linux-stable.git/drivers/tty/vt, branch v3.18.41

tty/vt/keyboard: fix OOB access in do_compute_shiftstate()

2016-08-08T01:58:58+00:00

[ Upstream commit 510cccb5b0c8868a2b302a0ab524da7912da648b ]

The size of individual keymap in drivers/tty/vt/keyboard.c is NR_KEYS,
which is currently 256, whereas number of keys/buttons in input device (and
therefor in key_down) is much larger - KEY_CNT - 768, and that can cause
out-of-bound access when we do

	sym = U(key_maps[0][k]);

with large 'k'.

To fix it we should not attempt iterating beyond smaller of NR_KEYS and
KEY_CNT.

Also while at it let's switch to for_each_set_bit() instead of open-coding
it.

Reported-by: Sasha Levin 
Reviewed-by: Guenter Roeck 
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

tty: vt, return error when con_startup fails

2016-07-12T12:48:18+00:00

[ Upstream commit 6798df4c5fe0a7e6d2065cf79649a794e5ba7114 ]

When csw->con_startup() fails in do_register_con_driver, we return no
error (i.e. 0). This was changed back in 2006 by commit 3e795de763.
Before that we used to return -ENODEV.

So fix the return value to be -ENODEV in that case again.

Fixes: 3e795de763 ("VT binding: Add binding/unbinding support for the VT console")
Signed-off-by: Jiri Slaby 
Reported-by: "Dan Carpenter" 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

vt: provide notifications on selection changes

2015-03-06T22:53:00+00:00

commit 19e3ae6b4f07a87822c1c9e7ed99d31860e701af upstream.

The vcs device's poll/fasync support relies on the vt notifier to signal
changes to the screen content.  Notifier invocations were missing for
changes that comes through the selection interface though.  Fix that.

Tested with BRLTTY 5.2.

Signed-off-by: Nicolas Pitre 
Cc: Dave Mielke 
Signed-off-by: Greg Kroah-Hartman

tty/vt: don't set font mappings on vc not supporting this

2014-11-06T04:12:02+00:00

We can call this function for a dummy console that doesn't support
setting the font mapping, which will result in a null ptr BUG. So check
for this case and return error for consoles w/o font mapping support.

Reference: https://bugzilla.kernel.org/show_bug.cgi?id=59321
Signed-off-by: Imre Deak 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

tty/vt/keyboard: Resolve many shadow warnings

2014-09-08T23:30:43+00:00

Many local variables were given the same name as a global. This
is valid, but generates many shadow warnings in W=2 builds. Resolve
them by changing the local names. Also change local variables
named "up" because they shadow the semaphore "up" function. Also
moved the outer declaration of the variable "a" because it is
only used in one block, and that resolves all of the shadow warnings
for the other declarations of "a" that have different types.

Change diacr => dia, kbd => kb, rep => rpt, up => udp.

Signed-off-by: Mark Rustad 
Signed-off-by: Jeff Kirsher 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'drm-intel-fixes-2014-06-17' of git://anongit.freedesktop.org/drm-intel into drm-next

2014-06-19T00:54:35+00:00

First round of fixes for 3.16-rc, mostly cc: stable, and the vt/vgacon
fixes from Daniel [1] to avoid hangs and unclaimed register errors on
module load/reload.

* tag 'drm-intel-fixes-2014-06-17' of git://anongit.freedesktop.org/drm-intel:
  drm/i915/bdw: remove erroneous chv specific workarounds from bdw code
  drm/i915: fix possible refcount leak when resetting forcewake
  drm/i915: Reorder semaphore deadlock check
  drm/i95: Initialize active ring->pid to -1
  drm/i915: set backlight duty cycle after backlight enable for gen4
  drm/i915: Avoid div-by-zero when pixel_multiplier is zero
  drm/i915: Disable FBC by default also on Haswell and later
  drm/i915: Kick out vga console
  drm/i915: Fixup global gtt cleanup
  vt: Don't ignore unbind errors in vt_unbind
  vt: Fix up unregistration of vt drivers
  vt: Fix replacement console check when unbinding

vt: Don't ignore unbind errors in vt_unbind

2014-06-06T20:19:47+00:00

Otherwise the loop will never stop since we don't make any
forward progress. Noticed while breaking this accidentally
in a painful attempt to make vga_con unregistering work.

With this patch we'll bail out on the first attempt, which
at least leaves a useful enough system behind for debugging.
Livelocks on console_lock just aren't fun.

Cc: Greg Kroah-Hartman 
Cc: Jiri Slaby 
Reviewed-by: David Herrmann 
Acked-by: Greg Kroah-Hartman 
Signed-off-by: Daniel Vetter

vt: Fix up unregistration of vt drivers

2014-06-06T20:19:32+00:00

A bunch of issues:
- We should not kick out the default console (which is tracked in
  conswitchp), so check for that.
- Add better error codes so callers can differentiate between "something
  went wrong" and "your driver isn't registered already". i915 needs
  that so it doesn't fall over when reloading the driver and hence
  vga_con is already unregistered.
- There's a mess with the driver flags: What we need to check for is
  that the driver isn't used any more, i.e. unbound completely (FLAG_INIT).
  And not whether it's the boot console or not (which is the only one
  which doesn't have FLAG_MODULE). Otherwise there's no way to kick
  out the boot console, which i915 wants to do to prevent havoc with
  vga_con interferring (which tends to hang machines).

Cc: Greg Kroah-Hartman 
Cc: Jiri Slaby 
Reviewed-by: David Herrmann 
Acked-by: Greg Kroah-Hartman 
Signed-off-by: Daniel Vetter

vt: Fix replacement console check when unbinding

2014-06-06T20:18:25+00:00

I don't fully understand the magic of the vt register/unregister
logic, but apparently everything but the inital console (as set
in the conswitchp pointer) is marked with FLAG_MODULE. Which means
if something unregistered the boot vt driver (e.g. i915.ko kicking
out vga_con) there's nothing left when trying to unbind e.g. fbcon
through sysfs.

But in most cases have the dummy console hanging around besides the
boot console, so this test is fairly dubious. What we actually want is
simply a different console than the one we want to unbind.

v2: Correct the commit message to clarify that the dummy console isn't
always around, but only in most cases (David).

Cc: Greg Kroah-Hartman 
Cc: Jiri Slaby 
Cc: David Herrmann 
Reviewed-by: David Herrmann 
Acked-by: Greg Kroah-Hartman 
Signed-off-by: Daniel Vetter

console: Remove superfluous readonly check

2014-05-28T20:37:21+00:00

uni_pagedir.readonly is never set.  Let's get rid of superfluous check
codes.

Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman