summaryrefslogtreecommitdiff
path: root/drivers/tty/vt
AgeCommit message (Collapse)AuthorFilesLines
2023-02-06Merge 6.2-rc7 into tty-nextGreg Kroah-Hartman1-4/+5
We need the tty/serial fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-31vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAFGeorge Kennedy1-4/+5
After a call to console_unlock() in vcs_read() the vc_data struct can be freed by vc_deallocate(). Because of that, the struct vc_data pointer load must be done at the top of while loop in vcs_read() to avoid a UAF when vcs_size() is called. Syzkaller reported a UAF in vcs_size(). BUG: KASAN: use-after-free in vcs_size (drivers/tty/vt/vc_screen.c:215) Read of size 4 at addr ffff8881137479a8 by task 4a005ed81e27e65/1537 CPU: 0 PID: 1537 Comm: 4a005ed81e27e65 Not tainted 6.2.0-rc5 #1 Hardware name: Red Hat KVM, BIOS 1.15.0-2.module Call Trace: <TASK> __asan_report_load4_noabort (mm/kasan/report_generic.c:350) vcs_size (drivers/tty/vt/vc_screen.c:215) vcs_read (drivers/tty/vt/vc_screen.c:415) vfs_read (fs/read_write.c:468 fs/read_write.c:450) ... </TASK> Allocated by task 1191: ... kmalloc_trace (mm/slab_common.c:1069) vc_allocate (./include/linux/slab.h:580 ./include/linux/slab.h:720 drivers/tty/vt/vt.c:1128 drivers/tty/vt/vt.c:1108) con_install (drivers/tty/vt/vt.c:3383) tty_init_dev (drivers/tty/tty_io.c:1301 drivers/tty/tty_io.c:1413 drivers/tty/tty_io.c:1390) tty_open (drivers/tty/tty_io.c:2080 drivers/tty/tty_io.c:2126) chrdev_open (fs/char_dev.c:415) do_dentry_open (fs/open.c:883) vfs_open (fs/open.c:1014) ... Freed by task 1548: ... kfree (mm/slab_common.c:1021) vc_port_destruct (drivers/tty/vt/vt.c:1094) tty_port_destructor (drivers/tty/tty_port.c:296) tty_port_put (drivers/tty/tty_port.c:312) vt_disallocate_all (drivers/tty/vt/vt_ioctl.c:662 (discriminator 2)) vt_ioctl (drivers/tty/vt/vt_ioctl.c:903) tty_ioctl (drivers/tty/tty_io.c:2776) ... The buggy address belongs to the object at ffff888113747800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 424 bytes inside of 1024-byte region [ffff888113747800, ffff888113747c00) The buggy address belongs to the physical page: page:00000000b3fe6c7c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113740 head:00000000b3fe6c7c order:3 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0 anon flags: 0x17ffffc0010200(slab|head|node=0|zone=2|lastcpupid=0x1fffff) raw: 0017ffffc0010200 ffff888100042dc0 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888113747880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888113747900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff888113747980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888113747a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888113747a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Disabling lock debugging due to kernel taint Fixes: ac751efa6a0d ("console: rename acquire/release_console_sem() to console_lock/unlock()") Reported-by: syzkaller <syzkaller@googlegroups.com> Suggested-by: Jiri Slaby <jirislaby@kernel.org> Signed-off-by: George Kennedy <george.kennedy@oracle.com> Link: https://lore.kernel.org/r/1674577014-12374-1-git-send-email-george.kennedy@oracle.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-19VT: Bump font size limitation to 64x128 pixelsSamuel Thibault1-12/+16
This moves 32x32 font size limitation checking down to drivers, so that fbcon can allow large fonts. We still keep a limitation to 64x128 pixels so as to have a simple bounded allocation for con_font_get and in the userland kbd tool. That glyph size will however be enough to have 128x36 characters on a "16/9 8K display". Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://lore.kernel.org/r/20230119151935.112415738@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-19VT: Add KD_FONT_OP_SET/GET_TALL operationsSamuel Thibault1-4/+10
The KD_FONT_OP_SET/GET operations hardcode vpitch to be 32 pixels, which only dates from the old VGA hardware which as asserting this. Drivers such as fbcon however do not have such limitation, so this introduces KD_FONT_OP_SET/GET_TALL operations, which userland can try to use to avoid this limitation, thus opening the patch to >32 pixels font height. Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://lore.kernel.org/r/20230119151935.013597162@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-19VT: Add height parameter to con_font_get/set consw operationsSamuel Thibault1-2/+2
The current con_font_get/set API currently hardcodes a 32-pixel-tall limitation, which only dates from the old VGA hardware which could not handle taller fonts than that. This change just adds a vpitch parameter to release this constraint. Drivers which do not support vpitch != 32 can just return EINVAL when it is not 32, font loading tools will revert to trying 32 and succeed. This change makes the fbcon driver consider vpitch appropriately, thus making it able to load large fonts. Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Link: https://lore.kernel.org/r/20230119151934.932642243@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-19tty: vt: cache row count in con_scroll()Jiri Slaby (SUSE)1-3/+4
It's used on few places, so make the code easier to follow by caching the subtraction result. Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://lore.kernel.org/r/20230112080136.4929-11-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-19tty: vt: saner names for more scroll variablesJiri Slaby (SUSE)1-18/+22
Rename more variables (t, b, s, d) -> (top, bottom, src, dst) to make them more obvious. Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://lore.kernel.org/r/20230112080136.4929-10-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-19tty: vt: separate array juggling to juggle_array()Jiri Slaby (SUSE)1-24/+28
The algorithm used for scrolling is the array juggling. It has complexity O(N) and space complexity O(1). I.e. quite fast w/o requirements for temporary storage. Move the algorithm to a separate function so it is obvious what it is. It is almost generic (except the array type), so if anyone else wants array rotation, feel free to make it generic and move it to include/. And rename all the variables from i, j, k, sz, d, and so on to something saner. Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org> Link: https://lore.kernel.org/r/20230112080136.4929-9-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-19tty: vt: simplify some unicode conditionsJiri Slaby (SUSE)1-49/+36
After previous patches, we can simply test vc->vc_uni_lines, so do so in many unicode functions. This makes the code more compact. And even use if (!) return; in vc_uniscr_scroll(), so that the whole code is indented on the left. Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://lore.kernel.org/r/20230112080136.4929-8-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-19tty: vt: replace BUG_ON() by WARN_ON_ONCE()Jiri Slaby (SUSE)1-1/+2
No need to panic in vc_uniscr_copy_line(), just warn. This should never happen though, as vc_uniscr_check() is supposed to be called before vc_uniscr_copy_line(). And the former checks vc->vc_uni_lines already. In any case, use _ONCE as vc_uniscr_copy_line() is called repeatedly for each line. So don't flood the logs, just in case. Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://lore.kernel.org/r/20230112080136.4929-7-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-19tty: vt: remove struct uni_screenJiri Slaby (SUSE)1-59/+58
It contains only lines with pointers to characters (u32s). So use simple clear 'u32 **lines' all over the code. This avoids zero-length arrays. It also makes the allocation less error-prone (size of the struct wasn't taken into account at all). Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://lore.kernel.org/r/20230112080136.4929-6-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-19tty: vt: remove char32_t typedefJiri Slaby (SUSE)1-14/+12
It boils down to uint32_t, so use u32 directly, instead. This makes the code more obvious. Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://lore.kernel.org/r/20230112080136.4929-5-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-19tty: vt: use sizeof(*variable) where possibleJiri Slaby (SUSE)1-5/+5
Instead of sizeof(type), use sizeof(*variable) which is preferred. We are going to remove the unicode's char32_t typedef, so this makes the switch easier. Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org> Link: https://lore.kernel.org/r/20230112080136.4929-4-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-19tty: vt: remove reference to undefined NO_VC_UNI_SCREENJiri Slaby (SUSE)1-3/+0
NO_VC_UNI_SCREEN is defined nowhere. Remove the last reference to it. Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://lore.kernel.org/r/20230112080136.4929-3-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-19tty: vt: drop get_vc_uniscr()Jiri Slaby (SUSE)1-17/+10
Its definition depends on the NO_VC_UNI_SCREEN macro. But that is never defined, so remove all this completely. I.e. expand the macro to vc->vc_uni_screen everywhere. Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://lore.kernel.org/r/20230112080136.4929-2-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-19tty: vt: remove vc_uniscr_debug_check()Jiri Slaby (SUSE)1-40/+0
VC_UNI_SCREEN_DEBUG is always defined as 0, so this code is never executed. Drop it along with VC_UNI_SCREEN_DEBUG. Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Link: https://lore.kernel.org/r/20230112080136.4929-1-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-19tty/vt: prevent registration of console with invalid numberSven Schnelle1-0/+6
If a user specifies an invalid console like 'console=tty3000', the vt driver should prevent setting up a vt entry for that. Suggested-by: Jiri Slaby <jirislaby@kernel.org> Signed-off-by: Sven Schnelle <svens@linux.ibm.com> Link: https://lore.kernel.org/r/20221209112737.3222509-3-svens@linux.ibm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-05Merge 6.0-rc4 into tty-nextGreg Kroah-Hartman1-4/+8
We need the tty/serial fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-01tty/vt: Add console_lock check to vt_console_print()Daniel Vetter1-1/+3
I'm scratching my head why we have this printing_lock. Digging through historical git trees shows that: - Added in 1.1.73, and I found absolutely no reason why. - Converted to atomic bitops in 2.1.125pre2, I guess as part of SMP enabling/bugfixes. - Converted to a proper spinlock in b0940003f25d ("vt: bitlock fix") because the hand-rolled atomic version lacked necessary memory barriers. Digging around in lore for that time period did also not shed further light. The only reason I think this might still be relevant today is that (to my understanding at least, ymmv) during an oops we might be printing without console_lock held. See console_flush_on_panic() and the comments in there - we flush out the console buffers irrespective of whether we managed to acquire the right locks. The strange thing is that this reason is fairly recent, because the console flushing was historically done without oops_in_progress set. This only changed in c7c3f05e341a ("panic: avoid deadlocks in re-entrant console drivers"), which removed the call to bust_spinlocks(0) (which decrements oops_in_progress again) before flushing out the console (which back then was open coded as a console_trylock/unlock pair). Note that this entire mess should be properly fixed in the printk/console layer, and not inflicted on each implementation. For now just document what's going on and check that in all other cases callers obey the locking rules. v2: WARN_CONSOLE_UNLOCKED already checks for oops_in_progress (something else that should be fixed I guess), hence remove the open-coded check I've had. Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Jiri Slaby <jirislaby@kernel.org> Cc: "Ilpo Järvinen" <ilpo.jarvinen@linux.intel.com> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: Xuezhi Zhang <zhangxuezhi1@coolpad.com> Cc: Yangxi Xiang <xyangxi5@gmail.com> Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Cc: nick black <dankamongmen@gmail.com> Cc: Petr Mladek <pmladek@suse.com> Cc: Sergey Senozhatsky <senozhatsky@chromium.org> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: John Ogness <john.ogness@linutronix.de> Reviewed-by: Sam Ravnborg <sam@ravnborg.org> Link: https://lore.kernel.org/r/20220830144945.430528-1-daniel.vetter@ffwll.ch Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-01kernel/panic: Drop unblank_screen callDaniel Vetter1-1/+2
console_unblank() does this too (called in both places right after), and with a lot more confidence inspiring approach to locking. Reconstructing this story is very strange: In b61312d353da ("oops handling: ensure that any oops is flushed to the mtdoops console") it is claimed that a printk(" "); flushed out the console buffer, which was removed in e3e8a75d2acf ("[PATCH] Extract and use wake_up_klogd()"). In todays kernels this is done way earlier in console_flush_on_panic with some really nasty tricks. I didn't bother to fully reconstruct this all, least because the call to bust_spinlock(0); gets moved every few years, depending upon how the wind blows (or well, who screamed loudest about the various issue each call site caused). Before that commit the only calls to console_unblank() where in s390 arch code. The other side here is the console->unblank callback, which was introduced in 2.1.31 for the vt driver. Which predates the console_unblank() function by a lot, which was added (without users) in 2.4.14.3. So pretty much impossible to guess at any motivation here. Also afaict the vt driver is the only (and always was the only) console driver implementing the unblank callback, so no idea why a call to console_unblank() was added for the mtdooops driver - the action actually flushing out the console buffers is done from console_unlock() only. Note that as prep for the s390 users the locking was adjusted in 2.5.22 (I couldn't figure out how to properly reference the BK commit from the historical git trees) from a normal semaphore to a trylock. Note that a copy of the direct unblank_screen() call was added to panic() in c7c3f05e341a ("panic: avoid deadlocks in re-entrant console drivers"), which partially inlined the bust_spinlocks(0); call. Long story short, I have no idea why the direct call to unblank_screen survived for so long (the infrastructure to do it properly existed for years), nor why it wasn't removed when the console_unblank() call was finally added. But it makes a ton more sense to finally do that than not - it's just better encapsulation to go through the console functions instead of doing a direct call, so let's dare. Plus it really does not make much sense to call the only unblank implementation there is twice, once without, and once with appropriate locking. Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Jiri Slaby <jirislaby@kernel.org> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: "Ilpo Järvinen" <ilpo.jarvinen@linux.intel.com> Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Cc: Xuezhi Zhang <zhangxuezhi1@coolpad.com> Cc: Yangxi Xiang <xyangxi5@gmail.com> Cc: nick black <dankamongmen@gmail.com> Cc: Petr Mladek <pmladek@suse.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Luis Chamberlain <mcgrof@kernel.org> Cc: "Guilherme G. Piccoli" <gpiccoli@igalia.com> Cc: Marco Elver <elver@google.com> Cc: John Ogness <john.ogness@linutronix.de> Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Cc: David Gow <davidgow@google.com> Cc: tangmeng <tangmeng@uniontech.com> Cc: Tiezhu Yang <yangtiezhu@loongson.cn> Cc: Chris Wilson <chris@chris-wilson.co.uk> Reviewed-by: Petr Mladek <pmladek@suse.com> Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Link: https://lore.kernel.org/r/20220830145004.430545-1-daniel.vetter@ffwll.ch Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-30vt: Clear selection before changing the fontHelge Deller1-4/+8
When changing the console font with ioctl(KDFONTOP) the new font size can be bigger than the previous font. A previous selection may thus now be outside of the new screen size and thus trigger out-of-bounds accesses to graphics memory if the selection is removed in vc_do_resize(). Prevent such out-of-memory accesses by dropping the selection before the various con_font_set() console handlers are called. Reported-by: syzbot+14b0e8f3fd1612e35350@syzkaller.appspotmail.com Cc: stable <stable@kernel.org> Tested-by: Khalid Masum <khalid.masum.92@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de> Link: https://lore.kernel.org/r/YuV9apZGNmGfjcor@p100 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-30tty/vt: Remove printable variableDaniel Vetter1-4/+0
Every since the 0.99.7A release when console_register() was introduced it's become impossible to call vt_console_print (called console_print() back then still) directly. Which means the initialization issue this variable protected against is no more. Give it a send off with style and let it rest in peace. Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Jiri Slaby <jirislaby@kernel.org> Cc: "Ilpo Järvinen" <ilpo.jarvinen@linux.intel.com> Cc: nick black <dankamongmen@gmail.com> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Cc: Yangxi Xiang <xyangxi5@gmail.com> Cc: Xuezhi Zhang <zhangxuezhi1@coolpad.com> Reviewed-by: Jiri Slaby <jirislaby@kernel.org> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Link: https://lore.kernel.org/r/20220826202419.198535-1-daniel.vetter@ffwll.ch Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-08-08Merge tag 'tty-6.0-rc1' of ↵Linus Torvalds5-325/+386
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty / serial driver updates from Greg KH: "Here is the big set of tty and serial driver changes for 6.0-rc1. It was delayed from last week as I wanted to make sure the last commit here got some good testing in linux-next and elsewhere as it seemed to show up only late in testing for some reason. Nothing major here, just lots of cleanups from Jiri and Ilpo to make the tty core cleaner (Jiri) and the rs485 code simpler to use (Ilpo). Also included in here is the obligatory n_gsm updates from Daniel Starke and lots of tiny driver updates and minor fixes and tweaks for other smaller serial drivers. All of these have been in linux-next for a while with no reported problems" * tag 'tty-6.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (186 commits) tty: serial: qcom-geni-serial: Fix %lu -> %u in print statements tty: amiserial: Fix comment typo tty: serial: document uart_get_console() tty: serial: serial_core, reformat kernel-doc for functions Documentation: serial: link uart_ops properly Documentation: serial: move GPIO kernel-doc to the functions Documentation: serial: dedup kernel-doc for uart functions Documentation: serial: move uart_ops documentation to the struct dt-bindings: serial: snps-dw-apb-uart: Document Rockchip RV1126 serial: mvebu-uart: uart2 error bits clearing tty: serial: fsl_lpuart: correct the count of break characters serial: stm32: make info structs static to avoid sparse warnings serial: fsl_lpuart: zero out parity bit in CS7 mode tty: serial: qcom-geni-serial: Fix get_clk_div_rate() which otherwise could return a sub-optimal clock rate. serial: 8250_bcm2835aux: Add missing clk_disable_unprepare() tty: vt: initialize unicode screen buffer serial: remove VR41XX serial driver serial: 8250: lpc18xx: Remove redundant sanity check for RS485 flags serial: 8250_dwlib: remove redundant sanity check for RS485 flags dt_bindings: rs485: Correct delay values ...
2022-07-19tty: vt: initialize unicode screen bufferTetsuo Handa1-1/+1
syzbot reports kernel infoleak at vcs_read() [1], for buffer can be read immediately after resize operation. Initialize buffer using kzalloc(). ---------- #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <linux/fb.h> int main(int argc, char *argv[]) { struct fb_var_screeninfo var = { }; const int fb_fd = open("/dev/fb0", 3); ioctl(fb_fd, FBIOGET_VSCREENINFO, &var); var.yres = 0x21; ioctl(fb_fd, FBIOPUT_VSCREENINFO, &var); return read(open("/dev/vcsu", O_RDONLY), &var, sizeof(var)) == -1; } ---------- Link: https://syzkaller.appspot.com/bug?extid=31a641689d43387f05d3 [1] Cc: stable <stable@vger.kernel.org> Reported-by: syzbot <syzbot+31a641689d43387f05d3@syzkaller.appspotmail.com> Reviewed-by: Jiri Slaby <jirislaby@kernel.org> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Link: https://lore.kernel.org/r/4ef053cf-e796-fb5e-58b7-3ae58242a4ad@I-love.SAKURA.ne.jp Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-30vt: fix memory overlapping when deleting chars in the bufferYangxi Xiang1-1/+1
A memory overlapping copy occurs when deleting a long line. This memory overlapping copy can cause data corruption when scr_memcpyw is optimized to memcpy because memcpy does not ensure its behavior if the destination buffer overlaps with the source buffer. The line buffer is not always broken, because the memcpy utilizes the hardware acceleration, whose result is not deterministic. Fix this problem by using replacing the scr_memcpyw with scr_memmovew. Fixes: 81732c3b2fed ("tty vt: Fix line garbage in virtual console on command line edition") Cc: stable <stable@kernel.org> Signed-off-by: Yangxi Xiang <xyangxi5@gmail.com> Link: https://lore.kernel.org/r/20220628093322.5688-1-xyangxi5@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-27tty/vt: consolemap: use E_TABSZ for the translations sizeJiri Slaby1-1/+1
The code expects "translations" to have 256 (E_TABSZ) values. Use the macro instead of the constant to be explicit about this. Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220614090537.15557-8-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-27tty/vt: consolemap: remove dflt reset from con_do_clear_unimap()Jiri Slaby1-2/+0
con_do_clear_unimap() sets dflt to NULL and then calls con_release_unimap() which does the very same as the first thing. So remove the former as it is apparently superfluous. Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220614090537.15557-7-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-27tty/vt: consolemap: improve UNI_*() macros definitionsJiri Slaby1-4/+13
Use FIELD_GET() and GENMASK() helpers instead of direct shifts and ANDs. This makes the code even more obvious. I didn't know about the helpers at the time of writing the macros. Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220614090537.15557-6-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-27tty/vt: consolemap: rename struct vc_data::vc_uni_pagedir*Jiri Slaby2-27/+27
As a follow-up to the commit 4173f018aae1 (tty/vt: consolemap: rename and document struct uni_pagedir), rename also the members of struct vc_data. I.e. pagedir -> pagedict. And while touching all the places, remove also the unnecessary vc_ prefix. Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220614090537.15557-5-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-27tty/vt: consolemap: saner variable names in set_inverse_transl()Jiri Slaby1-13/+13
The function uses too vague variable names like i, j, k for iterators, p, q, p1, p2 for pointers etc. Rename all these, so that it is clear what is going on: - dict: for dictionaries. - d, r, g: for dir, row, glyph iterators -- these are unsigned now. - dir, row: for directory and row pointers. - glyph: for the glyph. - and so on... This is a lot of shuffling, but the result pays off, IMO. Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220614090537.15557-4-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-27tty/vt: consolemap: saner variable names in set_inverse_trans_unicode()Jiri Slaby1-5/+5
The function still uses too vague parameter name after commit 50c92a1b2d50 (tty/vt: consolemap: saner variable names in set_inverse_trans_unicode()). So use "dict" instead of "p" for that parameter too. Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220614090537.15557-3-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-27tty/vt: consolemap: remove unused parameter from set_inverse_trans_unicode()Jiri Slaby1-5/+4
conp is unused in set_inverse_trans_unicode(), remove it. Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220614090537.15557-2-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-27tty/vt: consolemap: use ARRAY_SIZE(), part II.Jiri Slaby1-2/+2
The code still uses constants (macros) as bounds in loops after commit 17945d317a52 (tty/vt: consolemap: use ARRAY_SIZE()). The contants are at least macros used also in the definition of the arrays. But use ARRAY_SIZE() on two more places to ensure the loops never run out of bounds even if the array definition change. Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220614090537.15557-1-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-10tty: vt: convert sysfs snprintf to sysfs_emitXuezhi Zhang1-2/+2
Fix the following coccicheck warnings: drivers/tty/vt/vt.c:3942:8-16: WARNING: use scnprintf or sprintf drivers/tty/vt/vt.c:3950:8-16: WARNING: use scnprintf or sprintf Signed-off-by: Xuezhi Zhang <zhangxuezhi1@coolpad.com> Link: https://lore.kernel.org/r/20220531072814.34999-1-zhangxuezhi1@coolpad.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-10tty/vt: consolemap: walk the buffer only once in con_set_trans_old()Jiri Slaby1-7/+7
Fetch the user data one by one (by get_user()) and fill in the local buffer simultaneously. I.e. we no longer require to walk two buffers and save thus 256 B from stack (whole ubuf). Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220607104946.18710-36-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-10tty/vt: consolemap: use con_allocate_new() in con_unshare_unimap()Jiri Slaby1-5/+1
The old->refcount is guaranteed to be > 1, so we can directly call con_allocate_new() to make the code more obvious. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220607104946.18710-35-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-10tty/vt: consolemap: extract con_allocate_new() from con_do_clear_unimap()Jiri Slaby1-15/+23
The first part of con_do_clear_unimap() is needed on another place, so extract it to a separate function called con_allocate_new(). It will be used once more in the next patch. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220607104946.18710-34-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-10tty/vt: consolemap: change refcount only if needed in con_do_clear_unimap()Jiri Slaby1-6/+7
con_do_clear_unimap() currently decreases and increases refcount of old dictionary in a back and forth fashion. This makes the code really hard to follow. Decrease the refcount only if everything went well and we really allocated a new one and decoupled from the old dictionary. I sincerelly hope I did not make a mistake in this (ill) logic. Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220607104946.18710-33-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-10tty/vt: consolemap: remove superfluous whitespaceJiri Slaby1-8/+8
There are still some remaining tabs/spaces at EOLs or spaces before tabs. Remove them all now. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220607104946.18710-32-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-10tty/vt: consolemap: make conv_uni_to_pc() more readableJiri Slaby1-10/+16
1) Fetch *conp->vc_uni_pagedir_loc first and do the NULL check on the local variable. 2) Decouple the large "if" into few smaller "if"s. 3) Remove a \n from the definition line. This makes the code more readable. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220607104946.18710-31-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-10tty/vt: consolemap: saner variable names in con_set_default_unimap()Jiri Slaby1-21/+22
The function uses too vague variable names like i, j, k for iterators, p, q, p1, p2 for pointers etc. Rename all these, so that it is clear what is going on: - dict: for dictionaries. - d, r, g: for dir, row, glyph iterators -- these are unsigned now. - dir, row: for directory and row pointers. - glyph: for the glyph. - and so on... This is a lot of shuffling, but the result pays off, IMO. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220607104946.18710-30-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-10tty/vt: consolemap: saner variable names in con_set_unimap()Jiri Slaby1-12/+12
The function uses too vague variable names like i, j, k for iterators, p, q, p1, p2 for pointers etc. Rename all these, so that it is clear what is going on: - dict: for dictionaries. - d, r, g: for dir, row, glyph iterators -- these are unsigned now. - dir, row: for directory and row pointers. - glyph: for the glyph. - and so on... This is a lot of shuffling, but the result pays off, IMO. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220607104946.18710-29-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-10tty/vt: consolemap: saner variable names in con_get_unimap()Jiri Slaby1-15/+15
The function uses too vague variable names like i, j, k for iterators, p, q, p1, p2 for pointers etc. Rename all these, so that it is clear what is going on: - dict: for dictionaries. - d, r, g: for dir, row, glyph iterators -- these are unsigned now. - dir, row: for directory and row pointers. - glyph: for the glyph. - and so on... Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220607104946.18710-28-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-10tty/vt: consolemap: saner variable names in con_copy_unimap()Jiri Slaby1-4/+4
The function uses too vague variable names like i, j, k for iterators, p, q, p1, p2 for pointers etc. Rename all these, so that it is clear what is going on: - dict: for dictionaries. - d, r, g: for dir, row, glyph iterators -- these are unsigned now. - dir, row: for directory and row pointers. - glyph: for the glyph. - and so on... This is a lot of shuffling, but the result pays off, IMO. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220607104946.18710-27-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-10tty/vt: consolemap: saner variable names in con_release_unimap()Jiri Slaby1-16/+18
The function uses too vague variable names like i, j, k for iterators, p, q, p1, p2 for pointers etc. Rename all these, so that it is clear what is going on: - dict: for dictionaries. - d, r, g: for dir, row, glyph iterators -- these are unsigned now. - dir, row: for directory and row pointers. - glyph: for the glyph. - and so on... This is a lot of shuffling, but the result pays off, IMO. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220607104946.18710-26-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-10tty/vt: consolemap: saner variable names in con_unshare_unimap()Jiri Slaby1-26/+25
The function uses too vague variable names like i, j, k for iterators, p, q, p1, p2 for pointers etc. Rename all these, so that it is clear what is going on: - dict: for dictionaries. - d, r, g: for dir, row, glyph iterators -- these are unsigned now. - dir, row: for directory and row pointers. - glyph: for the glyph. - and so on... This is a lot of shuffling, but the result pays off, IMO. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220607104946.18710-25-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-10tty/vt: consolemap: saner variable names in con_do_clear_unimap()Jiri Slaby1-13/+12
The function uses too vague variable names like i, j, k for iterators, p, q, p1, p2 for pointers etc. Rename all these, so that it is clear what is going on: - dict: for dictionaries. - d, r, g: for dir, row, glyph iterators -- these are unsigned now. - dir, row: for directory and row pointers. - glyph: for the glyph. - and so on... This is a lot of shuffling, but the result pays off, IMO. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220607104946.18710-24-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-10tty/vt: consolemap: saner variable names in con_unify_unimap()Jiri Slaby1-25/+24
The function uses too vague variable names like i, j, k for iterators, p, q, p1, p2 for pointers etc. Rename all these, so that it is clear what is going on: - dict: for dictionaries. - d, r, g: for dir, row, glyph iterators -- these are unsigned now. - dir, row: for directory and row pointers. - glyph: for the glyph. - and so on... This is a lot of shuffling, but the result pays off, IMO. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220607104946.18710-23-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-10tty/vt: consolemap: saner variable names in con_insert_unipair()Jiri Slaby1-13/+13
The function uses too vague variable names like i, j, k for iterators, p, q, p1, p2 for pointers etc. Rename all these, so that it is clear what is going on: - dict: for dictionaries. - d, r, g: for dir, row, glyph iterators -- these are unsigned now. - dir, row: for directory and row pointers. - glyph: for the glyph. - and so on... This is a lot of shuffling, but the result pays off, IMO. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220607104946.18710-22-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-10tty/vt: consolemap: saner variable names in conv_uni_to_pc()Jiri Slaby1-9/+8
The function uses too vague variable names like i, j, k for iterators, p, q, p1, p2 for pointers etc. Rename all these, so that it is clear what is going on: - dict: for dictionaries. - d, r, g: for dir, row, glyph iterators -- these are unsigned now. - dir, row: for directory and row pointers. - glyph: for the glyph. - and so on... Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20220607104946.18710-21-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>