linux-toradex.git/drivers/tty/vt, branch v5.14

Merge 5.13-rc4 into tty-next

2021-05-31T07:44:28+00:00

We need the tty/serial fixes in here as well.

Signed-off-by: Greg Kroah-Hartman

tty: vt: selection: Correct misspelled function sel_loadlut()

2021-05-20T15:05:33+00:00

Fixes the following W=1 kernel build warning(s):

 drivers/tty/vt/selection.c:119: warning: expecting prototype for set loadlut(). Prototype was for sel_loadlut() instead

Cc: Greg Kroah-Hartman 
Cc: Jiri Slaby 
Signed-off-by: Lee Jones 
Link: https://lore.kernel.org/r/20210520121906.3468725-2-lee.jones@linaro.org
Signed-off-by: Greg Kroah-Hartman

tty: vt: always invoke vc->vc_sw->con_resize callback

2021-05-15T15:12:12+00:00

syzbot is reporting OOB write at vga16fb_imageblit() [1], for
resize_screen() from ioctl(VT_RESIZE) returns 0 without checking whether
requested rows/columns fit the amount of memory reserved for the graphical
screen if current mode is KD_GRAPHICS.

----------
  #include 
  #include 
  #include 
  #include 
  #include 
  #include 

  int main(int argc, char *argv[])
  {
        const int fd = open("/dev/char/4:1", O_RDWR);
        struct vt_sizes vt = { 0x4100, 2 };

        ioctl(fd, KDSETMODE, KD_GRAPHICS);
        ioctl(fd, VT_RESIZE, &vt);
        ioctl(fd, KDSETMODE, KD_TEXT);
        return 0;
  }
----------

Allow framebuffer drivers to return -EINVAL, by moving vc->vc_mode !=
KD_GRAPHICS check from resize_screen() to fbcon_resize().

Link: https://syzkaller.appspot.com/bug?extid=1f29e126cf461c4de3b3 [1]
Reported-by: syzbot 
Suggested-by: Linus Torvalds 
Signed-off-by: Tetsuo Handa 
Tested-by: syzbot 
Signed-off-by: Linus Torvalds

vt: Move custom isspace() to its own namespace

2021-05-13T18:38:51+00:00

If by some reason any of the headers will include ctype.h
we will have a name collision. Avoid this by moving isspace()
to the dedicate namespace.

First appearance of the code is in the commit 24a1c2a769cf
("Import 1.1.92").

Reported-by: kernel test robot 
Reviewed-by: Jiri Slaby 
Signed-off-by: Andy Shevchenko 
Link: https://lore.kernel.org/r/20210510144947.58270-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman

Merge branch 'resizex' (patches from Maciej)

2021-05-13T18:12:51+00:00

Merge VT_RESIZEX fixes from Maciej Rozycki:
 "I got to the bottom of the issue with VT_RESIZEX recently discussed
  and came up with this small patch series, fixing an additional issue
  that I originally thought might be broken VGA hardware emulation with
  my laptop, which however turned out to be intertwined with the
  original problem and also a regression introduced somewhat later.

  The fix for that because the first patch, and then to make backporting
  feasible I had to put a revert of the offending change from last
  September next, followed by a proper fix for the framebuffer issue
  that change had tried to address.

  See individual change descriptions for details.

  These have been verified with true VGA hardware (a Trident TVGA8900
  ISA video adapter) using various combinations of `svgatextmode' and
  `setfont' command invocations to change both the VT size and the font
  size, and also switching between the text console and X11, both by
  starting/stopping the X server and by switching between VTs.

  All this to ensure bringing the behaviour of VGA text console back to
  correct operation as it used to be with Linux 2.6.18"

* emailed patches from Maciej W. Rozycki :
  vt: Fix character height handling with VT_RESIZEX
  vt_ioctl: Revert VT_RESIZEX parameter handling removal
  vgacon: Record video mode changes with VT_RESIZEX

vt: Fix character height handling with VT_RESIZEX

2021-05-13T18:00:18+00:00

Restore the original intent of the VT_RESIZEX ioctl's `v_clin' parameter
which is the number of pixel rows per character (cell) rather than the
height of the font used.

For framebuffer devices the two values are always the same, because the
former is inferred from the latter one.  For VGA used as a true text
mode device these two parameters are independent from each other: the
number of pixel rows per character is set in the CRT controller, while
font height is in fact hardwired to 32 pixel rows and fonts of heights
below that value are handled by padding their data with blanks when
loaded to hardware for use by the character generator.  One can change
the setting in the CRT controller and it will update the screen contents
accordingly regardless of the font loaded.

The `v_clin' parameter is used by the `vgacon' driver to set the height
of the character cell and then the cursor position within.  Make the
parameter explicit then, by defining a new `vc_cell_height' struct
member of `vc_data', set it instead of `vc_font.height' from `v_clin' in
the VT_RESIZEX ioctl, and then use it throughout the `vgacon' driver
except where actual font data is accessed which as noted above is
independent from the CRTC setting.

This way the framebuffer console driver is free to ignore the `v_clin'
parameter as irrelevant, as it always should have, avoiding any issues
attempts to give the parameter a meaning there could have caused, such
as one that has led to commit 988d0763361b ("vt_ioctl: make VT_RESIZEX
behave like VT_RESIZE"):

 "syzbot is reporting UAF/OOB read at bit_putcs()/soft_cursor() [1][2],
  for vt_resizex() from ioctl(VT_RESIZEX) allows setting font height
  larger than actual font height calculated by con_font_set() from
  ioctl(PIO_FONT). Since fbcon_set_font() from con_font_set() allocates
  minimal amount of memory based on actual font height calculated by
  con_font_set(), use of vt_resizex() can cause UAF/OOB read for font
  data."

The problem first appeared around Linux 2.5.66 which predates our repo
history, but the origin could be identified with the old MIPS/Linux repo
also at: 
as commit 9736a3546de7 ("Merge with Linux 2.5.66."), where VT_RESIZEX
code in `vt_ioctl' was updated as follows:

 		if (clin)
-			video_font_height = clin;
+			vc->vc_font.height = clin;

making the parameter apply to framebuffer devices as well, perhaps due
to the use of "font" in the name of the original `video_font_height'
variable.  Use "cell" in the new struct member then to avoid ambiguity.

References:

[1] https://syzkaller.appspot.com/bug?id=32577e96d88447ded2d3b76d71254fb855245837
[2] https://syzkaller.appspot.com/bug?id=6b8355d27b2b94fb5cedf4655e3a59162d9e48e3

Signed-off-by: Maciej W. Rozycki 
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org # v2.6.12+
Signed-off-by: Linus Torvalds

vt_ioctl: Revert VT_RESIZEX parameter handling removal

2021-05-13T18:00:18+00:00

Revert the removal of code handling extra VT_RESIZEX ioctl's parameters
beyond those that VT_RESIZE supports, fixing a functional regression
causing `svgatextmode' not to resize the VT anymore.

As a consequence of the reverted change when the video adapter is
reprogrammed from the original say 80x25 text mode using a 9x16
character cell (720x400 pixel resolution) to say 80x37 text mode and the
same character cell (720x592 pixel resolution), the VT geometry does not
get updated and only upper two thirds of the screen are used for the VT,
and the lower part remains blank.  The proportions change according to
text mode geometries chosen.

Revert the change verbatim then, bringing back previous VT resizing.

Signed-off-by: Maciej W. Rozycki 
Fixes: 988d0763361b ("vt_ioctl: make VT_RESIZEX behave like VT_RESIZE")
Cc: stable@vger.kernel.org # v5.10+
Signed-off-by: Linus Torvalds

tty: remove tty_operations::chars_in_buffer for non-buffering

2021-05-13T16:29:11+00:00

The only user of tty_ops::chars_in_buffer is tty_chars_in_buffer. And it
considers tty_ops::chars_in_buffer optional. In case it's NULL, zero is
returned. So remove all those chars_in_buffer from tty_ops which return
zero. (Zero means such driver doesn't buffer.)

Signed-off-by: Jiri Slaby 
Cc: Richard Henderson 
Acked-by: Max Filippov  # xtensa
Cc: Ivan Kokshaysky 
Cc: Matt Turner 
Cc: "James E.J. Bottomley" 
Cc: Helge Deller 
Cc: Chris Zankel 
Cc: Heiko Carstens 
Cc: Vasily Gorbik 
Cc: Christian Borntraeger 
Link: https://lore.kernel.org/r/20210505091928.22010-26-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman

tty: make tty_operations::write_room return uint

2021-05-13T15:03:20+00:00

Line disciplines expect a positive value or zero returned from
tty->ops->write_room (invoked by tty_write_room). So make this
assumption explicit by using unsigned int as a return value. Both of
tty->ops->write_room and tty_write_room.

Signed-off-by: Jiri Slaby 
Acked-by: Laurentiu Tudor 
Acked-by: Alex Elder 
Acked-by: Max Filippov  # xtensa
Acked-by: David Sterba 
Acked-By: Anton Ivanov 
Acked-by: Geert Uytterhoeven 
Cc: Richard Henderson 
Cc: Ivan Kokshaysky 
Cc: Matt Turner 
Cc: "James E.J. Bottomley" 
Cc: Helge Deller 
Cc: Jeff Dike 
Cc: Richard Weinberger 
Cc: Chris Zankel 
Cc: Arnd Bergmann 
Cc: Samuel Iglesias Gonsalvez 
Cc: Jens Taprogge 
Cc: Karsten Keil 
Cc: Scott Branden 
Cc: Ulf Hansson 
Cc: "David S. Miller" 
Cc: Jakub Kicinski 
Cc: Heiko Carstens 
Cc: Vasily Gorbik 
Cc: Christian Borntraeger 
Cc: David Lin 
Cc: Johan Hovold 
Cc: Jiri Kosina 
Cc: Shawn Guo 
Cc: Sascha Hauer 
Cc: Oliver Neukum 
Cc: Felipe Balbi 
Cc: Mathias Nyman 
Cc: Marcel Holtmann 
Cc: Johan Hedberg 
Cc: Luiz Augusto von Dentz 
Link: https://lore.kernel.org/r/20210505091928.22010-23-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman

tty: cumulate and document tty_struct::ctrl* members

2021-05-13T14:57:16+00:00

Group the ctrl members under a single struct called ctrl. The new struct
contains 'pgrp', 'session', 'pktstatus', and 'packet'. 'pktstatus' and
'packet' used to be bits in a bitfield. The struct also contains the
lock protecting them to share the same cache line.

Note that commit c545b66c6922b (tty: Serialize tcflow() with other tty
flow control changes) added a padding to the original bitfield. It was
for the bitfield to occupy a whole 64b word to avoid interferring stores
on Alpha (cannot we evaporate this arch with weird implications to C
code yet?). But it doesn't work as expected as the padding
(tty_struct::ctrl_unused) is aligned to a 8B boundary too and occupies
some bytes from the next word.

So make it reliable by:
1) setting __aligned of the struct -- that aligns the start, and
2) making 'unsigned long unused[0]' as the last member of the struct --
   pads the end.

Add a kerneldoc comment for this grouped members.

Signed-off-by: Jiri Slaby 
Cc: "David S. Miller" 
Cc: Jakub Kicinski 
Cc: netdev@vger.kernel.org
Link: https://lore.kernel.org/r/20210505091928.22010-14-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman