linux-stable.git/drivers/tty/vt, branch linux-3.10.y

vt: fix unchecked __put_user() in tioclinux ioctls

2017-11-01T21:12:43+00:00

commit 6987dc8a70976561d22450b5858fc9767788cc1c upstream.

Only read access is checked before this call.

Actually, at the moment this is not an issue, as every in-tree arch does
the same manual checks for VERIFY_READ vs VERIFY_WRITE, relying on the MMU
to tell them apart, but this wasn't the case in the past and may happen
again on some odd arch in the future.

If anyone cares about 3.7 and earlier, this is a security hole (untested)
on real 80386 CPUs.

Signed-off-by: Adam Borowski 
CC: stable@vger.kernel.org # v3.7-
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Willy Tarreau

vt: clear selection before resizing

2017-02-10T10:03:41+00:00

commit 009e39ae44f4191188aeb6dfbf661b771dbbe515 upstream.

When resizing a vt its selection may exceed the new size, resulting in
an invalid memory access [1]. Clear the selection before resizing.

[1] http://lkml.kernel.org/r/CACT4Y+acDTwy4umEvf5ROBGiRJNrxHN4Cn5szCXE5Jw-d1B=Xw@mail.gmail.com

Reported-and-tested-by: Dmitry Vyukov 
Signed-off-by: Scot Doyle 
Signed-off-by: Willy Tarreau

tty: vt, fix bogus division in csi_J

2017-02-10T10:03:40+00:00

commit 42acfc6615f47e465731c263bee0c799edb098f2 upstream.

In csi_J(3), the third parameter of scr_memsetw (vc_screenbuf_size) is
divided by 2 inappropriatelly. But scr_memsetw expects size, not
count, because it divides the size by 2 on its own before doing actual
memset-by-words.

So remove the bogus division.

Signed-off-by: Jiri Slaby 
Cc: Petr PÃsaÅ 
Fixes: f8df13e0a9 (tty: Clean console safely)
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Willy Tarreau

tty: limit terminal size to 4M chars

2017-02-10T10:03:40+00:00

commit 32b2921e6a7461fe63b71217067a6cf4bddb132f upstream.

Size of kmalloc() in vc_do_resize() is controlled by user.
Too large kmalloc() size triggers WARNING message on console.
Put a reasonable upper bound on terminal size to prevent WARNINGs.

Signed-off-by: Dmitry Vyukov 
CC: David Rientjes 
Cc: One Thousand Gnomes 
Cc: Greg Kroah-Hartman 
Cc: Jiri Slaby 
Cc: Peter Hurley 
Cc: linux-kernel@vger.kernel.org
Cc: syzkaller@googlegroups.com
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Willy Tarreau

tty/vt/keyboard: fix OOB access in do_compute_shiftstate()

2016-08-27T09:40:26+00:00

commit 510cccb5b0c8868a2b302a0ab524da7912da648b upstream.

The size of individual keymap in drivers/tty/vt/keyboard.c is NR_KEYS,
which is currently 256, whereas number of keys/buttons in input device (and
therefor in key_down) is much larger - KEY_CNT - 768, and that can cause
out-of-bound access when we do

	sym = U(key_maps[0][k]);

with large 'k'.

To fix it we should not attempt iterating beyond smaller of NR_KEYS and
KEY_CNT.

Also while at it let's switch to for_each_set_bit() instead of open-coding
it.

Reported-by: Sasha Levin 
Reviewed-by: Guenter Roeck 
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Willy Tarreau

tty: vt, return error when con_startup fails

2016-06-07T08:42:55+00:00

commit 6798df4c5fe0a7e6d2065cf79649a794e5ba7114 upstream.

When csw->con_startup() fails in do_register_con_driver, we return no
error (i.e. 0). This was changed back in 2006 by commit 3e795de763.
Before that we used to return -ENODEV.

So fix the return value to be -ENODEV in that case again.

Fixes: 3e795de763 ("VT binding: Add binding/unbinding support for the VT console")
Signed-off-by: Jiri Slaby 
Reported-by: "Dan Carpenter" 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Willy Tarreau

vt: provide notifications on selection changes

2015-03-06T22:40:51+00:00

commit 19e3ae6b4f07a87822c1c9e7ed99d31860e701af upstream.

The vcs device's poll/fasync support relies on the vt notifier to signal
changes to the screen content.  Notifier invocations were missing for
changes that comes through the selection interface though.  Fix that.

Tested with BRLTTY 5.2.

Signed-off-by: Nicolas Pitre 
Cc: Dave Mielke 
Signed-off-by: Greg Kroah-Hartman

vt: Fix secure clear screen

2014-02-22T20:41:27+00:00

commit 0930b0950a8996aa88b0d2ba4bb2bab27cc36bc7 upstream.

\E[3J console code (secure clear screen) needs to update_screen(vc)
in order to write-through blanks into off-screen video memory.

This has been removed accidentally in 3.6 by:

commit 81732c3b2fede049a692e58a7ceabb6d18ffb18c
Author: Jean-François Moine 
Date:   Thu Sep 6 19:24:13 2012 +0200

    tty vt: Fix line garbage in virtual console on command line edition

Signed-off-by: Petr Písař 
Signed-off-by: Greg Kroah-Hartman

tty/vt: Return EBUSY if deallocating VT1 and it is busy

2013-06-17T19:37:29+00:00

Commit 421b40a6286e ("tty/vt: Fix vc_deallocate() lock order") changed
the behavior when deallocating VT 1.  Previously if trying to
deallocate VT1 and it is busy, we would return EBUSY.  The commit
changed this to return 0 (success).

This commit restores the old behavior.

Signed-off-by: Ross Lagerwall 
Tested-by: Mikael Pettersson 
Acked-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

tty/vt: Fix vc_deallocate() lock order

2013-05-20T19:15:59+00:00

Now that the tty port owns the flip buffers and i/o is allowed
from the driver even when no tty is attached, the destruction
of the tty port (and the flip buffers) must ensure that no
outstanding work is pending.

Unfortunately, this creates a lock order problem with the
console_lock (see attached lockdep report [1] below).

For single console deallocation, drop the console_lock prior
to port destruction. When multiple console deallocation,
defer port destruction until the consoles have been
deallocated.

tty_port_destroy() is not required if the port has not
been used; remove from vc_allocate() failure path.

[1] lockdep report from Dave Jones 

 ======================================================
 [ INFO: possible circular locking dependency detected ]
 3.9.0+ #16 Not tainted
 -------------------------------------------------------
 (agetty)/26163 is trying to acquire lock:
 blocked:  ((&buf->work)){+.+...}, instance: ffff88011c8b0020, at: [] flush_work+0x5/0x2e0

 but task is already holding lock:
 blocked:  (console_lock){+.+.+.}, instance: ffffffff81c2fde0, at: [] vt_ioctl+0xb61/0x1230

 which lock already depends on the new lock.

 the existing dependency chain (in reverse order) is:

 -> #1 (console_lock){+.+.+.}:
        [] lock_acquire+0xa4/0x210
        [] console_lock+0x77/0x80
        [] con_flush_chars+0x2d/0x50
        [] n_tty_receive_buf+0x122/0x14d0
        [] flush_to_ldisc+0x119/0x170
        [] process_one_work+0x211/0x700
        [] worker_thread+0x11b/0x3a0
        [] kthread+0xed/0x100
        [] ret_from_fork+0x7c/0xb0

 -> #0 ((&buf->work)){+.+...}:
        [] __lock_acquire+0x193a/0x1c00
        [] lock_acquire+0xa4/0x210
        [] flush_work+0x4e/0x2e0
        [] __cancel_work_timer+0x95/0x130
        [] cancel_work_sync+0x10/0x20
        [] tty_port_destroy+0x12/0x20
        [] vc_deallocate+0xf8/0x110
        [] vt_ioctl+0xb6c/0x1230
        [] tty_ioctl+0x285/0xd50
        [] do_vfs_ioctl+0x305/0x530
        [] sys_ioctl+0x81/0xa0
        [] system_call_fastpath+0x16/0x1b

 other info that might help us debug this:

 [ 6760.076175]  Possible unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
   lock(console_lock);
                                lock((&buf->work));
                                lock(console_lock);
   lock((&buf->work));

  *** DEADLOCK ***

 1 lock on stack by (agetty)/26163:
  #0: blocked:  (console_lock){+.+.+.}, instance: ffffffff81c2fde0, at: [] vt_ioctl+0xb61/0x1230
 stack backtrace:
 Pid: 26163, comm: (agetty) Not tainted 3.9.0+ #16
 Call Trace:
  [] print_circular_bug+0x200/0x20e
  [] __lock_acquire+0x193a/0x1c00
  [] ? sched_clock+0x9/0x10
  [] ? sched_clock+0x9/0x10
  [] ? native_sched_clock+0x20/0x80
  [] lock_acquire+0xa4/0x210
  [] ? flush_work+0x5/0x2e0
  [] flush_work+0x4e/0x2e0
  [] ? flush_work+0x5/0x2e0
  [] ? mark_held_locks+0xbb/0x140
  [] ? __free_pages_ok.part.57+0x93/0xc0
  [] ? mark_held_locks+0xbb/0x140
  [] ? __cancel_work_timer+0x82/0x130
  [] __cancel_work_timer+0x95/0x130
  [] cancel_work_sync+0x10/0x20
  [] tty_port_destroy+0x12/0x20
  [] vc_deallocate+0xf8/0x110
  [] vt_ioctl+0xb6c/0x1230
  [] ? lock_release_holdtime.part.30+0xa1/0x170
  [] tty_ioctl+0x285/0xd50
  [] ? inode_has_perm.isra.46.constprop.61+0x56/0x80
  [] do_vfs_ioctl+0x305/0x530
  [] ? selinux_file_ioctl+0x5b/0x110
  [] sys_ioctl+0x81/0xa0
  [] system_call_fastpath+0x16/0x1b

Cc: Dave Jones 
Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman