diff line
@@ -398,7 +398,7 @@ static void vc_uniscr_delete(struct vc_data *vc, unsigned int nr) 
		char32_t *ln = uniscr->lines[vc->state.y];

		unsigned int x = vc->state.x, cols = vc->vc_cols;



		memcpy(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln));

		memmove(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln));

		memset32(&ln[cols - nr], ' ', nr);

	}

}