user/sven/linux.git/drivers/tty/vt, branch v5.11.9

vt/consolemap: do font sum unsigned

2021-03-07T11:35:49Z

[ Upstream commit 9777f8e60e718f7b022a94f2524f967d8def1931 ] The constant 20 makes the font sum computation signed which can lead to sign extensions and signed wraps. It's not much of a problem as we build with -fno-strict-overflow. But if we ever decide not to, be ready, so switch the constant to unsigned. Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20210105120239.28031-7-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

tty: Fix whitespace inconsistencies in vt_io_ioctl

2020-12-09T14:35:43Z

Replaces spaces with tabs for indentation. Signed-off-by: Yan.Gao Link: https://lore.kernel.org/r/20201209030551.48029-1-gao.yanB@h3c.com Signed-off-by: Greg Kroah-Hartman

vt: keyboard, make use of assign_bit() API

2020-11-12T08:43:51Z

We have for some time the assign_bit() API to replace open coded if (foo) set_bit(n, bar); else clear_bit(n, bar); Use this API in VT keyboard library code. Acked-by: Jiri Slaby Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20201109105601.47159-3-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman

vt: keyboard, replace numbers with \r, \n where appropriate

2020-11-12T08:43:51Z

Instead of 10, 13 use \n, \r respectively. Acked-by: Jiri Slaby Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20201109105601.47159-2-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman

vt: keyboard, use BIT() macro instead of open coded variants

2020-11-12T08:43:50Z

There are few places when BIT() macro is suitable and makes code easier to understand. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20201109105601.47159-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman

Merge 5.10-rc3 into tty-next

2020-11-09T09:37:10Z

We need the TTY/vt/serial fixes in here as well. Signed-off-by: Greg Kroah-Hartman

Merge tag 'tty-5.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2020-11-08T19:28:08Z

Pull tty/serial fixes from Greg KH: "Here are a small number of small tty and serial fixes for some reported problems for the tty core, vt code, and some serial drivers. They include fixes for: - a buggy and obsolete vt font ioctl removal - 8250_mtk serial baudrate runtime warnings - imx serial earlycon build configuration fix - txx9 serial driver error path cleanup issues - tty core fix in release_tty that can be triggered by trying to bind an invalid serial port name to a speakup console device Almost all of these have been in linux-next without any problems, the only one that hasn't, just deletes code :)" * tag 'tty-5.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: vt: Disable KD_FONT_OP_COPY tty: fix crash in release_tty if tty->port is not set serial: txx9: add missing platform_driver_unregister() on error in serial_txx9_init tty: serial: imx: enable earlycon by default if IMX_SERIAL_CONSOLE is enabled serial: 8250_mtk: Fix uart_get_baud_rate warning

vt: Disable KD_FONT_OP_COPY

2020-11-08T18:35:06Z

It's buggy: On Fri, Nov 06, 2020 at 10:30:08PM +0800, Minh Yuan wrote: > We recently discovered a slab-out-of-bounds read in fbcon in the latest > kernel ( v5.10-rc2 for now ). The root cause of this vulnerability is that > "fbcon_do_set_font" did not handle "vc->vc_font.data" and > "vc->vc_font.height" correctly, and the patch > for VT_RESIZEX can't handle this > issue. > > Specifically, we use KD_FONT_OP_SET to set a small font.data for tty6, and > use KD_FONT_OP_SET again to set a large font.height for tty1. After that, > we use KD_FONT_OP_COPY to assign tty6's vc_font.data to tty1's vc_font.data > in "fbcon_do_set_font", while tty1 retains the original larger > height. Obviously, this will cause an out-of-bounds read, because we can > access a smaller vc_font.data with a larger vc_font.height. Further there was only one user ever. - Android's loadfont, busybox and console-tools only ever use OP_GET and OP_SET - fbset documentation only mentions the kernel cmdline font: option, not anything else. - systemd used OP_COPY before release 232 published in Nov 2016 Now unfortunately the crucial report seems to have gone down with gmane, and the commit message doesn't say much. But the pull request hints at OP_COPY being broken https://github.com/systemd/systemd/pull/3651 So in other words, this never worked, and the only project which foolishly every tried to use it, realized that rather quickly too. Instead of trying to fix security issues here on dead code by adding missing checks, fix the entire thing by removing the functionality. Note that systemd code using the OP_COPY function ignored the return value, so it doesn't matter what we're doing here really - just in case a lone server somewhere happens to be extremely unlucky and running an affected old version of systemd. The relevant code from font_copy_to_all_vcs() in systemd was: /* copy font from active VT, where the font was uploaded to */ cfo.op = KD_FONT_OP_COPY; cfo.height = vcs.v_active-1; /* tty1 == index 0 */ (void) ioctl(vcfd, KDFONTOP, &cfo); Note this just disables the ioctl, garbage collecting the now unused callbacks is left for -next. v2: Tetsuo found the old mail, which allowed me to find it on another archive. Add the link too. Acked-by: Peilin Ye Reported-by: Minh Yuan References: https://lists.freedesktop.org/archives/systemd-devel/2016-June/036935.html References: https://github.com/systemd/systemd/pull/3651 Cc: Greg KH Cc: Peilin Ye Cc: Tetsuo Handa Signed-off-by: Daniel Vetter Link: https://lore.kernel.org/r/20201108153806.3140315-1-daniel.vetter@ffwll.ch Signed-off-by: Greg Kroah-Hartman

tty: vt: consolemap: Demote weakly documented function header

2020-11-06T09:49:27Z

Fixes the following W=1 kernel build warning(s): drivers/tty/vt/consolemap.c:739: warning: Function parameter or member 'ct' not described in 'con_get_unimap' drivers/tty/vt/consolemap.c:739: warning: Function parameter or member 'uct' not described in 'con_get_unimap' drivers/tty/vt/consolemap.c:739: warning: Function parameter or member 'list' not described in 'con_get_unimap' Cc: Greg Kroah-Hartman Cc: Jiri Slaby Cc: Jakub Jelinek Cc: Stanislav Voronyi Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20201104193549.4026187-10-lee.jones@linaro.org Signed-off-by: Greg Kroah-Hartman

vt: keyboard, use tty_insert_flip_string in puts_queue

2020-11-04T15:43:39Z

'puts_queue' currently loops over characters and employs the full tty buffer machinery for every character. Do the buffer allocation only once and copy all the character at once. This is achieved using tty_insert_flip_string instead of loop+tty_insert_flip_char. Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20201029113222.32640-17-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman