linux-toradex.git/drivers/tty/vt/vt.c, branch v4.4.83

vt: fix unchecked __put_user() in tioclinux ioctls

2017-07-21T05:44:57+00:00

commit 6987dc8a70976561d22450b5858fc9767788cc1c upstream.

Only read access is checked before this call.

Actually, at the moment this is not an issue, as every in-tree arch does
the same manual checks for VERIFY_READ vs VERIFY_WRITE, relying on the MMU
to tell them apart, but this wasn't the case in the past and may happen
again on some odd arch in the future.

If anyone cares about 3.7 and earlier, this is a security hole (untested)
on real 80386 CPUs.

Signed-off-by: Adam Borowski 
Signed-off-by: Greg Kroah-Hartman

tty: vt, fix bogus division in csi_J

2016-11-10T15:36:37+00:00

commit 42acfc6615f47e465731c263bee0c799edb098f2 upstream.

In csi_J(3), the third parameter of scr_memsetw (vc_screenbuf_size) is
divided by 2 inappropriatelly. But scr_memsetw expects size, not
count, because it divides the size by 2 on its own before doing actual
memset-by-words.

So remove the bogus division.

Signed-off-by: Jiri Slaby 
Cc: Petr Písař 
Fixes: f8df13e0a9 (tty: Clean console safely)
Signed-off-by: Greg Kroah-Hartman

tty: limit terminal size to 4M chars

2016-11-10T15:36:34+00:00

commit 32b2921e6a7461fe63b71217067a6cf4bddb132f upstream.

Size of kmalloc() in vc_do_resize() is controlled by user.
Too large kmalloc() size triggers WARNING message on console.
Put a reasonable upper bound on terminal size to prevent WARNINGs.

Signed-off-by: Dmitry Vyukov 
CC: David Rientjes 
Cc: One Thousand Gnomes 
Cc: Greg Kroah-Hartman 
Cc: Jiri Slaby 
Cc: Peter Hurley 
Cc: linux-kernel@vger.kernel.org
Cc: syzkaller@googlegroups.com
Signed-off-by: Greg Kroah-Hartman

vt: clear selection before resizing

2016-11-10T15:36:34+00:00

commit 009e39ae44f4191188aeb6dfbf661b771dbbe515 upstream.

When resizing a vt its selection may exceed the new size, resulting in
an invalid memory access [1]. Clear the selection before resizing.

[1] http://lkml.kernel.org/r/CACT4Y+acDTwy4umEvf5ROBGiRJNrxHN4Cn5szCXE5Jw-d1B=Xw@mail.gmail.com

Reported-and-tested-by: Dmitry Vyukov 
Signed-off-by: Scot Doyle 
Signed-off-by: Greg Kroah-Hartman

tty: vt: Fix soft lockup in fbcon cursor blink timer.

2016-07-27T16:47:37+00:00

commit 1b45996d2ebf9680ccd0db875fc668aa025f40fd upstream.

We are getting somewhat random soft lockups with this signature:

[   86.992215] [] el1_irq+0xa0/0x10c
[   86.997082] [] cursor_timer_handler+0x30/0x54
[   87.002991] [] call_timer_fn+0x54/0x1a8
[   87.008378] [] run_timer_softirq+0x1c4/0x2bc
[   87.014200] [] __do_softirq+0x114/0x344
[   87.019590] [] irq_exit+0x74/0x98
[   87.024458] [] __handle_domain_irq+0x98/0xfc
[   87.030278] [] gic_handle_irq+0x94/0x190

This is caused by the vt visual_init() function calling into
fbcon_init() with a vc_cur_blink_ms value of zero.  This is a
transient condition, as it is later set to a non-zero value.  But, if
the timer happens to expire while the blink rate is zero, it goes into
an endless loop, and we get soft lockup.

The fix is to initialize vc_cur_blink_ms before calling the con_init()
function.

Signed-off-by: David Daney 
Acked-by: Pavel Machek 
Tested-by: Ming Lei 
Acked-by: Scot Doyle 
Tested-by: Henrique de Moraes Holschuh 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Greg Kroah-Hartman

tty: vt, return error when con_startup fails

2016-06-01T19:15:52+00:00

commit 6798df4c5fe0a7e6d2065cf79649a794e5ba7114 upstream.

When csw->con_startup() fails in do_register_con_driver, we return no
error (i.e. 0). This was changed back in 2006 by commit 3e795de763.
Before that we used to return -ENODEV.

So fix the return value to be -ENODEV in that case again.

Fixes: 3e795de763 ("VT binding: Add binding/unbinding support for the VT console")
Signed-off-by: Jiri Slaby 
Reported-by: "Dan Carpenter" 
Signed-off-by: Greg Kroah-Hartman

tty/vt: Fix the memory leak in visual_init

2015-07-23T22:11:08+00:00

If vc->vc_uni_pagedir_loc is not NULL, its refcount needs to be
decreased before vc_uni_pagedir_loc is re-assigned.

unreferenced object 0xffff88002cdd13b0 (size 512):
  comm "setfont", pid 503, jiffies 4294896503 (age 722.828s)
  hex dump (first 32 bytes):
    40 92 61 2b 00 88 ff ff 00 00 00 00 00 00 00 00  @.a+............
    00 00 00 00 00 00 00 00 a0 ad 61 2b 00 88 ff ff  ..........a+....
  backtrace:
    [] kmemleak_alloc+0x4e/0xb0
    [] kmem_cache_alloc_trace+0x1c8/0x240
    [] con_do_clear_unimap.isra.2+0x83/0xe0
    [] con_clear_unimap+0x22/0x40
    [] vt_ioctl+0xeb8/0x1170
    [] tty_ioctl+0x208/0xca0
    [] do_vfs_ioctl+0x2f8/0x510
    [] SyS_ioctl+0x81/0xa0
    [] system_call_fastpath+0x16/0x75
    [] 0xffffffffffffffff
unreferenced object 0xffff88002b619240 (size 256):
  comm "setfont", pid 503, jiffies 4294896503 (age 722.828s)
  hex dump (first 32 bytes):
    90 bc 84 d5 00 88 ff ff 58 85 84 d5 00 88 ff ff  ........X.......
    88 ac 84 d5 00 88 ff ff e0 b1 84 d5 00 88 ff ff  ................
  backtrace:
    [] kmemleak_alloc+0x4e/0xb0
    [] kmem_cache_alloc_trace+0x1c8/0x240
    [] con_insert_unipair+0x86/0x170
    [] con_set_unimap+0x1b7/0x280
    [] vt_ioctl+0xe65/0x1170
    [] tty_ioctl+0x208/0xca0
    [] do_vfs_ioctl+0x2f8/0x510
    [] SyS_ioctl+0x81/0xa0
    [] system_call_fastpath+0x16/0x75
    [] 0xffffffffffffffff

Signed-off-by: Dongxing Zhang 
Signed-off-by: Xiaoming Wang 
Reviewed-by: Peter Hurley 
Tested-by: Konstantin Khlebnikov 
Signed-off-by: Greg Kroah-Hartman

vt: Don't check KD_GRAPHICS when binding/unbinding

2015-05-10T17:29:51+00:00

This was introduced in

commit 6db4063c5b72b46e9793b0f141a7a3984ac6facf
Author: Antonino A. Daplas 
Date:   Mon Jun 26 00:27:12 2006 -0700

    [PATCH] VT binding: Add sysfs control to the VT layer

with the justification

    "In addition, if any of the consoles are in KD_GRAPHICS mode, binding and
    unbinding will not succeed.  KD_GRAPHICS mode usually indicates that the
    underlying console hardware is used for other purposes other than displaying
    text (ie X).  This feature should prevent binding/unbinding from interfering
    with a graphics application using the VT."

I think we should lift this artificial restriction though:
- KD_GRAPHICS doesn't get cleaned up automatically, which means it's
  easy to have terminals stuck in KD_GRAPHICS when hacking around on
  X.
- X doesn't really care, especially with drm where kms already blocks
  fbdev (and hence fbcon) when there's an active compositor.
- This is a root-only interface with a separate .config option and
  it's possible to hang your machine already anyway if you
  unload/reload drivers and don't know what you're doing.

With this patch i915.ko module reloading works again reliably,
something in the recent fedora upgrades broke things.

Cc: Antonino A. Daplas 
Cc: Peter Hurley 
Cc: Imre Deak 
Signed-off-by: Daniel Vetter 
Acked-by: David Herrmann 
Signed-off-by: Greg Kroah-Hartman

vt: fix console lock vs. kernfs s_active lock order

2015-05-10T17:29:51+00:00

Currently there is a lock order problem between the console lock and the
kernfs s_active lock of the console driver's bind sysfs entry. When
writing to the sysfs entry the lock order is first s_active then console
lock, when unregistering the console driver via
do_unregister_con_driver() the order is the opposite. See the below
bugzilla reference for one instance of a lockdep backtrace.

Fix this by unregistering the console driver from a deferred work, where
we can safely drop the console lock while unregistering the device and
corresponding sysfs entries (which in turn acquire s_active). Note that
we have to keep the console driver slot in the registered_con_driver
array reserved for the driver that's being unregistered until it's fully
removed. Otherwise a concurrent call to do_register_con_driver could
try to reuse the same slot and fail when registering the corresponding
device with a minor index that's still in use.

Note that the referenced bug report contains two dmesg logs with two
distinct lockdep reports: [1] is about a locking scenario involving
s_active, console_lock and the fb_notifier list lock, while [2] is
about a locking scenario involving only s_active and console_lock.
In [1] locking fb_notifier triggers the lockdep warning only because
of its dependence on console_lock, otherwise case [1] is the same
s_active<->console_lock dependency problem fixed by this patch.
Before this change we have the following locking scenarios involving
the 3 locks:

a) via do_unregister_framebuffer()->...->do_unregister_con_driver():
   1. console lock 2. fb_notifier lock 3. s_active lock
b) for example via give_up_console()->do_unregister_con_driver():
   1. console lock 2. s_active lock
c) via vt_bind()/vt_unbind():
   1. s_active lock 2. console lock

Since c) is the console bind sysfs entry's write code path we can't
change the locking order there. We can only fix this issue by removing
s_active's dependence on the other two locks in a) and b). We can do
this only in the vt code which owns the corresponding sysfs entry, so
that after the change we have:

a) 1. console lock 2. fb_notifier lock
b) 1. console lock
c) 1. s_active lock 2. console lock
d) in the new con_driver_unregister_callback():
   1. s_active lock

[1] https://bugs.freedesktop.org/attachment.cgi?id=87716
[2] https://bugs.freedesktop.org/attachment.cgi?id=107602

v2:
- get console_lock earlier in con_driver_unregister_callback(), so we
  protect the following console driver field assignments there
- add code coment explaining the reason for deferring the sysfs entry
  removal
- add a third paragraph to the commit message explaining why there are
  two distinct lockdep reports and that this issue is independent of
  fb/fbcon. (Peter Hurley)
v3:
- clarify further the third paragraph
v4:
- rebased on v4 of patch 1/3

Signed-off-by: Imre Deak 
Reviewed-by: Daniel Vetter 
Signed-off-by: Greg Kroah-Hartman

vt: add cursor blink interval escape sequence

2015-05-10T17:15:52+00:00

Add an escape sequence to specify the current console's cursor blink
interval. The interval is specified as a number of milliseconds until
the next cursor display state toggle, from 50 to 65535. /proc/loadavg
did not show a difference with a one msec interval, but the lower
bound is set to 50 msecs since slower hardware wasn't tested.

Store the interval in the vc_data structure for later access by fbcon,
initializing the value to fbcon's current hardcoded value of 200 msecs.

Signed-off-by: Scot Doyle 
Acked-by: Pavel Machek 
Signed-off-by: Greg Kroah-Hartman