summaryrefslogtreecommitdiff
path: root/drivers/tty/vt/vt.c
AgeCommit message (Collapse)Author
2021-10-06tty: Fix out-of-bound vmalloc access in imageblitIgor Matheus Andrade Torrente
[ Upstream commit 3b0c406124719b625b1aba431659f5cdc24a982c ] This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values. If this struct is the same as the previous ioctl, the vc_resize() detects it and doesn't call the resize_screen(), leaving the fb_var_screeninfo incomplete. And this leads to the updatescrollmode() calculates a wrong value to fbcon_display->vrows, which makes the real_y() return a wrong value of y, and that value, eventually, causes the imageblit to access an out-of-bound address value. To solve this issue I made the resize_screen() be called even if the screen does not need any resizing, so it will "fix and fill" the fb_var_screeninfo independently. Cc: stable <stable@vger.kernel.org> # after 5.15-rc2 is out, give it time to bake Reported-and-tested-by: syzbot+858dc7a2f7ef07c2c219@syzkaller.appspotmail.com Signed-off-by: Igor Matheus Andrade Torrente <igormtorrente@gmail.com> Link: https://lore.kernel.org/r/20210628134509.15895-1-igormtorrente@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-26tty: vt: always invoke vc->vc_sw->con_resize callbackTetsuo Handa
commit ffb324e6f874121f7dce5bdae5e05d02baae7269 upstream. syzbot is reporting OOB write at vga16fb_imageblit() [1], for resize_screen() from ioctl(VT_RESIZE) returns 0 without checking whether requested rows/columns fit the amount of memory reserved for the graphical screen if current mode is KD_GRAPHICS. ---------- #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <sys/ioctl.h> #include <linux/kd.h> #include <linux/vt.h> int main(int argc, char *argv[]) { const int fd = open("/dev/char/4:1", O_RDWR); struct vt_sizes vt = { 0x4100, 2 }; ioctl(fd, KDSETMODE, KD_GRAPHICS); ioctl(fd, VT_RESIZE, &vt); ioctl(fd, KDSETMODE, KD_TEXT); return 0; } ---------- Allow framebuffer drivers to return -EINVAL, by moving vc->vc_mode != KD_GRAPHICS check from resize_screen() to fbcon_resize(). Link: https://syzkaller.appspot.com/bug?extid=1f29e126cf461c4de3b3 [1] Reported-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com> Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Tested-by: syzbot <syzbot+1f29e126cf461c4de3b3@syzkaller.appspotmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-11-10vt: Disable KD_FONT_OP_COPYDaniel Vetter
commit 3c4e0dff2095c579b142d5a0693257f1c58b4804 upstream. It's buggy: On Fri, Nov 06, 2020 at 10:30:08PM +0800, Minh Yuan wrote: > We recently discovered a slab-out-of-bounds read in fbcon in the latest > kernel ( v5.10-rc2 for now ). The root cause of this vulnerability is that > "fbcon_do_set_font" did not handle "vc->vc_font.data" and > "vc->vc_font.height" correctly, and the patch > <https://lkml.org/lkml/2020/9/27/223> for VT_RESIZEX can't handle this > issue. > > Specifically, we use KD_FONT_OP_SET to set a small font.data for tty6, and > use KD_FONT_OP_SET again to set a large font.height for tty1. After that, > we use KD_FONT_OP_COPY to assign tty6's vc_font.data to tty1's vc_font.data > in "fbcon_do_set_font", while tty1 retains the original larger > height. Obviously, this will cause an out-of-bounds read, because we can > access a smaller vc_font.data with a larger vc_font.height. Further there was only one user ever. - Android's loadfont, busybox and console-tools only ever use OP_GET and OP_SET - fbset documentation only mentions the kernel cmdline font: option, not anything else. - systemd used OP_COPY before release 232 published in Nov 2016 Now unfortunately the crucial report seems to have gone down with gmane, and the commit message doesn't say much. But the pull request hints at OP_COPY being broken https://github.com/systemd/systemd/pull/3651 So in other words, this never worked, and the only project which foolishly every tried to use it, realized that rather quickly too. Instead of trying to fix security issues here on dead code by adding missing checks, fix the entire thing by removing the functionality. Note that systemd code using the OP_COPY function ignored the return value, so it doesn't matter what we're doing here really - just in case a lone server somewhere happens to be extremely unlucky and running an affected old version of systemd. The relevant code from font_copy_to_all_vcs() in systemd was: /* copy font from active VT, where the font was uploaded to */ cfo.op = KD_FONT_OP_COPY; cfo.height = vcs.v_active-1; /* tty1 == index 0 */ (void) ioctl(vcfd, KDFONTOP, &cfo); Note this just disables the ioctl, garbage collecting the now unused callbacks is left for -next. v2: Tetsuo found the old mail, which allowed me to find it on another archive. Add the link too. Acked-by: Peilin Ye <yepeilin.cs@gmail.com> Reported-by: Minh Yuan <yuanmingbuaa@gmail.com> References: https://lists.freedesktop.org/archives/systemd-devel/2016-June/036935.html References: https://github.com/systemd/systemd/pull/3651 Cc: Greg KH <greg@kroah.com> Cc: Peilin Ye <yepeilin.cs@gmail.com> Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Link: https://lore.kernel.org/r/20201108153806.3140315-1-daniel.vetter@ffwll.ch Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-01tty: vt, consw->con_scrolldelta cleanupJiri Slaby
commit 97293de977365fe672daec2523e66ef457104921 upstream. * allow NULL consw->con_scrolldelta (some consoles define an empty hook) * => remove empty hooks now * return value of consw->con_scrolldelta is never checked => make the function void * document consw->con_scrolldelta a bit Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: Thomas Winischhofer <thomas@winischhofer.net> Cc: linux-usb@vger.kernel.org Cc: Jean-Christophe Plagniol-Villard <plagnioj@jcrosoft.com> Cc: Tomi Valkeinen <tomi.valkeinen@ti.com> Cc: "James E.J. Bottomley" <jejb@parisc-linux.org> Cc: Helge Deller <deller@gmx.de> Cc: linux-fbdev@vger.kernel.org Cc: linux-parisc@vger.kernel.org Cc: Ajay Kaher <akaher@vmware.com> [ for 4.4.y backport, only do the first change above, to prevent .con_scrolldelta from being called if not present - gregkh] Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-09-03vt: defer kfree() of vc_screenbuf in vc_do_resize()Tetsuo Handa
commit f8d1653daec02315e06d30246cff4af72e76e54e upstream. syzbot is reporting UAF bug in set_origin() from vc_do_resize() [1], for vc_do_resize() calls kfree(vc->vc_screenbuf) before calling set_origin(). Unfortunately, in set_origin(), vc->vc_sw->con_set_origin() might access vc->vc_pos when scroll is involved in order to manipulate cursor, but vc->vc_pos refers already released vc->vc_screenbuf until vc->vc_pos gets updated based on the result of vc->vc_sw->con_set_origin(). Preserving old buffer and tolerating outdated vc members until set_origin() completes would be easier than preventing vc->vc_sw->con_set_origin() from accessing outdated vc members. [1] https://syzkaller.appspot.com/bug?id=6649da2081e2ebdc65c0642c214b27fe91099db3 Reported-by: syzbot <syzbot+9116ecc1978ca3a12f43@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/1596034621-4714-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual consoleEric Biggers
commit ca4463bf8438b403596edd0ec961ca0d4fbe0220 upstream. The VT_DISALLOCATE ioctl can free a virtual console while tty_release() is still running, causing a use-after-free in con_shutdown(). This occurs because VT_DISALLOCATE considers a virtual console's 'struct vc_data' to be unused as soon as the corresponding tty's refcount hits 0. But actually it may be still being closed. Fix this by making vc_data be reference-counted via the embedded 'struct tty_port'. A newly allocated virtual console has refcount 1. Opening it for the first time increments the refcount to 2. Closing it for the last time decrements the refcount (in tty_operations::cleanup() so that it happens late enough), as does VT_DISALLOCATE. Reproducer: #include <fcntl.h> #include <linux/vt.h> #include <sys/ioctl.h> #include <unistd.h> int main() { if (fork()) { for (;;) close(open("/dev/tty5", O_RDWR)); } else { int fd = open("/dev/tty10", O_RDWR); for (;;) ioctl(fd, VT_DISALLOCATE, 5); } } KASAN report: BUG: KASAN: use-after-free in con_shutdown+0x76/0x80 drivers/tty/vt/vt.c:3278 Write of size 8 at addr ffff88806a4ec108 by task syz_vt/129 CPU: 0 PID: 129 Comm: syz_vt Not tainted 5.6.0-rc2 #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20191223_100556-anatol 04/01/2014 Call Trace: [...] con_shutdown+0x76/0x80 drivers/tty/vt/vt.c:3278 release_tty+0xa8/0x410 drivers/tty/tty_io.c:1514 tty_release_struct+0x34/0x50 drivers/tty/tty_io.c:1629 tty_release+0x984/0xed0 drivers/tty/tty_io.c:1789 [...] Allocated by task 129: [...] kzalloc include/linux/slab.h:669 [inline] vc_allocate drivers/tty/vt/vt.c:1085 [inline] vc_allocate+0x1ac/0x680 drivers/tty/vt/vt.c:1066 con_install+0x4d/0x3f0 drivers/tty/vt/vt.c:3229 tty_driver_install_tty drivers/tty/tty_io.c:1228 [inline] tty_init_dev+0x94/0x350 drivers/tty/tty_io.c:1341 tty_open_by_driver drivers/tty/tty_io.c:1987 [inline] tty_open+0x3ca/0xb30 drivers/tty/tty_io.c:2035 [...] Freed by task 130: [...] kfree+0xbf/0x1e0 mm/slab.c:3757 vt_disallocate drivers/tty/vt/vt_ioctl.c:300 [inline] vt_ioctl+0x16dc/0x1e30 drivers/tty/vt/vt_ioctl.c:818 tty_ioctl+0x9db/0x11b0 drivers/tty/tty_io.c:2660 [...] Fixes: 4001d7b7fc27 ("vt: push down the tty lock so we can see what is left to tackle") Cc: <stable@vger.kernel.org> # v3.4+ Reported-by: syzbot+522643ab5729b0421998@syzkaller.appspotmail.com Acked-by: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Eric Biggers <ebiggers@google.com> Link: https://lore.kernel.org/r/20200322034305.210082-2-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-02vt: selection, introduce vc_is_selJiri Slaby
commit dce05aa6eec977f1472abed95ccd71276b9a3864 upstream. Avoid global variables (namely sel_cons) by introducing vc_is_sel. It checks whether the parameter is the current selection console. This will help putting sel_cons to a struct later. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Link: https://lore.kernel.org/r/20200219073951.16151-1-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-11vt: selection, push console lock downJiri Slaby
commit 4b70dd57a15d2f4685ac6e38056bad93e81e982f upstream. We need to nest the console lock in sel_lock, so we have to push it down a bit. Fortunately, the callers of set_selection_* just lock the console lock around the function call. So moving it down is easy. In the next patch, we switch the order. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Fixes: 07e6124a1a46 ("vt: selection, close sel_buffer race") Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20200228115406.5735-1-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-06vt: invoke notifier on screen size changeNicolas Pitre
commit 0c9b1965faddad7534b6974b5b36c4ad37998f8e upstream. User space using poll() on /dev/vcs devices are not awaken when a screen size change occurs. Let's fix that. Signed-off-by: Nicolas Pitre <nico@linaro.org> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-04-08vt: change SGR 21 to follow the standardsMike Frysinger
commit 65d9982d7e523a1a8e7c9af012da0d166f72fc56 upstream. ECMA-48 [1] (aka ISO 6429) has defined SGR 21 as "doubly underlined" since at least March 1984. The Linux kernel has treated it as SGR 22 "normal intensity" since it was added in Linux-0.96b in June 1992. Before that, it was simply ignored. Other terminal emulators have either ignored it, or treat it as double underline now. xterm for example added support in its 304 release (May 2014) [2] where it was previously ignoring it. Changing this behavior shouldn't be an issue: - It isn't a named capability in ncurses's terminfo database, so no script is using libtinfo/libcurses to look this up, or using tput to query & output the right sequence. - Any script assuming SGR 21 will reset intensity in all terminals already do not work correctly on non-Linux VTs (including running under screen/tmux/etc...). - If someone has written a script that only runs in the Linux VT, and they're using SGR 21 (instead of SGR 22), the output should still be readable. imo it's important to change this as the Linux VT's non-conformance is sometimes used as an argument for other terminal emulators to not implement SGR 21 at all, or do so incorrectly. [1]: https://www.ecma-international.org/publications/standards/Ecma-048.htm [2]: https://github.com/ThomasDickey/xterm-snapshots/commit/2fd29cb98d214cb536bcafbee00bc73b3f1eeb9d Signed-off-by: Mike Frysinger <vapier@chromium.org> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-28tty: vt: fix up tabstops properlyLinus Torvalds
commit f1869a890cdedb92a3fab969db5d0fd982850273 upstream. Tabs on a console with long lines do not wrap properly, so correctly account for the line length when computing the tab placement location. Reported-by: James Holderness <j4_james@hotmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: stable <stable@vger.kernel.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-21vt: fix unchecked __put_user() in tioclinux ioctlsAdam Borowski
commit 6987dc8a70976561d22450b5858fc9767788cc1c upstream. Only read access is checked before this call. Actually, at the moment this is not an issue, as every in-tree arch does the same manual checks for VERIFY_READ vs VERIFY_WRITE, relying on the MMU to tell them apart, but this wasn't the case in the past and may happen again on some odd arch in the future. If anyone cares about 3.7 and earlier, this is a security hole (untested) on real 80386 CPUs. Signed-off-by: Adam Borowski <kilobyte@angband.pl> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-11-10tty: vt, fix bogus division in csi_JJiri Slaby
commit 42acfc6615f47e465731c263bee0c799edb098f2 upstream. In csi_J(3), the third parameter of scr_memsetw (vc_screenbuf_size) is divided by 2 inappropriatelly. But scr_memsetw expects size, not count, because it divides the size by 2 on its own before doing actual memset-by-words. So remove the bogus division. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: Petr Písař <ppisar@redhat.com> Fixes: f8df13e0a9 (tty: Clean console safely) Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-11-10tty: limit terminal size to 4M charsDmitry Vyukov
commit 32b2921e6a7461fe63b71217067a6cf4bddb132f upstream. Size of kmalloc() in vc_do_resize() is controlled by user. Too large kmalloc() size triggers WARNING message on console. Put a reasonable upper bound on terminal size to prevent WARNINGs. Signed-off-by: Dmitry Vyukov <dvyukov@google.com> CC: David Rientjes <rientjes@google.com> Cc: One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Jiri Slaby <jslaby@suse.com> Cc: Peter Hurley <peter@hurleysoftware.com> Cc: linux-kernel@vger.kernel.org Cc: syzkaller@googlegroups.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-11-10vt: clear selection before resizingScot Doyle
commit 009e39ae44f4191188aeb6dfbf661b771dbbe515 upstream. When resizing a vt its selection may exceed the new size, resulting in an invalid memory access [1]. Clear the selection before resizing. [1] http://lkml.kernel.org/r/CACT4Y+acDTwy4umEvf5ROBGiRJNrxHN4Cn5szCXE5Jw-d1B=Xw@mail.gmail.com Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Scot Doyle <lkml14@scotdoyle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-07-27tty: vt: Fix soft lockup in fbcon cursor blink timer.David Daney
commit 1b45996d2ebf9680ccd0db875fc668aa025f40fd upstream. We are getting somewhat random soft lockups with this signature: [ 86.992215] [<fffffc00080935e0>] el1_irq+0xa0/0x10c [ 86.997082] [<fffffc000841822c>] cursor_timer_handler+0x30/0x54 [ 87.002991] [<fffffc000810ec44>] call_timer_fn+0x54/0x1a8 [ 87.008378] [<fffffc000810ef88>] run_timer_softirq+0x1c4/0x2bc [ 87.014200] [<fffffc000809077c>] __do_softirq+0x114/0x344 [ 87.019590] [<fffffc00080af45c>] irq_exit+0x74/0x98 [ 87.024458] [<fffffc00080fac20>] __handle_domain_irq+0x98/0xfc [ 87.030278] [<fffffc000809056c>] gic_handle_irq+0x94/0x190 This is caused by the vt visual_init() function calling into fbcon_init() with a vc_cur_blink_ms value of zero. This is a transient condition, as it is later set to a non-zero value. But, if the timer happens to expire while the blink rate is zero, it goes into an endless loop, and we get soft lockup. The fix is to initialize vc_cur_blink_ms before calling the con_init() function. Signed-off-by: David Daney <david.daney@cavium.com> Acked-by: Pavel Machek <pavel@ucw.cz> Tested-by: Ming Lei <ming.lei@canonical.com> Acked-by: Scot Doyle <lkml14@scotdoyle.com> Tested-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-06-01tty: vt, return error when con_startup failsJiri Slaby
commit 6798df4c5fe0a7e6d2065cf79649a794e5ba7114 upstream. When csw->con_startup() fails in do_register_con_driver, we return no error (i.e. 0). This was changed back in 2006 by commit 3e795de763. Before that we used to return -ENODEV. So fix the return value to be -ENODEV in that case again. Fixes: 3e795de763 ("VT binding: Add binding/unbinding support for the VT console") Signed-off-by: Jiri Slaby <jslaby@suse.cz> Reported-by: "Dan Carpenter" <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-07-23tty/vt: Fix the memory leak in visual_initDongxing Zhang
If vc->vc_uni_pagedir_loc is not NULL, its refcount needs to be decreased before vc_uni_pagedir_loc is re-assigned. unreferenced object 0xffff88002cdd13b0 (size 512): comm "setfont", pid 503, jiffies 4294896503 (age 722.828s) hex dump (first 32 bytes): 40 92 61 2b 00 88 ff ff 00 00 00 00 00 00 00 00 @.a+............ 00 00 00 00 00 00 00 00 a0 ad 61 2b 00 88 ff ff ..........a+.... backtrace: [<ffffffff817b755e>] kmemleak_alloc+0x4e/0xb0 [<ffffffff811d4898>] kmem_cache_alloc_trace+0x1c8/0x240 [<ffffffff814ae7d3>] con_do_clear_unimap.isra.2+0x83/0xe0 [<ffffffff814ae9b2>] con_clear_unimap+0x22/0x40 [<ffffffff814a8db8>] vt_ioctl+0xeb8/0x1170 [<ffffffff8149b458>] tty_ioctl+0x208/0xca0 [<ffffffff81207858>] do_vfs_ioctl+0x2f8/0x510 [<ffffffff81207af1>] SyS_ioctl+0x81/0xa0 [<ffffffff817ca2b2>] system_call_fastpath+0x16/0x75 [<ffffffffffffffff>] 0xffffffffffffffff unreferenced object 0xffff88002b619240 (size 256): comm "setfont", pid 503, jiffies 4294896503 (age 722.828s) hex dump (first 32 bytes): 90 bc 84 d5 00 88 ff ff 58 85 84 d5 00 88 ff ff ........X....... 88 ac 84 d5 00 88 ff ff e0 b1 84 d5 00 88 ff ff ................ backtrace: [<ffffffff817b755e>] kmemleak_alloc+0x4e/0xb0 [<ffffffff811d4898>] kmem_cache_alloc_trace+0x1c8/0x240 [<ffffffff814ae286>] con_insert_unipair+0x86/0x170 [<ffffffff814af107>] con_set_unimap+0x1b7/0x280 [<ffffffff814a8d65>] vt_ioctl+0xe65/0x1170 [<ffffffff8149b458>] tty_ioctl+0x208/0xca0 [<ffffffff81207858>] do_vfs_ioctl+0x2f8/0x510 [<ffffffff81207af1>] SyS_ioctl+0x81/0xa0 [<ffffffff817ca2b2>] system_call_fastpath+0x16/0x75 [<ffffffffffffffff>] 0xffffffffffffffff Signed-off-by: Dongxing Zhang <dongxing.zhang@intel.com> Signed-off-by: Xiaoming Wang <xiaoming.wang@intel.com> Reviewed-by: Peter Hurley <peter@hurleysoftware.com> Tested-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-05-10vt: Don't check KD_GRAPHICS when binding/unbindingDaniel Vetter
This was introduced in commit 6db4063c5b72b46e9793b0f141a7a3984ac6facf Author: Antonino A. Daplas <adaplas@gmail.com> Date: Mon Jun 26 00:27:12 2006 -0700 [PATCH] VT binding: Add sysfs control to the VT layer with the justification "In addition, if any of the consoles are in KD_GRAPHICS mode, binding and unbinding will not succeed. KD_GRAPHICS mode usually indicates that the underlying console hardware is used for other purposes other than displaying text (ie X). This feature should prevent binding/unbinding from interfering with a graphics application using the VT." I think we should lift this artificial restriction though: - KD_GRAPHICS doesn't get cleaned up automatically, which means it's easy to have terminals stuck in KD_GRAPHICS when hacking around on X. - X doesn't really care, especially with drm where kms already blocks fbdev (and hence fbcon) when there's an active compositor. - This is a root-only interface with a separate .config option and it's possible to hang your machine already anyway if you unload/reload drivers and don't know what you're doing. With this patch i915.ko module reloading works again reliably, something in the recent fedora upgrades broke things. Cc: Antonino A. Daplas <adaplas@gmail.com> Cc: Peter Hurley <peter@hurleysoftware.com> Cc: Imre Deak <imre.deak@intel.com> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Acked-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-05-10vt: fix console lock vs. kernfs s_active lock orderImre Deak
Currently there is a lock order problem between the console lock and the kernfs s_active lock of the console driver's bind sysfs entry. When writing to the sysfs entry the lock order is first s_active then console lock, when unregistering the console driver via do_unregister_con_driver() the order is the opposite. See the below bugzilla reference for one instance of a lockdep backtrace. Fix this by unregistering the console driver from a deferred work, where we can safely drop the console lock while unregistering the device and corresponding sysfs entries (which in turn acquire s_active). Note that we have to keep the console driver slot in the registered_con_driver array reserved for the driver that's being unregistered until it's fully removed. Otherwise a concurrent call to do_register_con_driver could try to reuse the same slot and fail when registering the corresponding device with a minor index that's still in use. Note that the referenced bug report contains two dmesg logs with two distinct lockdep reports: [1] is about a locking scenario involving s_active, console_lock and the fb_notifier list lock, while [2] is about a locking scenario involving only s_active and console_lock. In [1] locking fb_notifier triggers the lockdep warning only because of its dependence on console_lock, otherwise case [1] is the same s_active<->console_lock dependency problem fixed by this patch. Before this change we have the following locking scenarios involving the 3 locks: a) via do_unregister_framebuffer()->...->do_unregister_con_driver(): 1. console lock 2. fb_notifier lock 3. s_active lock b) for example via give_up_console()->do_unregister_con_driver(): 1. console lock 2. s_active lock c) via vt_bind()/vt_unbind(): 1. s_active lock 2. console lock Since c) is the console bind sysfs entry's write code path we can't change the locking order there. We can only fix this issue by removing s_active's dependence on the other two locks in a) and b). We can do this only in the vt code which owns the corresponding sysfs entry, so that after the change we have: a) 1. console lock 2. fb_notifier lock b) 1. console lock c) 1. s_active lock 2. console lock d) in the new con_driver_unregister_callback(): 1. s_active lock [1] https://bugs.freedesktop.org/attachment.cgi?id=87716 [2] https://bugs.freedesktop.org/attachment.cgi?id=107602 v2: - get console_lock earlier in con_driver_unregister_callback(), so we protect the following console driver field assignments there - add code coment explaining the reason for deferring the sysfs entry removal - add a third paragraph to the commit message explaining why there are two distinct lockdep reports and that this issue is independent of fb/fbcon. (Peter Hurley) v3: - clarify further the third paragraph v4: - rebased on v4 of patch 1/3 Signed-off-by: Imre Deak <imre.deak@intel.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-05-10vt: add cursor blink interval escape sequenceScot Doyle
Add an escape sequence to specify the current console's cursor blink interval. The interval is specified as a number of milliseconds until the next cursor display state toggle, from 50 to 65535. /proc/loadavg did not show a difference with a one msec interval, but the lower bound is set to 50 msecs since slower hardware wasn't tested. Store the interval in the vc_data structure for later access by fbcon, initializing the value to fbcon's current hardcoded value of 200 msecs. Signed-off-by: Scot Doyle <lkml14@scotdoyle.com> Acked-by: Pavel Machek <pavel@ucw.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-03-26tty: Use static attribute groups for sysfs entriesTakashi Iwai
Instead of manual calls of device_create_file() and device_remove_file(), pass the static attribute groups using device_create_with_groups(). Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-03-07vt: use msecs_to_jiffies for time conversionNicholas Mc Guire
Converting milliseconds to jiffies by "val * HZ / 1000" is technically OK but msecs_to_jiffies(val) is the cleaner solution and handles all corner cases correctly. This is a minor API consolidation only and should make things more readable. Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org> Reviewed-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-03-07tty: vt/vt: fix sparse warningLad, Prabhakar
this patch fixes following sparse warning: vt.c:1240:12: warning: symbol 'rgb_from_256' was not declared. Should it be static? Signed-off-by: Lad, Prabhakar <prabhakar.csengg@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-02-02vt: provide notifications on selection changesNicolas Pitre
The vcs device's poll/fasync support relies on the vt notifier to signal changes to the screen content. Notifier invocations were missing for changes that comes through the selection interface though. Fix that. Tested with BRLTTY 5.2. Signed-off-by: Nicolas Pitre <nico@linaro.org> Cc: Dave Mielke <dave@mielke.cc> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-01-09vt: fix locking around vt_bind/vt_unbindImre Deak
Currently vt_bind and vt_unbind access at least the con_driver object and registered_con_driver array without holding the console lock. Fix this by locking around the whole function in each case. Signed-off-by: Imre Deak <imre.deak@intel.com> Reviewed-by: Peter Hurley <peter@hurleysoftware.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-01-09vt: fix check for system/busy console drivers when unregistering themImre Deak
The default console driver (conswitchp) and busy drivers bound to a console (as reported by con_is_bound()) shouldn't be unregistered. System console drivers (without the CON_DRIVER_FLAG_MODULE flag) can be unregistered, provided they are neither default nor busy. The current code checks for the CON_DRIVER_FLAG_INIT flag but this doesn't make sense: this flag is set for a driver whenever its associated console's con_startup() function is called, which first happens when the console driver is registered (so before the console gets bound) and gets cleared when the console gets unbound. The purpose of this flag is to show if we need to call con_startup() on a console before we use it. Based on the above, do_unregister_con_driver() in its current form will allow unregistering a console driver only if it was never bound, but will refuse to unregister one that was bound and later unbound. Fix this by dropping the CON_DRIVER_FLAG_INIT check, allowing unregistering of any console driver provided that it's not the default one and it's not busy. v2: - reword the third paragraph to clarify how the fix works (Peter Hurley) v3: - unchanged v4: - Allow unregistering a system console driver too, needed by i915 to unregister vgacon. Update commit description accordingly. (Daniel) Signed-off-by: Imre Deak <imre.deak@intel.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-11-25tty: pr_warning->pr_warn and logging neateningJoe Perches
Convert the pr_warning to the more common pr_warn. Other miscellanea: o Convert unusual PR_FMT define and uses to pr_fmt o Remove unnecessary OOM message o Fix grammar in an error message o Convert a pr_warning with a KERN_ERR to pr_err Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-11-22vt: Fix build breakage when !CONFIG_VT_CONSOLEPeter Hurley
Commit 68952076e9226cc23ebce66d3fc2fdb8b6c04c30 ("vt: Remove vt_get_kmsg_redirect() from uapi header") fails to compile if !CONFIG_VT_CONSOLE. Move macro definition for vt_get_kmsg_redirect() up with file-scope function declarations. Reported-by: Jim Davis <jim.epost@gmail.com> Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-11-05tty:vt remove obsolete struct initializerPeng Fan
This patch fixes sparse warning: "obsolete struct initializer, use C99 syntax" Signed-off-by: Peng Fan <van.freenix@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-11-05vt: Remove vt_get_kmsg_redirect() from uapi headerPeter Hurley
vt_get_kmsg_redirect() only has meaning to the console driver as an alias for calling vt_kmsg_redirect(). Move the macro definition to the only source file which uses it; remove from uapi/linux/vt.h Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-06-19Merge tag 'drm-intel-fixes-2014-06-17' of ↵Dave Airlie
git://anongit.freedesktop.org/drm-intel into drm-next First round of fixes for 3.16-rc, mostly cc: stable, and the vt/vgacon fixes from Daniel [1] to avoid hangs and unclaimed register errors on module load/reload. * tag 'drm-intel-fixes-2014-06-17' of git://anongit.freedesktop.org/drm-intel: drm/i915/bdw: remove erroneous chv specific workarounds from bdw code drm/i915: fix possible refcount leak when resetting forcewake drm/i915: Reorder semaphore deadlock check drm/i95: Initialize active ring->pid to -1 drm/i915: set backlight duty cycle after backlight enable for gen4 drm/i915: Avoid div-by-zero when pixel_multiplier is zero drm/i915: Disable FBC by default also on Haswell and later drm/i915: Kick out vga console drm/i915: Fixup global gtt cleanup vt: Don't ignore unbind errors in vt_unbind vt: Fix up unregistration of vt drivers vt: Fix replacement console check when unbinding
2014-06-06vt: Don't ignore unbind errors in vt_unbindDaniel Vetter
Otherwise the loop will never stop since we don't make any forward progress. Noticed while breaking this accidentally in a painful attempt to make vga_con unregistering work. With this patch we'll bail out on the first attempt, which at least leaves a useful enough system behind for debugging. Livelocks on console_lock just aren't fun. Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Jiri Slaby <jslaby@suse.cz> Reviewed-by: David Herrmann <dh.herrmann@gmail.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-06-06vt: Fix up unregistration of vt driversDaniel Vetter
A bunch of issues: - We should not kick out the default console (which is tracked in conswitchp), so check for that. - Add better error codes so callers can differentiate between "something went wrong" and "your driver isn't registered already". i915 needs that so it doesn't fall over when reloading the driver and hence vga_con is already unregistered. - There's a mess with the driver flags: What we need to check for is that the driver isn't used any more, i.e. unbound completely (FLAG_INIT). And not whether it's the boot console or not (which is the only one which doesn't have FLAG_MODULE). Otherwise there's no way to kick out the boot console, which i915 wants to do to prevent havoc with vga_con interferring (which tends to hang machines). Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Jiri Slaby <jslaby@suse.cz> Reviewed-by: David Herrmann <dh.herrmann@gmail.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-06-06vt: Fix replacement console check when unbindingDaniel Vetter
I don't fully understand the magic of the vt register/unregister logic, but apparently everything but the inital console (as set in the conswitchp pointer) is marked with FLAG_MODULE. Which means if something unregistered the boot vt driver (e.g. i915.ko kicking out vga_con) there's nothing left when trying to unbind e.g. fbcon through sysfs. But in most cases have the dummy console hanging around besides the boot console, so this test is fairly dubious. What we actually want is simply a different console than the one we want to unbind. v2: Correct the commit message to clarify that the dummy console isn't always around, but only in most cases (David). Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Jiri Slaby <jslaby@suse.cz> Cc: David Herrmann <dh.herrmann@gmail.com> Reviewed-by: David Herrmann <dh.herrmann@gmail.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2014-05-28console: Use explicit pointer type for vc_uni_pagedir* fieldsTakashi Iwai
The vc_data.vc_uni_pagedir filed is currently long int, supposedly to be served generically. This, however, leads to lots of cast to pointer, and rather it worsens the readability significantly. Actually, we have now only a single uni_pagedir map implementation, and this won't change likely. So, it'd be much more simple and error-prone to just use the exact pointer for struct uni_pagedir instead of long. Ditto for vc_uni_pagedir_loc. It's a pointer to the uni_pagedir, thus it can be changed similarly to the exact type. Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-05-28vt: emulate 8- and 24-bit colour codes.Adam Borowski
Most other mainstream terminals support "xterm256" colours, which means people sometimes use these blindly without checking capabilities. Because of hardware limitations of VGA consoles, colours are downgraded to 16 foregrounds and 8 backgrounds. On fbdev consoles it would be possible to support them without quality loss, but adding that would require quite a large amount of code. Signed-off-by: Adam Borowski <kilobyte@angband.pl> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-28vt: detect and ignore OSC codes.Adam Borowski
These can be used to send commands consisting of an arbitrary string to the terminal, most often used to set a terminal's window title or to redefine the colour palette. Our console doesn't use OSC, unlike everything else, which can lead to junk being displayed if a process sends such a code unconditionally. The rules for termination follow established practice rather than Ecma-48. Ecma-48 requires the string to use only byte values 0x08..0x0D and 0x20..0x7E, terminated with either ESC \ or 0x9C. This would disallow using 8-bit characters, which are reasonable for example in window titles. A widespread idiom is to terminate with 0x07. The behaviour for other control characters differs between terminal emulators, I followed libvte and xterm: * 0x07 and ESC anything terminate * nothing else terminates, all 8-bit values including 0x9C are considered a part of the string Signed-off-by: Adam Borowski <kilobyte@angband.pl> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-28vt: drop an useless enum and assignment.Adam Borowski
Signed-off-by: Adam Borowski <kilobyte@angband.pl> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2014-02-13vt: Fix secure clear screenPetr Písař
\E[3J console code (secure clear screen) needs to update_screen(vc) in order to write-through blanks into off-screen video memory. This has been removed accidentally in 3.6 by: commit 81732c3b2fede049a692e58a7ceabb6d18ffb18c Author: Jean-François Moine <moinejf@free.fr> Date: Thu Sep 6 19:24:13 2012 +0200 tty vt: Fix line garbage in virtual console on command line edition Signed-off-by: Petr Písař <petr.pisar@atlas.cz> Cc: stable <stable@vger.kernel.org> # 3.6 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-09-26vt: properly ignore xterm-256 colour codesAdam Borowski
This is not a bug on our side, but a misdesign in ITU T.416, yet with all popular terminals supporting these codes, people consider this to be a bug in Linux. By breaking the design principles behind SGR codes (gracefully ignoring unsupported ones should not require knowing about them), 256 colour ones tend to turn blinking on before invoking an arbitrary unrelated command. This commit doesn't add such support, merely skips such codes without ill effects. Signed-off-by: Adam Borowski <kilobyte@angband.pl> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-09-26vt: break a couple of obsolete SCOish codes.Adam Borowski
No modern terminal supports them, and SGR 38 conflicts with detecting xterm-256 colours. This also makes SGR 39 consistent with other popular terminals. Neither are used by ncurses' terminfo. Signed-off-by: Adam Borowski <kilobyte@angband.pl> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-08-05vt: make the default color configurableClemens Ladisch
The virtual console has (undocumented) module parameters to set the colors for italic and underlined text, but the default text color was hardcoded for some reason. This made it impossible to change the color for startup messages, or to set the default for new virtual consoles. Add a module parameter for that, and document the entire bunch. Any hacker who thinks that a command prompt on a "black screen with white font" is not supicious enough can now use the kernel parameter vt.color=10 to get a nice, evil green. Signed-off-by: Clemens Ladisch <clemens@ladisch.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-07-23tty: Convert termios_mutex to termios_rwsemPeter Hurley
termios is commonly accessed unsafely (especially by N_TTY) because the existing mutex forces exclusive access. Convert existing usage. Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-05-27Merge 3.10-rc3 into tty-nextGreg Kroah-Hartman
We want these fixes. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-05-20TTY:vt: convert remain take_over_console's users to do_take_over_consoleWang YanQing
Impact: 1:convert all remain take_over_console to do_take_over_console 2:update take_over_console to do_take_over_console in comment Commit dc9641895abb ("vt: delete unneeded functions register_con_driver|take_over_console") delete take_over_console, but forget to convert remain take_over_console's users to new API do_take_over_console, this patch fix it. Reported-by: Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by: Wang YanQing <udknight@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-05-20vt: delete unneeded function unregister_con_driverWang YanQing
Now there is no place use unregister_con_driver, and we can achieve unregister_con_driver's function with unregister_con_driver easily, so just delete it to reduce code size and duplication. Signed-off-by: Wang YanQing <udknight@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-05-20fbcon: convert last two unregister_con_driver call to do_unregister_con_driverWang YanQing
There are only two place use unregister_con_driver now, this patch convert them to do_unregister_con_driver too, then we can delete unregister_con_driver whos function can be achieved with do_unregister_con_driver easily to reduce code size and duplication. Signed-off-by: Wang YanQing <udknight@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-05-20vt: delete unneeded function bind_con_driverWang YanQing
Now there is no place use bind_con_driver, and do_bind_con_driver can achieve bind_con_driver's function easily, so just delete it to reduce code size and duplication. Signed-off-by: Wang YanQing <udknight@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2013-05-20vt: convert last bind_con_driver call to do_bind_con_driverWang YanQing
There is only one place use bind_con_driver now, this patch convert it to do_bind_con_driver too, then we can delete bind_con_driver whos function can be replaced by do_bind_con_driver easily to reduce code size and duplication. Signed-off-by: Wang YanQing <udknight@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
generated by cgit v1.2.3 (git 2.0.4) at 2024-06-04 12:54:41 +0000