kernel/linux.git/drivers/tty/vt, branch v3.18.100

vt: fix unchecked __put_user() in tioclinux ioctls

2017-07-21T06:12:23+00:00

commit 6987dc8a70976561d22450b5858fc9767788cc1c upstream. Only read access is checked before this call. Actually, at the moment this is not an issue, as every in-tree arch does the same manual checks for VERIFY_READ vs VERIFY_WRITE, relying on the MMU to tell them apart, but this wasn't the case in the past and may happen again on some odd arch in the future. If anyone cares about 3.7 and earlier, this is a security hole (untested) on real 80386 CPUs. Signed-off-by: Adam Borowski Signed-off-by: Greg Kroah-Hartman

tty: vt, fix bogus division in csi_J

2017-04-18T05:55:45+00:00

commit 42acfc6615f47e465731c263bee0c799edb098f2 upstream. In csi_J(3), the third parameter of scr_memsetw (vc_screenbuf_size) is divided by 2 inappropriatelly. But scr_memsetw expects size, not count, because it divides the size by 2 on its own before doing actual memset-by-words. So remove the bogus division. Signed-off-by: Jiri Slaby Cc: Petr Písař Fixes: f8df13e0a9 (tty: Clean console safely) Signed-off-by: Greg Kroah-Hartman

vt: clear selection before resizing

2016-11-24T03:49:36+00:00

[ Upstream commit 009e39ae44f4191188aeb6dfbf661b771dbbe515 ] When resizing a vt its selection may exceed the new size, resulting in an invalid memory access [1]. Clear the selection before resizing. [1] http://lkml.kernel.org/r/CACT4Y+acDTwy4umEvf5ROBGiRJNrxHN4Cn5szCXE5Jw-d1B=Xw@mail.gmail.com Reported-and-tested-by: Dmitry Vyukov Signed-off-by: Scot Doyle Cc: stable Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

tty: limit terminal size to 4M chars

2016-11-24T03:49:30+00:00

[ Upstream commit 32b2921e6a7461fe63b71217067a6cf4bddb132f ] Size of kmalloc() in vc_do_resize() is controlled by user. Too large kmalloc() size triggers WARNING message on console. Put a reasonable upper bound on terminal size to prevent WARNINGs. Signed-off-by: Dmitry Vyukov CC: David Rientjes Cc: One Thousand Gnomes Cc: Greg Kroah-Hartman Cc: Jiri Slaby Cc: Peter Hurley Cc: linux-kernel@vger.kernel.org Cc: syzkaller@googlegroups.com Cc: stable Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

tty/vt/keyboard: fix OOB access in do_compute_shiftstate()

2016-08-08T01:58:58+00:00

[ Upstream commit 510cccb5b0c8868a2b302a0ab524da7912da648b ] The size of individual keymap in drivers/tty/vt/keyboard.c is NR_KEYS, which is currently 256, whereas number of keys/buttons in input device (and therefor in key_down) is much larger - KEY_CNT - 768, and that can cause out-of-bound access when we do sym = U(key_maps[0][k]); with large 'k'. To fix it we should not attempt iterating beyond smaller of NR_KEYS and KEY_CNT. Also while at it let's switch to for_each_set_bit() instead of open-coding it. Reported-by: Sasha Levin Reviewed-by: Guenter Roeck Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov Signed-off-by: Sasha Levin

tty: vt, return error when con_startup fails

2016-07-12T12:48:18+00:00

[ Upstream commit 6798df4c5fe0a7e6d2065cf79649a794e5ba7114 ] When csw->con_startup() fails in do_register_con_driver, we return no error (i.e. 0). This was changed back in 2006 by commit 3e795de763. Before that we used to return -ENODEV. So fix the return value to be -ENODEV in that case again. Fixes: 3e795de763 ("VT binding: Add binding/unbinding support for the VT console") Signed-off-by: Jiri Slaby Reported-by: "Dan Carpenter" Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

vt: provide notifications on selection changes

2015-03-06T22:53:00+00:00

commit 19e3ae6b4f07a87822c1c9e7ed99d31860e701af upstream. The vcs device's poll/fasync support relies on the vt notifier to signal changes to the screen content. Notifier invocations were missing for changes that comes through the selection interface though. Fix that. Tested with BRLTTY 5.2. Signed-off-by: Nicolas Pitre Cc: Dave Mielke Signed-off-by: Greg Kroah-Hartman

tty/vt: don't set font mappings on vc not supporting this

2014-11-06T04:12:02+00:00

We can call this function for a dummy console that doesn't support setting the font mapping, which will result in a null ptr BUG. So check for this case and return error for consoles w/o font mapping support. Reference: https://bugzilla.kernel.org/show_bug.cgi?id=59321 Signed-off-by: Imre Deak Cc: stable Signed-off-by: Greg Kroah-Hartman

tty/vt/keyboard: Resolve many shadow warnings

2014-09-08T23:30:43+00:00

Many local variables were given the same name as a global. This is valid, but generates many shadow warnings in W=2 builds. Resolve them by changing the local names. Also change local variables named "up" because they shadow the semaphore "up" function. Also moved the outer declaration of the variable "a" because it is only used in one block, and that resolves all of the shadow warnings for the other declarations of "a" that have different types. Change diacr => dia, kbd => kb, rep => rpt, up => udp. Signed-off-by: Mark Rustad Signed-off-by: Jeff Kirsher Signed-off-by: Greg Kroah-Hartman

Merge tag 'drm-intel-fixes-2014-06-17' of git://anongit.freedesktop.org/drm-intel into drm-next

2014-06-19T00:54:35+00:00

First round of fixes for 3.16-rc, mostly cc: stable, and the vt/vgacon fixes from Daniel [1] to avoid hangs and unclaimed register errors on module load/reload. * tag 'drm-intel-fixes-2014-06-17' of git://anongit.freedesktop.org/drm-intel: drm/i915/bdw: remove erroneous chv specific workarounds from bdw code drm/i915: fix possible refcount leak when resetting forcewake drm/i915: Reorder semaphore deadlock check drm/i95: Initialize active ring->pid to -1 drm/i915: set backlight duty cycle after backlight enable for gen4 drm/i915: Avoid div-by-zero when pixel_multiplier is zero drm/i915: Disable FBC by default also on Haswell and later drm/i915: Kick out vga console drm/i915: Fixup global gtt cleanup vt: Don't ignore unbind errors in vt_unbind vt: Fix up unregistration of vt drivers vt: Fix replacement console check when unbinding