linux-stable.git/drivers/tty/vt, branch v3.12.64

tty/vt/keyboard: fix OOB access in do_compute_shiftstate()

2016-08-19T07:50:49+00:00

commit 510cccb5b0c8868a2b302a0ab524da7912da648b upstream.

The size of individual keymap in drivers/tty/vt/keyboard.c is NR_KEYS,
which is currently 256, whereas number of keys/buttons in input device (and
therefor in key_down) is much larger - KEY_CNT - 768, and that can cause
out-of-bound access when we do

	sym = U(key_maps[0][k]);

with large 'k'.

To fix it we should not attempt iterating beyond smaller of NR_KEYS and
KEY_CNT.

Also while at it let's switch to for_each_set_bit() instead of open-coding
it.

Reported-by: Sasha Levin 
Reviewed-by: Guenter Roeck 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Jiri Slaby

tty: vt, return error when con_startup fails

2016-06-15T07:32:08+00:00

commit 6798df4c5fe0a7e6d2065cf79649a794e5ba7114 upstream.

When csw->con_startup() fails in do_register_con_driver, we return no
error (i.e. 0). This was changed back in 2006 by commit 3e795de763.
Before that we used to return -ENODEV.

So fix the return value to be -ENODEV in that case again.

Fixes: 3e795de763 ("VT binding: Add binding/unbinding support for the VT console")
Signed-off-by: Jiri Slaby 
Reported-by: "Dan Carpenter" 
Signed-off-by: Jiri Slaby

tty/vt: don't set font mappings on vc not supporting this

2015-09-30T09:00:00+00:00

commit 9e326f78713a4421fe11afc2ddeac07698fac131 upstream.

We can call this function for a dummy console that doesn't support
setting the font mapping, which will result in a null ptr BUG. So check
for this case and return error for consoles w/o font mapping support.

Reference: https://bugzilla.kernel.org/show_bug.cgi?id=59321
Signed-off-by: Imre Deak 
Signed-off-by: Sudip Mukherjee 
Signed-off-by: Jiri Slaby

vt: provide notifications on selection changes

2015-03-01T22:34:21+00:00

commit 19e3ae6b4f07a87822c1c9e7ed99d31860e701af upstream.

The vcs device's poll/fasync support relies on the vt notifier to signal
changes to the screen content.  Notifier invocations were missing for
changes that comes through the selection interface though.  Fix that.

Tested with BRLTTY 5.2.

Signed-off-by: Nicolas Pitre 
Cc: Dave Mielke 
Signed-off-by: Jiri Slaby

vt: Fix secure clear screen

2014-02-22T21:32:26+00:00

commit 0930b0950a8996aa88b0d2ba4bb2bab27cc36bc7 upstream.

\E[3J console code (secure clear screen) needs to update_screen(vc)
in order to write-through blanks into off-screen video memory.

This has been removed accidentally in 3.6 by:

commit 81732c3b2fede049a692e58a7ceabb6d18ffb18c
Author: Jean-François Moine 
Date:   Thu Sep 6 19:24:13 2012 +0200

    tty vt: Fix line garbage in virtual console on command line edition

Signed-off-by: Petr Písař 
Signed-off-by: Greg Kroah-Hartman

vt: make the default color configurable

2013-08-05T07:06:46+00:00

The virtual console has (undocumented) module parameters to set the
colors for italic and underlined text, but the default text color was
hardcoded for some reason.  This made it impossible to change the color
for startup messages, or to set the default for new virtual consoles.
Add a module parameter for that, and document the entire bunch.

Any hacker who thinks that a command prompt on a "black screen with
white font" is not supicious enough can now use the kernel parameter
vt.color=10 to get a nice, evil green.

Signed-off-by: Clemens Ladisch 
Signed-off-by: Greg Kroah-Hartman

tty: Remove dead code

2013-07-26T23:19:48+00:00

-> The ledptrs[] array is never initialized.
-> There is no place where kbd->ledmode is set to LED_SHOW_MEM therefore the if
   statement does not make much sense.
-> Since LED_SHOW_MEM is not used, it can be removed from the header file as well.

Signed-off-by: Andreas Platschek 
Signed-off-by: Greg Kroah-Hartman

tty: Fix unsafe vt paste_selection()

2013-07-23T23:47:10+00:00

Convert the tty_buffer_flush() exclusion mechanism to a
public interface - tty_buffer_lock/unlock_exclusive() - and use
the interface to safely write the paste selection to the line
discipline.

Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

tty: Convert termios_mutex to termios_rwsem

2013-07-23T23:43:01+00:00

termios is commonly accessed unsafely (especially by N_TTY)
because the existing mutex forces exclusive access.
Convert existing usage.

Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

tty: Make ldisc input flow control concurrency-friendly

2013-07-23T23:42:59+00:00

Although line discipline receiving is single-producer/single-consumer,
using tty->receive_room to manage flow control creates unnecessary
critical regions requiring additional lock use.

Instead, introduce the optional .receive_buf2() ldisc method which
returns the # of bytes actually received. Serialization is guaranteed
by the caller.

In turn, the line discipline should schedule the buffer work item
whenever space becomes available; ie., when there is room to receive
data and receive_room() previously returned 0 (the buffer work
item stops processing if receive_buf2() returns 0). Note the
'no room' state need not be atomic despite concurrent use by two
threads because only the buffer work thread can set the state and
only the read() thread can clear the state.

Add n_tty_receive_buf2() as the receive_buf2() method for N_TTY.
Provide a public helper function, tty_ldisc_receive_buf(), to use
when directly accessing the receive_buf() methods.

Line disciplines not using input flow control can continue to set
tty->receive_room to a fixed value and only provide the receive_buf()
method.

Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman