linux-stable.git/drivers/tty/vt, branch v4.1.41

vt: clear selection before resizing

2016-11-24T01:59:49+00:00

[ Upstream commit 009e39ae44f4191188aeb6dfbf661b771dbbe515 ]

When resizing a vt its selection may exceed the new size, resulting in
an invalid memory access [1]. Clear the selection before resizing.

[1] http://lkml.kernel.org/r/CACT4Y+acDTwy4umEvf5ROBGiRJNrxHN4Cn5szCXE5Jw-d1B=Xw@mail.gmail.com

Reported-and-tested-by: Dmitry Vyukov 
Signed-off-by: Scot Doyle 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

tty: limit terminal size to 4M chars

2016-11-24T01:59:49+00:00

[ Upstream commit 32b2921e6a7461fe63b71217067a6cf4bddb132f ]

Size of kmalloc() in vc_do_resize() is controlled by user.
Too large kmalloc() size triggers WARNING message on console.
Put a reasonable upper bound on terminal size to prevent WARNINGs.

Signed-off-by: Dmitry Vyukov 
CC: David Rientjes 
Cc: One Thousand Gnomes 
Cc: Greg Kroah-Hartman 
Cc: Jiri Slaby 
Cc: Peter Hurley 
Cc: linux-kernel@vger.kernel.org
Cc: syzkaller@googlegroups.com
Cc: stable 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

tty/vt/keyboard: fix OOB access in do_compute_shiftstate()

2016-08-06T17:01:07+00:00

[ Upstream commit 510cccb5b0c8868a2b302a0ab524da7912da648b ]

The size of individual keymap in drivers/tty/vt/keyboard.c is NR_KEYS,
which is currently 256, whereas number of keys/buttons in input device (and
therefor in key_down) is much larger - KEY_CNT - 768, and that can cause
out-of-bound access when we do

	sym = U(key_maps[0][k]);

with large 'k'.

To fix it we should not attempt iterating beyond smaller of NR_KEYS and
KEY_CNT.

Also while at it let's switch to for_each_set_bit() instead of open-coding
it.

Reported-by: Sasha Levin 
Reviewed-by: Guenter Roeck 
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sasha Levin

tty: vt, return error when con_startup fails

2016-07-11T03:07:27+00:00

[ Upstream commit 6798df4c5fe0a7e6d2065cf79649a794e5ba7114 ]

When csw->con_startup() fails in do_register_con_driver, we return no
error (i.e. 0). This was changed back in 2006 by commit 3e795de763.
Before that we used to return -ENODEV.

So fix the return value to be -ENODEV in that case again.

Fixes: 3e795de763 ("VT binding: Add binding/unbinding support for the VT console")
Signed-off-by: Jiri Slaby 
Reported-by: "Dan Carpenter" 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

tty: Use static attribute groups for sysfs entries

2015-03-26T15:10:10+00:00

Instead of manual calls of device_create_file() and
device_remove_file(), pass the static attribute groups using
device_create_with_groups().

Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

vt: use msecs_to_jiffies for time conversion

2015-03-07T03:02:26+00:00

Converting milliseconds to jiffies by "val * HZ / 1000" is technically
OK but msecs_to_jiffies(val) is the cleaner solution and handles all
corner cases correctly. This is a minor API consolidation only and
should make things more readable.

Signed-off-by: Nicholas Mc Guire 
Reviewed-by: David Herrmann 
Signed-off-by: Greg Kroah-Hartman

tty: vt/vt: fix sparse warning

2015-03-07T03:02:26+00:00

this patch fixes following sparse warning:
vt.c:1240:12: warning: symbol 'rgb_from_256' was not declared. Should it be static?

Signed-off-by: Lad, Prabhakar 
Signed-off-by: Greg Kroah-Hartman

vt: vt_ioctl: use msecs_to_jiffies for time conversion

2015-03-07T03:02:26+00:00

Converting milliseconds to jiffies by "val * HZ / 1000" is technically
OK but msecs_to_jiffies(val) is the cleaner solution and handles all
corner cases correctly. This is a minor API consolidation only and
should make things more readable.

Signed-off-by: Nicholas Mc Guire 
Signed-off-by: Greg Kroah-Hartman

vt: provide notifications on selection changes

2015-02-02T18:09:54+00:00

The vcs device's poll/fasync support relies on the vt notifier to signal
changes to the screen content.  Notifier invocations were missing for
changes that comes through the selection interface though.  Fix that.

Tested with BRLTTY 5.2.

Signed-off-by: Nicolas Pitre 
Cc: Dave Mielke 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

vt: fix locking around vt_bind/vt_unbind

2015-01-09T22:39:52+00:00

Currently vt_bind and vt_unbind access at least the con_driver object
and registered_con_driver array without holding the console lock. Fix
this by locking around the whole function in each case.

Signed-off-by: Imre Deak 
Reviewed-by: Peter Hurley 
Reviewed-by: Daniel Vetter 
Signed-off-by: Greg Kroah-Hartman