Skip to content

Commit 6c84a61

Browse files
David Laightgregkh
authored andcommitted
drivers/tty/vt: use umin() instead of min_t(u16, ...) for row/col limits
The row/column bounds (for a screen window box) are changed from 'offset one' to 'offset zero' and bound to the screen size using: v->xs = min_t(u16, v->xs - 1, vc->vc_cols - 1); This has the side effect of converting zero to the limit. A check I'm adding to min_t() reports that (u16)(v->xs - 1) (etc) discards signiticant bits (because v->xs is promoted to 'int' before the addition). If v->xs is zero (it comes from userspace) it converts -1 to 0xffff. This is then bounded to 'vc->vc_cols - 1' which will be fine. Replace with: v->xs = umin(v->xs - 1, vc->vc_cols - 1); which again converts a -1 to unsigned - this time to 0xffffffff, with the same overall effect. Whether zero is meant to mean the 'maximum size' is unknown. I can't find any documentation for the ioctl and it pre-dates git. Detected by an extra check added to min_t(). Signed-off-by: David Laight <david.laight.linux@gmail.com> Reviewed-by: Jiri Slaby <jirislaby@kernel.org> Link: https://patch.msgid.link/20251119224140.8616-28-david.laight.linux@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 719f3df commit 6c84a61

1 file changed

Lines changed: 5 additions & 4 deletions

File tree

drivers/tty/vt/selection.c

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -348,10 +348,11 @@ static int vc_selection(struct vc_data *vc, struct tiocl_selection *v,
348348
return 0;
349349
}
350350

351-
v->xs = min_t(u16, v->xs - 1, vc->vc_cols - 1);
352-
v->ys = min_t(u16, v->ys - 1, vc->vc_rows - 1);
353-
v->xe = min_t(u16, v->xe - 1, vc->vc_cols - 1);
354-
v->ye = min_t(u16, v->ye - 1, vc->vc_rows - 1);
351+
/* Historically 0 => max value */
352+
v->xs = umin(v->xs - 1, vc->vc_cols - 1);
353+
v->ys = umin(v->ys - 1, vc->vc_rows - 1);
354+
v->xe = umin(v->xe - 1, vc->vc_cols - 1);
355+
v->ye = umin(v->ye - 1, vc->vc_rows - 1);
355356

356357
if (mouse_reporting() && (v->sel_mode & TIOCL_SELMOUSEREPORT)) {
357358
mouse_report(tty, v->sel_mode & TIOCL_SELBUTTONMASK, v->xs,

0 commit comments

Comments
 (0)