linux-stable.git/drivers/tty/vt, branch linux-4.6.y

tty/vt/keyboard: fix OOB access in do_compute_shiftstate()

2016-07-27T15:42:21+00:00

commit 510cccb5b0c8868a2b302a0ab524da7912da648b upstream.

The size of individual keymap in drivers/tty/vt/keyboard.c is NR_KEYS,
which is currently 256, whereas number of keys/buttons in input device (and
therefor in key_down) is much larger - KEY_CNT - 768, and that can cause
out-of-bound access when we do

	sym = U(key_maps[0][k]);

with large 'k'.

To fix it we should not attempt iterating beyond smaller of NR_KEYS and
KEY_CNT.

Also while at it let's switch to for_each_set_bit() instead of open-coding
it.

Reported-by: Sasha Levin 
Reviewed-by: Guenter Roeck 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Greg Kroah-Hartman

tty: vt: Fix soft lockup in fbcon cursor blink timer.

2016-07-27T15:42:21+00:00

commit 1b45996d2ebf9680ccd0db875fc668aa025f40fd upstream.

We are getting somewhat random soft lockups with this signature:

[   86.992215] [] el1_irq+0xa0/0x10c
[   86.997082] [] cursor_timer_handler+0x30/0x54
[   87.002991] [] call_timer_fn+0x54/0x1a8
[   87.008378] [] run_timer_softirq+0x1c4/0x2bc
[   87.014200] [] __do_softirq+0x114/0x344
[   87.019590] [] irq_exit+0x74/0x98
[   87.024458] [] __handle_domain_irq+0x98/0xfc
[   87.030278] [] gic_handle_irq+0x94/0x190

This is caused by the vt visual_init() function calling into
fbcon_init() with a vc_cur_blink_ms value of zero.  This is a
transient condition, as it is later set to a non-zero value.  But, if
the timer happens to expire while the blink rate is zero, it goes into
an endless loop, and we get soft lockup.

The fix is to initialize vc_cur_blink_ms before calling the con_init()
function.

Signed-off-by: David Daney 
Acked-by: Pavel Machek 
Tested-by: Ming Lei 
Acked-by: Scot Doyle 
Tested-by: Henrique de Moraes Holschuh 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Greg Kroah-Hartman

tty: vt, return error when con_startup fails

2016-06-01T19:18:03+00:00

commit 6798df4c5fe0a7e6d2065cf79649a794e5ba7114 upstream.

When csw->con_startup() fails in do_register_con_driver, we return no
error (i.e. 0). This was changed back in 2006 by commit 3e795de763.
Before that we used to return -ENODEV.

So fix the return value to be -ENODEV in that case again.

Fixes: 3e795de763 ("VT binding: Add binding/unbinding support for the VT console")
Signed-off-by: Jiri Slaby 
Reported-by: "Dan Carpenter" 
Signed-off-by: Greg Kroah-Hartman

tty: vt: initialize softcursor_original correctly

2016-02-07T07:42:25+00:00

add_softcursor() stores the contents of the text buffer position in this
variable before drawing the softcursor, whereas hide_softcursor() writes
the value back. A value of -1 means that no cursor has been drawn and
therefore no character is to be restored. softcursor_original, however,
is only implicitly initialized with 0. Therefore, when hide_softcursor
is called for the first time (console_init -> con_init -> redraw_screen
-> hide_cursor), it wrongly writes 0x0000 in the top left corner of
the text buffer. Normally, this is just as black as the rest of the
screen (vc_video_erase_char) and can't be seen, but it appears as a
black cursor rectangle on non-black backgrounds e.g. with boot option
"vt.global_cursor_default=0 vt.color=0xf0". softcursor_original needs
to be initialized with -1.

Signed-off-by: Melchior FRANZ 
Signed-off-by: Greg Kroah-Hartman

tty/vt/keyboard: use memdup_user to simplify code

2016-02-07T07:27:46+00:00

use memdup_user rather than duplicating implementation.
found by coccinelle

Signed-off-by: Saurabh Sengar 
Signed-off-by: Greg Kroah-Hartman

Merge 4.5-rc2 into tty-next

2016-02-01T20:53:14+00:00

We want the tty/serial fixes in here as well to make merges easier.

Signed-off-by: Greg Kroah-Hartman

Merge tag 'staging-4.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

2016-02-01T01:00:27+00:00

Pull staging fixes from Greg KH:
 "Here are some small staging driver fixes for 4.5-rc2.

  One of them predated 4.4-final, but I missed that merge window due to
  the holliday.  The others fix reported issues that have come up
  recently.  The tty change is needed for the speakup driver fix and has
  the ack of the tty driver maintainer as well, i.e.  myself :)

  All have been in linux-next with no reported issues"

* tag 'staging-4.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  Staging: speakup: fix read scrolled-back VT
  Staging: speakup: Fix getting port information
  Revert "Staging: panel: usleep_range is preferred over udelay"
  iio: adis_buffer: Fix out-of-bounds memory access

Staging: speakup: fix read scrolled-back VT

2016-01-29T06:55:40+00:00

Previously, speakup would always read the non-scrolled part of the VT,
even when the VT is scrolled back with shift-page.  This patch makes
vt.c export screen_pos so that speakup can use it to properly access
the content of the scrolled-back VT.

This was tested with both vgacon and fbcon.

Signed-off-by: Samuel Thibault 
Reviewed-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

tty: Prepare for destroying line discipline on hangup

2016-01-27T23:01:44+00:00

tty file_operations (read/write/ioctl) wait for the ldisc reference
indefinitely (until ldisc lifetime events, such as hangup or TIOCSETD,
finish). Since hangup now destroys the ldisc and does not instance
another copy, file_operations must now be prepared to receive a NULL
ldisc reference from tty_ldisc_ref_wait():

CPU 0                                   CPU 1
-----                                   -----
(*f_op->read)() => tty_read()
                                        __tty_hangup()
                                        ...
                                        f_op = &hung_up_tty_fops;
                                        ...
                                        tty_ldisc_hangup()
                                           tty_ldisc_lock()
                                           tty_ldisc_kill()
                                              tty->ldisc = NULL
                                           tty_ldisc_unlock()
ld = tty_ldisc_ref_wait()
/* ld == NULL */

Instead, the action taken now is to return the same value as if the
tty had been hungup a moment earlier:

CPU 0                                   CPU 1
-----                                   -----
                                        __tty_hangup()
                                        ...
                                        f_op = &hung_up_tty_fops;
(*f_op->read)() => hung_up_tty_read()
return 0;
                                        ...
                                        tty_ldisc_hangup()
                                           tty_ldisc_lock()
                                           tty_ldisc_kill()
                                              tty->ldisc = NULL
                                           tty_ldisc_unlock()

Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

vt: Deinline save_screen, save 238 bytes

2015-12-14T03:59:48+00:00

This function compiles to 79 bytes of machine code.

Signed-off-by: Denys Vlasenko 
CC: Jiri Slaby 
CC: linux-serial@vger.kernel.org
Reviewed-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman