kernel/linux.git/drivers/video/console, branch v5.10.78

vt: Fix character height handling with VT_RESIZEX

2021-05-26T10:06:56+00:00

commit 860dafa902595fb5f1d23bbcce1215188c3341e6 upstream. Restore the original intent of the VT_RESIZEX ioctl's `v_clin' parameter which is the number of pixel rows per character (cell) rather than the height of the font used. For framebuffer devices the two values are always the same, because the former is inferred from the latter one. For VGA used as a true text mode device these two parameters are independent from each other: the number of pixel rows per character is set in the CRT controller, while font height is in fact hardwired to 32 pixel rows and fonts of heights below that value are handled by padding their data with blanks when loaded to hardware for use by the character generator. One can change the setting in the CRT controller and it will update the screen contents accordingly regardless of the font loaded. The `v_clin' parameter is used by the `vgacon' driver to set the height of the character cell and then the cursor position within. Make the parameter explicit then, by defining a new `vc_cell_height' struct member of `vc_data', set it instead of `vc_font.height' from `v_clin' in the VT_RESIZEX ioctl, and then use it throughout the `vgacon' driver except where actual font data is accessed which as noted above is independent from the CRTC setting. This way the framebuffer console driver is free to ignore the `v_clin' parameter as irrelevant, as it always should have, avoiding any issues attempts to give the parameter a meaning there could have caused, such as one that has led to commit 988d0763361b ("vt_ioctl: make VT_RESIZEX behave like VT_RESIZE"): "syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2], for vt_resizex() from ioctl(VT_RESIZEX) allows setting font height larger than actual font height calculated by con_font_set() from ioctl(PIO_FONT). Since fbcon_set_font() from con_font_set() allocates minimal amount of memory based on actual font height calculated by con_font_set(), use of vt_resizex() can cause UAF/OOB read for font data." The problem first appeared around Linux 2.5.66 which predates our repo history, but the origin could be identified with the old MIPS/Linux repo also at: as commit 9736a3546de7 ("Merge with Linux 2.5.66."), where VT_RESIZEX code in `vt_ioctl' was updated as follows: if (clin) - video_font_height = clin; + vc->vc_font.height = clin; making the parameter apply to framebuffer devices as well, perhaps due to the use of "font" in the name of the original `video_font_height' variable. Use "cell" in the new struct member then to avoid ambiguity. References: [1] https://syzkaller.appspot.com/bug?id=32577e96d88447ded2d3b76d71254fb855245837 [2] https://syzkaller.appspot.com/bug?id=6b8355d27b2b94fb5cedf4655e3a59162d9e48e3 Signed-off-by: Maciej W. Rozycki Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org # v2.6.12+ Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

vgacon: Record video mode changes with VT_RESIZEX

2021-05-26T10:06:56+00:00

commit d4d0ad57b3865795c4cde2fb5094c594c2e8f469 upstream. Fix an issue with VGA console font size changes made after the initial video text mode has been changed with a user tool like `svgatextmode' calling the VT_RESIZEX ioctl. As it stands in that case the original screen geometry continues being used to validate further VT resizing. Consequently when the video adapter is firstly reprogrammed from the original say 80x25 text mode using a 9x16 character cell (720x400 pixel resolution) to say 80x37 text mode and the same character cell (720x592 pixel resolution), and secondly the CRTC character cell updated to 9x8 (by loading a suitable font with the KD_FONT_OP_SET request of the KDFONTOP ioctl), the VT geometry does not get further updated from 80x37 and only upper half of the screen is used for the VT, with the lower half showing rubbish corresponding to whatever happens to be there in the video memory that maps to that part of the screen. Of course the proportions change according to text mode geometries and font sizes chosen. Address the problem then, by updating the text mode geometry defaults rather than checking against them whenever the VT is resized via a user ioctl. Signed-off-by: Maciej W. Rozycki Fixes: e400b6ec4ede ("vt/vgacon: Check if screen resize request comes from userspace") Cc: stable@vger.kernel.org # v2.6.24+ Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

parisc/sticon: Add user font support

2020-10-15T06:12:59+00:00

This is a major rework of the sticon (parisc text console) driver in order to support user font support. Usually one want to use the stifb (parisc framebuffer driver) which is based on fbcon and does support fonts and colors, but some old machines (e.g. HP 730 workstations) don't provide a supported stifb graphic card, and for those user fonts are preferred. This patch drops unused code for software cursor and scrollback, enhances the debug output and adds better documentation. The code was tested on various machines with byte-mode and word-mode graphic cards on GSC- and PCI-busses. Signed-off-by: Helge Deller

parisc/sticon: Always register sticon console driver

2020-10-15T06:10:39+00:00

If the ROM provides functional STI routines, always register the sticon driver, even if the serial console was choosen as boot device. Additionally, in that case, do not make the sticon driver the default output console device. Signed-off-by: Helge Deller

Merge tag 'tty-5.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2020-10-14T23:05:52+00:00

Pull tty/serial updates from Greg KH: "Here is the big set of tty and serial driver patches for 5.10-rc1. Lots of little things in here, including: - tasklet_setup api conversions - sysrq support for capital letters - vt and vc cleanups and unwinding the mess some more - serial driver updates and minor tweaks - new device ids - rs485 support for some drivers - serial binding documentation updates - lots of small serial driver changes for reported issues All have been in linux-next for a while with no reported issues" * tag 'tty-5.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (79 commits) serial: mcf: add sysrq capability serial: fsl_lpuart: add sysrq support when using dma fbcon: remove no-op fbcon_set_origin() tty/sysrq: Extend the sysrq_key_table to cover capital letters serial: max310x: rework RX interrupt handling serial: 8250_dw: Fix clk-notifier/port suspend deadlock serial: 8250: Skip uninitialized TTY port baud rate update serial: 8250: Discard RTS/DTS setting from clock update method tty: serial: imx: disable TXDC IRQ in imx_uart_shutdown() to avoid IRQ storm serial: 8250_fsl: Fix TX interrupt handling condition serial: pl011: Fix lockdep splat when handling magic-sysrq interrupt tty: serial: fsl_lpuart: fix lpuart32_poll_get_char tty: serial: lpuart: fix lpuart32_write usage serial: qcom_geni_serial: To correct QUP Version detection logic serial: mvebu-uart: fix unused variable warning vt_ioctl: make VT_RESIZEX behave like VT_RESIZE serial: mvebu-uart: simplify the return expression of mvebu_uart_probe() tty: serial: imx: fix link error with CONFIG_SERIAL_CORE_CONSOLE=n tty: hvc: fix link error with CONFIG_SERIAL_CORE_CONSOLE=n pch_uart: drop double zeroing ...

Merge tag 'drm-misc-fixes-2020-10-01' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes

2020-10-06T02:38:28+00:00

drm-misc-fixes for v5.9: - Small doc fix. - Re-add FB_ARMCLCD for android. - Fix global-out-of-bounds read in fbcon_get_font(). Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/8585daa2-fcbc-3924-ac4f-e7b5668808e0@linux.intel.com

fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h

2020-09-25T08:28:18+00:00

drivers/video/console/newport_con.c is borrowing FONT_EXTRA_WORDS macros from drivers/video/fbdev/core/fbcon.h. To keep things simple, move all definitions into . Since newport_con now uses four extra words, initialize the fourth word in newport_set_font() properly. Cc: stable@vger.kernel.org Signed-off-by: Peilin Ye Reviewed-by: Greg Kroah-Hartman Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/7fb8bc9b0abc676ada6b7ac0e0bd443499357267.1600953813.git.yepeilin.cs@gmail.com

Merge 5.9.0-rc6 into tty-next

2020-09-21T07:23:55+00:00

We need the tty/serial fixes in here and this resolves a merge issue in the 8250 driver. Signed-off-by: Greg Kroah-Hartman

sticon: remove no-op sticon_set_origin()

2020-09-16T12:37:50+00:00

We don't need to call vc->vc_sw->con_set_origin() from set_origin() if it is no-op. Signed-off-by: Tetsuo Handa Link: https://lore.kernel.org/r/20200915000019.3422-2-penguin-kernel@I-love.SAKURA.ne.jp Signed-off-by: Greg Kroah-Hartman

newport_con: remove no-op newport_set_origin()

2020-09-16T12:37:32+00:00

We don't need to call vc->vc_sw->con_set_origin() from set_origin() if it is no-op. Signed-off-by: Tetsuo Handa Link: https://lore.kernel.org/r/20200915000019.3422-1-penguin-kernel@I-love.SAKURA.ne.jp Signed-off-by: Greg Kroah-Hartman