linux-stable.git/drivers/tty/vt, branch v4.4.35

tty: vt, fix bogus division in csi_J

2016-11-10T15:36:37+00:00

commit 42acfc6615f47e465731c263bee0c799edb098f2 upstream.

In csi_J(3), the third parameter of scr_memsetw (vc_screenbuf_size) is
divided by 2 inappropriatelly. But scr_memsetw expects size, not
count, because it divides the size by 2 on its own before doing actual
memset-by-words.

So remove the bogus division.

Signed-off-by: Jiri Slaby 
Cc: Petr Písař 
Fixes: f8df13e0a9 (tty: Clean console safely)
Signed-off-by: Greg Kroah-Hartman

tty: limit terminal size to 4M chars

2016-11-10T15:36:34+00:00

commit 32b2921e6a7461fe63b71217067a6cf4bddb132f upstream.

Size of kmalloc() in vc_do_resize() is controlled by user.
Too large kmalloc() size triggers WARNING message on console.
Put a reasonable upper bound on terminal size to prevent WARNINGs.

Signed-off-by: Dmitry Vyukov 
CC: David Rientjes 
Cc: One Thousand Gnomes 
Cc: Greg Kroah-Hartman 
Cc: Jiri Slaby 
Cc: Peter Hurley 
Cc: linux-kernel@vger.kernel.org
Cc: syzkaller@googlegroups.com
Signed-off-by: Greg Kroah-Hartman

vt: clear selection before resizing

2016-11-10T15:36:34+00:00

commit 009e39ae44f4191188aeb6dfbf661b771dbbe515 upstream.

When resizing a vt its selection may exceed the new size, resulting in
an invalid memory access [1]. Clear the selection before resizing.

[1] http://lkml.kernel.org/r/CACT4Y+acDTwy4umEvf5ROBGiRJNrxHN4Cn5szCXE5Jw-d1B=Xw@mail.gmail.com

Reported-and-tested-by: Dmitry Vyukov 
Signed-off-by: Scot Doyle 
Signed-off-by: Greg Kroah-Hartman

tty/vt/keyboard: fix OOB access in do_compute_shiftstate()

2016-07-27T16:47:37+00:00

commit 510cccb5b0c8868a2b302a0ab524da7912da648b upstream.

The size of individual keymap in drivers/tty/vt/keyboard.c is NR_KEYS,
which is currently 256, whereas number of keys/buttons in input device (and
therefor in key_down) is much larger - KEY_CNT - 768, and that can cause
out-of-bound access when we do

	sym = U(key_maps[0][k]);

with large 'k'.

To fix it we should not attempt iterating beyond smaller of NR_KEYS and
KEY_CNT.

Also while at it let's switch to for_each_set_bit() instead of open-coding
it.

Reported-by: Sasha Levin 
Reviewed-by: Guenter Roeck 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Greg Kroah-Hartman

tty: vt: Fix soft lockup in fbcon cursor blink timer.

2016-07-27T16:47:37+00:00

commit 1b45996d2ebf9680ccd0db875fc668aa025f40fd upstream.

We are getting somewhat random soft lockups with this signature:

[   86.992215] [] el1_irq+0xa0/0x10c
[   86.997082] [] cursor_timer_handler+0x30/0x54
[   87.002991] [] call_timer_fn+0x54/0x1a8
[   87.008378] [] run_timer_softirq+0x1c4/0x2bc
[   87.014200] [] __do_softirq+0x114/0x344
[   87.019590] [] irq_exit+0x74/0x98
[   87.024458] [] __handle_domain_irq+0x98/0xfc
[   87.030278] [] gic_handle_irq+0x94/0x190

This is caused by the vt visual_init() function calling into
fbcon_init() with a vc_cur_blink_ms value of zero.  This is a
transient condition, as it is later set to a non-zero value.  But, if
the timer happens to expire while the blink rate is zero, it goes into
an endless loop, and we get soft lockup.

The fix is to initialize vc_cur_blink_ms before calling the con_init()
function.

Signed-off-by: David Daney 
Acked-by: Pavel Machek 
Tested-by: Ming Lei 
Acked-by: Scot Doyle 
Tested-by: Henrique de Moraes Holschuh 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Greg Kroah-Hartman

tty: vt, return error when con_startup fails

2016-06-01T19:15:52+00:00

commit 6798df4c5fe0a7e6d2065cf79649a794e5ba7114 upstream.

When csw->con_startup() fails in do_register_con_driver, we return no
error (i.e. 0). This was changed back in 2006 by commit 3e795de763.
Before that we used to return -ENODEV.

So fix the return value to be -ENODEV in that case again.

Fixes: 3e795de763 ("VT binding: Add binding/unbinding support for the VT console")
Signed-off-by: Jiri Slaby 
Reported-by: "Dan Carpenter" 
Signed-off-by: Greg Kroah-Hartman

tty: vt: Fix !TASK_RUNNING diagnostic warning from paste_selection()

2015-07-24T01:08:29+00:00

Pasting text with gpm on a VC produced warning [1]. Reset task state
to TASK_RUNNING in the paste_selection() loop, if the loop did not
sleep.

[1]
WARNING: CPU: 6 PID: 1960 at /home/peter/src/kernels/mainline/kernel/sched/core.c:7286 __might_sleep+0x7f/0x90()
do not call blocking ops when !TASK_RUNNING; state=1 set at [] paste_selection+0x9e/0x1a0
Modules linked in: btrfs xor raid6_pq ufs qnx4 hfsplus hfs minix ntfs msdos jfs xfs libcrc32c .....
CPU: 6 PID: 1960 Comm: gpm Not tainted 4.1.0-rc7+tty-xeon+debug #rc7+tty
Hardware name: Dell Inc. Precision WorkStation T5400  /0RW203, BIOS A11 04/30/2012
 ffffffff81c9c0a0 ffff8802b0fd3ac8 ffffffff8185778a 0000000000000001
 ffff8802b0fd3b18 ffff8802b0fd3b08 ffffffff8108039a ffffffff82ae8510
 ffffffff81c9ce00 0000000000000015 0000000000000000 0000000000000000
Call Trace:
 [] dump_stack+0x4f/0x7b
 [] warn_slowpath_common+0x8a/0xc0
 [] warn_slowpath_fmt+0x46/0x50
 [] ? __lock_acquire+0xe2d/0x13a0
 [] ? paste_selection+0x9e/0x1a0
 [] ? paste_selection+0x9e/0x1a0
 [] __might_sleep+0x7f/0x90
 [] down_read+0x2a/0xa0
 [] ? sched_clock_cpu+0xb8/0xe0
 [] n_tty_receive_buf_common+0x4c/0xba0
 [] ? mark_held_locks+0x75/0xa0
 [] ? _raw_spin_unlock_irqrestore+0x65/0x80
 [] ? get_parent_ip+0x11/0x50
 [] n_tty_receive_buf2+0x14/0x20
 [] paste_selection+0x157/0x1a0
 [] ? wake_up_state+0x20/0x20
 [] tioclinux+0xb8/0x2c0
 [] vt_ioctl+0xaee/0x11a0
 [] ? sched_clock_local+0x25/0x90
 [] ? vtime_account_user+0x91/0xa0
 [] tty_ioctl+0x20c/0xe20
 [] ? vtime_account_user+0x91/0xa0
 [] ? get_parent_ip+0x11/0x50
 [] ? preempt_count_sub+0x49/0x50
 [] ? context_tracking_exit+0x5c/0x290
 [] ? context_tracking_exit+0x5c/0x290
 [] do_vfs_ioctl+0x318/0x570
 [] ? trace_hardirqs_on+0xd/0x10
 [] ? trace_hardirqs_on_caller+0x115/0x1e0
 [] ? __fget_light+0x6c/0xa0
 [] SyS_ioctl+0x81/0xa0
 [] system_call_fastpath+0x16/0x7a

Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

tty/vt: Fix the memory leak in visual_init

2015-07-23T22:11:08+00:00

If vc->vc_uni_pagedir_loc is not NULL, its refcount needs to be
decreased before vc_uni_pagedir_loc is re-assigned.

unreferenced object 0xffff88002cdd13b0 (size 512):
  comm "setfont", pid 503, jiffies 4294896503 (age 722.828s)
  hex dump (first 32 bytes):
    40 92 61 2b 00 88 ff ff 00 00 00 00 00 00 00 00  @.a+............
    00 00 00 00 00 00 00 00 a0 ad 61 2b 00 88 ff ff  ..........a+....
  backtrace:
    [] kmemleak_alloc+0x4e/0xb0
    [] kmem_cache_alloc_trace+0x1c8/0x240
    [] con_do_clear_unimap.isra.2+0x83/0xe0
    [] con_clear_unimap+0x22/0x40
    [] vt_ioctl+0xeb8/0x1170
    [] tty_ioctl+0x208/0xca0
    [] do_vfs_ioctl+0x2f8/0x510
    [] SyS_ioctl+0x81/0xa0
    [] system_call_fastpath+0x16/0x75
    [] 0xffffffffffffffff
unreferenced object 0xffff88002b619240 (size 256):
  comm "setfont", pid 503, jiffies 4294896503 (age 722.828s)
  hex dump (first 32 bytes):
    90 bc 84 d5 00 88 ff ff 58 85 84 d5 00 88 ff ff  ........X.......
    88 ac 84 d5 00 88 ff ff e0 b1 84 d5 00 88 ff ff  ................
  backtrace:
    [] kmemleak_alloc+0x4e/0xb0
    [] kmem_cache_alloc_trace+0x1c8/0x240
    [] con_insert_unipair+0x86/0x170
    [] con_set_unimap+0x1b7/0x280
    [] vt_ioctl+0xe65/0x1170
    [] tty_ioctl+0x208/0xca0
    [] do_vfs_ioctl+0x2f8/0x510
    [] SyS_ioctl+0x81/0xa0
    [] system_call_fastpath+0x16/0x75
    [] 0xffffffffffffffff

Signed-off-by: Dongxing Zhang 
Signed-off-by: Xiaoming Wang 
Reviewed-by: Peter Hurley 
Tested-by: Konstantin Khlebnikov 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'tty-4.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2015-06-26T22:53:22+00:00

Pull tty/serial driver updates from Greg KH:
 "Here's the tty and serial driver patches for 4.2-rc1.

  A number of individual driver updates, some code cleanups, and other
  minor things, full details in the shortlog.

  All have been in linux-next for a while with no reported issues"

* tag 'tty-4.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (152 commits)
  Doc: serial-rs485.txt: update RS485 driver interface
  Doc: tty.txt: remove mention of the BKL
  MAINTAINERS: tty: add serial docs directory
  serial: sprd: check for NULL after calling devm_clk_get
  serial: 8250_pci: Correct uartclk for xr17v35x expansion chips
  serial: 8250_pci: Add support for 12 port Exar boards
  serial: 8250_uniphier: add bindings document for UniPhier UART
  serial: core: cleanup in uart_get_baud_rate()
  serial: stm32-usart: Add STM32 USART Driver
  tty/serial: kill off set_irq_flags usage
  tty: move linux/gsmmux.h to uapi
  doc: dt: add documentation for nxp,lpc1850-uart
  serial: 8250: add LPC18xx/43xx UART driver
  serial: 8250_uniphier: add UniPhier serial driver
  serial: 8250_dw: support ACPI platforms with integrated DMA engine
  serial: of_serial: check the return value of clk_prepare_enable()
  serial: of_serial: use devm_clk_get() instead of clk_get()
  serial: earlycon: Add support for big-endian MMIO accesses
  serial: sirf: use hrtimer for data rx
  serial: sirf: correct the fifo empty_bit
  ...

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2015-06-25T02:56:58+00:00

Pull input subsystem updates from Dmitry Torokhov:
 "Thanks to Samuel Thibault input device (keyboard) LEDs are no longer
  hardwired within the input core but use LED subsystem and so allow use
  of different triggers; Hans de Goede did a large update for the ALPS
  touchpad driver; we have new TI drv2665 haptics driver and DA9063
  OnKey driver, and host of other drivers got various fixes"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (55 commits)
  Input: pixcir_i2c_ts - fix receive error
  MAINTAINERS: remove non existent input mt git tree
  Input: improve usage of gpiod API
  tty/vt/keyboard: define LED triggers for VT keyboard lock states
  tty/vt/keyboard: define LED triggers for VT LED states
  Input: export LEDs as class devices in sysfs
  Input: cyttsp4 - use swap() in cyttsp4_get_touch()
  Input: goodix - do not explicitly set evbits in input device
  Input: goodix - export id and version read from device
  Input: goodix - fix variable length array warning
  Input: goodix - fix alignment issues
  Input: add OnKey driver for DA9063 MFD part
  Input: elan_i2c - add product IDs FW names
  Input: elan_i2c - add support for multi IC type and iap format
  Input: focaltech - report finger width to userspace
  tty: remove platform_sysrq_reset_seq
  Input: synaptics_i2c - use proper boolean values
  Input: psmouse - use true instead of 1 for boolean values
  Input: cyapa - fix a few typos in comments
  Input: stmpe-ts - enforce device tree only mode
  ...