From: Greg Kroah-Hartman Date: Mon, 28 Jan 2019 16:20:20 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v4.9.154~31 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0e4a84f71dd444ca1100fb68b2154da7ad5e22c3;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: can-bcm-check-timer-values-before-ktime-conversion.patch can-dev-__can_get_echo_skb-fix-bogous-check-for-non-existing-skb-by-removing-it.patch can-flexcan-fix-null-pointer-exception-during-bringup.patch irqchip-gic-v3-its-align-pci-multi-msi-allocation-on-their-size.patch net-sun-cassini-cleanup-license-conflict.patch posix-cpu-timers-unbreak-timer-rearming.patch vt-always-call-notifier-with-the-console-lock-held.patch vt-invoke-notifier-on-screen-size-change.patch vt-make-vt_console_print-compatible-with-the-unicode-screen-buffer.patch --- diff --git a/queue-4.19/can-bcm-check-timer-values-before-ktime-conversion.patch b/queue-4.19/can-bcm-check-timer-values-before-ktime-conversion.patch new file mode 100644 index 00000000000..09ddd83341f --- /dev/null +++ b/queue-4.19/can-bcm-check-timer-values-before-ktime-conversion.patch @@ -0,0 +1,89 @@ +From 93171ba6f1deffd82f381d36cb13177872d023f6 Mon Sep 17 00:00:00 2001 +From: Oliver Hartkopp +Date: Sun, 13 Jan 2019 19:31:43 +0100 +Subject: can: bcm: check timer values before ktime conversion + +From: Oliver Hartkopp + +commit 93171ba6f1deffd82f381d36cb13177872d023f6 upstream. + +Kyungtae Kim detected a potential integer overflow in bcm_[rx|tx]_setup() +when the conversion into ktime multiplies the given value with NSEC_PER_USEC +(1000). + +Reference: https://marc.info/?l=linux-can&m=154732118819828&w=2 + +Add a check for the given tv_usec, so that the value stays below one second. +Additionally limit the tv_sec value to a reasonable value for CAN related +use-cases of 400 days and ensure all values to be positive. + +Reported-by: Kyungtae Kim +Tested-by: Oliver Hartkopp +Signed-off-by: Oliver Hartkopp +Cc: linux-stable # >= 2.6.26 +Tested-by: Kyungtae Kim +Acked-by: Andre Naujoks +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + net/can/bcm.c | 27 +++++++++++++++++++++++++++ + 1 file changed, 27 insertions(+) + +--- a/net/can/bcm.c ++++ b/net/can/bcm.c +@@ -67,6 +67,9 @@ + */ + #define MAX_NFRAMES 256 + ++/* limit timers to 400 days for sending/timeouts */ ++#define BCM_TIMER_SEC_MAX (400 * 24 * 60 * 60) ++ + /* use of last_frames[index].flags */ + #define RX_RECV 0x40 /* received data for this element */ + #define RX_THR 0x80 /* element not been sent due to throttle feature */ +@@ -140,6 +143,22 @@ static inline ktime_t bcm_timeval_to_kti + return ktime_set(tv.tv_sec, tv.tv_usec * NSEC_PER_USEC); + } + ++/* check limitations for timeval provided by user */ ++static bool bcm_is_invalid_tv(struct bcm_msg_head *msg_head) ++{ ++ if ((msg_head->ival1.tv_sec < 0) || ++ (msg_head->ival1.tv_sec > BCM_TIMER_SEC_MAX) || ++ (msg_head->ival1.tv_usec < 0) || ++ (msg_head->ival1.tv_usec >= USEC_PER_SEC) || ++ (msg_head->ival2.tv_sec < 0) || ++ (msg_head->ival2.tv_sec > BCM_TIMER_SEC_MAX) || ++ (msg_head->ival2.tv_usec < 0) || ++ (msg_head->ival2.tv_usec >= USEC_PER_SEC)) ++ return true; ++ ++ return false; ++} ++ + #define CFSIZ(flags) ((flags & CAN_FD_FRAME) ? CANFD_MTU : CAN_MTU) + #define OPSIZ sizeof(struct bcm_op) + #define MHSIZ sizeof(struct bcm_msg_head) +@@ -873,6 +892,10 @@ static int bcm_tx_setup(struct bcm_msg_h + if (msg_head->nframes < 1 || msg_head->nframes > MAX_NFRAMES) + return -EINVAL; + ++ /* check timeval limitations */ ++ if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head)) ++ return -EINVAL; ++ + /* check the given can_id */ + op = bcm_find_op(&bo->tx_ops, msg_head, ifindex); + if (op) { +@@ -1053,6 +1076,10 @@ static int bcm_rx_setup(struct bcm_msg_h + (!(msg_head->can_id & CAN_RTR_FLAG)))) + return -EINVAL; + ++ /* check timeval limitations */ ++ if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head)) ++ return -EINVAL; ++ + /* check the given can_id */ + op = bcm_find_op(&bo->rx_ops, msg_head, ifindex); + if (op) { diff --git a/queue-4.19/can-dev-__can_get_echo_skb-fix-bogous-check-for-non-existing-skb-by-removing-it.patch b/queue-4.19/can-dev-__can_get_echo_skb-fix-bogous-check-for-non-existing-skb-by-removing-it.patch new file mode 100644 index 00000000000..aaa3903d6ed --- /dev/null +++ b/queue-4.19/can-dev-__can_get_echo_skb-fix-bogous-check-for-non-existing-skb-by-removing-it.patch @@ -0,0 +1,84 @@ +From 7b12c8189a3dc50638e7d53714c88007268d47ef Mon Sep 17 00:00:00 2001 +From: Manfred Schlaegl +Date: Wed, 19 Dec 2018 19:39:58 +0100 +Subject: can: dev: __can_get_echo_skb(): fix bogous check for non-existing skb by removing it + +From: Manfred Schlaegl + +commit 7b12c8189a3dc50638e7d53714c88007268d47ef upstream. + +This patch revert commit 7da11ba5c506 +("can: dev: __can_get_echo_skb(): print error message, if trying to echo non existing skb") + +After introduction of this change we encountered following new error +message on various i.MX plattforms (flexcan): + +| flexcan 53fc8000.can can0: __can_get_echo_skb: BUG! Trying to echo non +| existing skb: can_priv::echo_skb[0] + +The introduction of the message was a mistake because +priv->echo_skb[idx] = NULL is a perfectly valid in following case: If +CAN_RAW_LOOPBACK is disabled (setsockopt) in applications, the pkt_type +of the tx skb's given to can_put_echo_skb is set to PACKET_LOOPBACK. In +this case can_put_echo_skb will not set priv->echo_skb[idx]. It is +therefore kept NULL. + +As additional argument for revert: The order of check and usage of idx +was changed. idx is used to access an array element before checking it's +boundaries. + +Signed-off-by: Manfred Schlaegl +Fixes: 7da11ba5c506 ("can: dev: __can_get_echo_skb(): print error message, if trying to echo non existing skb") +Cc: linux-stable +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/dev.c | 27 +++++++++++++-------------- + 1 file changed, 13 insertions(+), 14 deletions(-) + +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -480,8 +480,6 @@ EXPORT_SYMBOL_GPL(can_put_echo_skb); + struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr) + { + struct can_priv *priv = netdev_priv(dev); +- struct sk_buff *skb = priv->echo_skb[idx]; +- struct canfd_frame *cf; + + if (idx >= priv->echo_skb_max) { + netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n", +@@ -489,20 +487,21 @@ struct sk_buff *__can_get_echo_skb(struc + return NULL; + } + +- if (!skb) { +- netdev_err(dev, "%s: BUG! Trying to echo non existing skb: can_priv::echo_skb[%u]\n", +- __func__, idx); +- return NULL; +- } ++ if (priv->echo_skb[idx]) { ++ /* Using "struct canfd_frame::len" for the frame ++ * length is supported on both CAN and CANFD frames. ++ */ ++ struct sk_buff *skb = priv->echo_skb[idx]; ++ struct canfd_frame *cf = (struct canfd_frame *)skb->data; ++ u8 len = cf->len; + +- /* Using "struct canfd_frame::len" for the frame +- * length is supported on both CAN and CANFD frames. +- */ +- cf = (struct canfd_frame *)skb->data; +- *len_ptr = cf->len; +- priv->echo_skb[idx] = NULL; ++ *len_ptr = len; ++ priv->echo_skb[idx] = NULL; ++ ++ return skb; ++ } + +- return skb; ++ return NULL; + } + + /* diff --git a/queue-4.19/can-flexcan-fix-null-pointer-exception-during-bringup.patch b/queue-4.19/can-flexcan-fix-null-pointer-exception-during-bringup.patch new file mode 100644 index 00000000000..6c052900c40 --- /dev/null +++ b/queue-4.19/can-flexcan-fix-null-pointer-exception-during-bringup.patch @@ -0,0 +1,50 @@ +From a55234dabe1f72cf22f9197980751d37e38ba020 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Fri, 11 Jan 2019 12:20:41 +0100 +Subject: can: flexcan: fix NULL pointer exception during bringup +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +commit a55234dabe1f72cf22f9197980751d37e38ba020 upstream. + +Commit cbffaf7aa09e ("can: flexcan: Always use last mailbox for TX") +introduced a loop letting i run up to (including) ARRAY_SIZE(regs->mb) +and in the body accessed regs->mb[i] which is an out-of-bounds array +access that then resulted in an access to an reserved register area. + +Later this was changed by commit 0517961ccdf1 ("can: flexcan: Add +provision for variable payload size") to iterate a bit differently but +still runs one iteration too much resulting to call + + flexcan_get_mb(priv, priv->mb_count) + +which results in a WARN_ON and then a NULL pointer exception. This +only affects devices compatible with "fsl,p1010-flexcan", +"fsl,imx53-flexcan", "fsl,imx35-flexcan", "fsl,imx25-flexcan", +"fsl,imx28-flexcan", so newer i.MX SoCs are not affected. + +Fixes: cbffaf7aa09e ("can: flexcan: Always use last mailbox for TX") +Signed-off-by: Uwe Kleine-König +Cc: linux-stable # >= 4.20 +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/net/can/flexcan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -1004,7 +1004,7 @@ static int flexcan_chip_start(struct net + } + } else { + /* clear and invalidate unused mailboxes first */ +- for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i <= ARRAY_SIZE(regs->mb); i++) { ++ for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i < ARRAY_SIZE(regs->mb); i++) { + priv->write(FLEXCAN_MB_CODE_RX_INACTIVE, + ®s->mb[i].can_ctrl); + } diff --git a/queue-4.19/irqchip-gic-v3-its-align-pci-multi-msi-allocation-on-their-size.patch b/queue-4.19/irqchip-gic-v3-its-align-pci-multi-msi-allocation-on-their-size.patch new file mode 100644 index 00000000000..b8c3fd5f58c --- /dev/null +++ b/queue-4.19/irqchip-gic-v3-its-align-pci-multi-msi-allocation-on-their-size.patch @@ -0,0 +1,83 @@ +From 8208d1708b88b412ca97f50a6d951242c88cbbac Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Fri, 18 Jan 2019 14:08:59 +0000 +Subject: irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size + +From: Marc Zyngier + +commit 8208d1708b88b412ca97f50a6d951242c88cbbac upstream. + +The way we allocate events works fine in most cases, except +when multiple PCI devices share an ITS-visible DevID, and that +one of them is trying to use MultiMSI allocation. + +In that case, our allocation is not guaranteed to be zero-based +anymore, and we have to make sure we allocate it on a boundary +that is compatible with the PCI Multi-MSI constraints. + +Fix this by allocating the full region upfront instead of iterating +over the number of MSIs. MSI-X are always allocated one by one, +so this shouldn't change anything on that front. + +Fixes: b48ac83d6bbc2 ("irqchip: GICv3: ITS: MSI support") +Cc: stable@vger.kernel.org +Reported-by: Ard Biesheuvel +Tested-by: Ard Biesheuvel +Signed-off-by: Marc Zyngier +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/irqchip/irq-gic-v3-its.c | 25 +++++++++++++------------ + 1 file changed, 13 insertions(+), 12 deletions(-) + +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -2267,13 +2267,14 @@ static void its_free_device(struct its_d + kfree(its_dev); + } + +-static int its_alloc_device_irq(struct its_device *dev, irq_hw_number_t *hwirq) ++static int its_alloc_device_irq(struct its_device *dev, int nvecs, irq_hw_number_t *hwirq) + { + int idx; + +- idx = find_first_zero_bit(dev->event_map.lpi_map, +- dev->event_map.nr_lpis); +- if (idx == dev->event_map.nr_lpis) ++ idx = bitmap_find_free_region(dev->event_map.lpi_map, ++ dev->event_map.nr_lpis, ++ get_count_order(nvecs)); ++ if (idx < 0) + return -ENOSPC; + + *hwirq = dev->event_map.lpi_base + idx; +@@ -2369,21 +2370,21 @@ static int its_irq_domain_alloc(struct i + int err; + int i; + +- for (i = 0; i < nr_irqs; i++) { +- err = its_alloc_device_irq(its_dev, &hwirq); +- if (err) +- return err; ++ err = its_alloc_device_irq(its_dev, nr_irqs, &hwirq); ++ if (err) ++ return err; + +- err = its_irq_gic_domain_alloc(domain, virq + i, hwirq); ++ for (i = 0; i < nr_irqs; i++) { ++ err = its_irq_gic_domain_alloc(domain, virq + i, hwirq + i); + if (err) + return err; + + irq_domain_set_hwirq_and_chip(domain, virq + i, +- hwirq, &its_irq_chip, its_dev); ++ hwirq + i, &its_irq_chip, its_dev); + irqd_set_single_target(irq_desc_get_irq_data(irq_to_desc(virq + i))); + pr_debug("ID:%d pID:%d vID:%d\n", +- (int)(hwirq - its_dev->event_map.lpi_base), +- (int) hwirq, virq + i); ++ (int)(hwirq + i - its_dev->event_map.lpi_base), ++ (int)(hwirq + i), virq + i); + } + + return 0; diff --git a/queue-4.19/net-sun-cassini-cleanup-license-conflict.patch b/queue-4.19/net-sun-cassini-cleanup-license-conflict.patch new file mode 100644 index 00000000000..b68b59a442c --- /dev/null +++ b/queue-4.19/net-sun-cassini-cleanup-license-conflict.patch @@ -0,0 +1,102 @@ +From 56cb4e5034998b5522a657957321ca64ca2ea0a0 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Fri, 18 Jan 2019 11:49:58 +0100 +Subject: net: sun: cassini: Cleanup license conflict + +From: Thomas Gleixner + +commit 56cb4e5034998b5522a657957321ca64ca2ea0a0 upstream. + +The recent addition of SPDX license identifiers to the files in +drivers/net/ethernet/sun created a licensing conflict. + +The cassini driver files contain a proper license notice: + + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as + * published by the Free Software Foundation; either version 2 of the + * License, or (at your option) any later version. + +but the SPDX change added: + + SPDX-License-Identifier: GPL-2.0 + +So the file got tagged GPL v2 only while in fact it is licensed under GPL +v2 or later. + +It's nice that people care about the SPDX tags, but they need to be more +careful about it. Not everything under (the) sun belongs to ... + +Fix up the SPDX identifier and remove the boiler plate text as it is +redundant. + +Fixes: c861ef83d771 ("sun: Add SPDX license tags to Sun network drivers") +Signed-off-by: Thomas Gleixner +Cc: Shannon Nelson +Cc: Zhu Yanjun +Cc: David S. Miller +Cc: netdev@vger.kernel.org +Cc: stable@vger.kernel.org +Acked-by: Shannon Nelson +Reviewed-by: Zhu Yanjun +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/sun/cassini.c | 15 +-------------- + drivers/net/ethernet/sun/cassini.h | 15 +-------------- + 2 files changed, 2 insertions(+), 28 deletions(-) + +--- a/drivers/net/ethernet/sun/cassini.c ++++ b/drivers/net/ethernet/sun/cassini.c +@@ -1,22 +1,9 @@ +-// SPDX-License-Identifier: GPL-2.0 ++// SPDX-License-Identifier: GPL-2.0+ + /* cassini.c: Sun Microsystems Cassini(+) ethernet driver. + * + * Copyright (C) 2004 Sun Microsystems Inc. + * Copyright (C) 2003 Adrian Sun (asun@darksunrising.com) + * +- * This program is free software; you can redistribute it and/or +- * modify it under the terms of the GNU General Public License as +- * published by the Free Software Foundation; either version 2 of the +- * License, or (at your option) any later version. +- * +- * This program is distributed in the hope that it will be useful, +- * but WITHOUT ANY WARRANTY; without even the implied warranty of +- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +- * GNU General Public License for more details. +- * +- * You should have received a copy of the GNU General Public License +- * along with this program; if not, see . +- * + * This driver uses the sungem driver (c) David Miller + * (davem@redhat.com) as its basis. + * +--- a/drivers/net/ethernet/sun/cassini.h ++++ b/drivers/net/ethernet/sun/cassini.h +@@ -1,23 +1,10 @@ +-/* SPDX-License-Identifier: GPL-2.0 */ ++/* SPDX-License-Identifier: GPL-2.0+ */ + /* $Id: cassini.h,v 1.16 2004/08/17 21:15:16 zaumen Exp $ + * cassini.h: Definitions for Sun Microsystems Cassini(+) ethernet driver. + * + * Copyright (C) 2004 Sun Microsystems Inc. + * Copyright (c) 2003 Adrian Sun (asun@darksunrising.com) + * +- * This program is free software; you can redistribute it and/or +- * modify it under the terms of the GNU General Public License as +- * published by the Free Software Foundation; either version 2 of the +- * License, or (at your option) any later version. +- * +- * This program is distributed in the hope that it will be useful, +- * but WITHOUT ANY WARRANTY; without even the implied warranty of +- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +- * GNU General Public License for more details. +- * +- * You should have received a copy of the GNU General Public License +- * along with this program; if not, see . +- * + * vendor id: 0x108E (Sun Microsystems, Inc.) + * device id: 0xabba (Cassini) + * revision ids: 0x01 = Cassini diff --git a/queue-4.19/posix-cpu-timers-unbreak-timer-rearming.patch b/queue-4.19/posix-cpu-timers-unbreak-timer-rearming.patch new file mode 100644 index 00000000000..a09fd72dd75 --- /dev/null +++ b/queue-4.19/posix-cpu-timers-unbreak-timer-rearming.patch @@ -0,0 +1,52 @@ +From 93ad0fc088c5b4631f796c995bdd27a082ef33a6 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Fri, 11 Jan 2019 14:33:16 +0100 +Subject: posix-cpu-timers: Unbreak timer rearming + +From: Thomas Gleixner + +commit 93ad0fc088c5b4631f796c995bdd27a082ef33a6 upstream. + +The recent commit which prevented a division by 0 issue in the alarm timer +code broke posix CPU timers as an unwanted side effect. + +The reason is that the common rearm code checks for timer->it_interval +being 0 now. What went unnoticed is that the posix cpu timer setup does not +initialize timer->it_interval as it stores the interval in CPU timer +specific storage. The reason for the separate storage is historical as the +posix CPU timers always had a 64bit nanoseconds representation internally +while timer->it_interval is type ktime_t which used to be a modified +timespec representation on 32bit machines. + +Instead of reverting the offending commit and fixing the alarmtimer issue +in the alarmtimer code, store the interval in timer->it_interval at CPU +timer setup time so the common code check works. This also repairs the +existing inconistency of the posix CPU timer code which kept a single shot +timer armed despite of the interval being 0. + +The separate storage can be removed in mainline, but that needs to be a +separate commit as the current one has to be backported to stable kernels. + +Fixes: 0e334db6bb4b ("posix-timers: Fix division by zero bug") +Reported-by: H.J. Lu +Signed-off-by: Thomas Gleixner +Cc: John Stultz +Cc: Peter Zijlstra +Cc: stable@vger.kernel.org +Link: https://lkml.kernel.org/r/20190111133500.840117406@linutronix.de +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/time/posix-cpu-timers.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/time/posix-cpu-timers.c ++++ b/kernel/time/posix-cpu-timers.c +@@ -685,6 +685,7 @@ static int posix_cpu_timer_set(struct k_ + * set up the signal and overrun bookkeeping. + */ + timer->it.cpu.incr = timespec64_to_ns(&new->it_interval); ++ timer->it_interval = ns_to_ktime(timer->it.cpu.incr); + + /* + * This acts as a modification timestamp for the timer, diff --git a/queue-4.19/series b/queue-4.19/series index 1404d9e4c9d..dfbae44dab1 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -73,3 +73,12 @@ x86-pkeys-properly-copy-pkey-state-at-fork.patch x86-selftests-pkeys-fork-to-check-for-state-being-preserved.patch x86-kaslr-fix-incorrect-i8254-outb-parameters.patch x86-entry-64-compat-fix-stack-switching-for-xen-pv.patch +posix-cpu-timers-unbreak-timer-rearming.patch +net-sun-cassini-cleanup-license-conflict.patch +irqchip-gic-v3-its-align-pci-multi-msi-allocation-on-their-size.patch +can-dev-__can_get_echo_skb-fix-bogous-check-for-non-existing-skb-by-removing-it.patch +can-bcm-check-timer-values-before-ktime-conversion.patch +can-flexcan-fix-null-pointer-exception-during-bringup.patch +vt-make-vt_console_print-compatible-with-the-unicode-screen-buffer.patch +vt-always-call-notifier-with-the-console-lock-held.patch +vt-invoke-notifier-on-screen-size-change.patch diff --git a/queue-4.19/vt-always-call-notifier-with-the-console-lock-held.patch b/queue-4.19/vt-always-call-notifier-with-the-console-lock-held.patch new file mode 100644 index 00000000000..7a08cb26282 --- /dev/null +++ b/queue-4.19/vt-always-call-notifier-with-the-console-lock-held.patch @@ -0,0 +1,32 @@ +From 7e1d226345f89ad5d0216a9092c81386c89b4983 Mon Sep 17 00:00:00 2001 +From: Nicolas Pitre +Date: Tue, 8 Jan 2019 22:55:00 -0500 +Subject: vt: always call notifier with the console lock held + +From: Nicolas Pitre + +commit 7e1d226345f89ad5d0216a9092c81386c89b4983 upstream. + +Every invocation of notify_write() and notify_update() is performed +under the console lock, except for one case. Let's fix that. + +Signed-off-by: Nicolas Pitre +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/vt/vt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -2767,8 +2767,8 @@ rescan_last_byte: + con_flush(vc, draw_from, draw_to, &draw_x); + vc_uniscr_debug_check(vc); + console_conditional_schedule(); +- console_unlock(); + notify_update(vc); ++ console_unlock(); + return n; + } + diff --git a/queue-4.19/vt-invoke-notifier-on-screen-size-change.patch b/queue-4.19/vt-invoke-notifier-on-screen-size-change.patch new file mode 100644 index 00000000000..0e076d6272c --- /dev/null +++ b/queue-4.19/vt-invoke-notifier-on-screen-size-change.patch @@ -0,0 +1,30 @@ +From 0c9b1965faddad7534b6974b5b36c4ad37998f8e Mon Sep 17 00:00:00 2001 +From: Nicolas Pitre +Date: Tue, 8 Jan 2019 22:55:01 -0500 +Subject: vt: invoke notifier on screen size change + +From: Nicolas Pitre + +commit 0c9b1965faddad7534b6974b5b36c4ad37998f8e upstream. + +User space using poll() on /dev/vcs devices are not awaken when a +screen size change occurs. Let's fix that. + +Signed-off-by: Nicolas Pitre +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/vt/vt.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -1275,6 +1275,7 @@ static int vc_do_resize(struct tty_struc + if (con_is_visible(vc)) + update_screen(vc); + vt_event_post(VT_EVENT_RESIZE, vc->vc_num, vc->vc_num); ++ notify_update(vc); + return err; + } + diff --git a/queue-4.19/vt-make-vt_console_print-compatible-with-the-unicode-screen-buffer.patch b/queue-4.19/vt-make-vt_console_print-compatible-with-the-unicode-screen-buffer.patch new file mode 100644 index 00000000000..79dd6b214ee --- /dev/null +++ b/queue-4.19/vt-make-vt_console_print-compatible-with-the-unicode-screen-buffer.patch @@ -0,0 +1,119 @@ +From 6609cff65c5b184ab889880ef5d41189611ea05f Mon Sep 17 00:00:00 2001 +From: Nicolas Pitre +Date: Tue, 8 Jan 2019 22:54:59 -0500 +Subject: vt: make vt_console_print() compatible with the unicode screen buffer + +From: Nicolas Pitre + +commit 6609cff65c5b184ab889880ef5d41189611ea05f upstream. + +When kernel messages are printed to the console, they appear blank on +the unicode screen. This is because vt_console_print() is lacking a call +to vc_uniscr_putc(). However the later function assumes vc->vc_x is +always up to date when called, which is not the case here as +vt_console_print() uses it to mark the beginning of the display update. + +This patch reworks (and simplifies) vt_console_print() so that vc->vc_x +is always valid and keeps the start of display update in a local variable +instead, which finally allows for adding the missing vc_uniscr_putc() +call. + +Signed-off-by: Nicolas Pitre +Cc: stable@vger.kernel.org # v4.19+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/vt/vt.c | 47 +++++++++++++++-------------------------------- + 1 file changed, 15 insertions(+), 32 deletions(-) + +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -2887,8 +2887,7 @@ static void vt_console_print(struct cons + unsigned char c; + static DEFINE_SPINLOCK(printing_lock); + const ushort *start; +- ushort cnt = 0; +- ushort myx; ++ ushort start_x, cnt; + int kmsg_console; + + /* console busy or not yet initialized */ +@@ -2901,10 +2900,6 @@ static void vt_console_print(struct cons + if (kmsg_console && vc_cons_allocated(kmsg_console - 1)) + vc = vc_cons[kmsg_console - 1].d; + +- /* read `x' only after setting currcons properly (otherwise +- the `x' macro will read the x of the foreground console). */ +- myx = vc->vc_x; +- + if (!vc_cons_allocated(fg_console)) { + /* impossible */ + /* printk("vt_console_print: tty %d not allocated ??\n", currcons+1); */ +@@ -2919,53 +2914,41 @@ static void vt_console_print(struct cons + hide_cursor(vc); + + start = (ushort *)vc->vc_pos; +- +- /* Contrived structure to try to emulate original need_wrap behaviour +- * Problems caused when we have need_wrap set on '\n' character */ ++ start_x = vc->vc_x; ++ cnt = 0; + while (count--) { + c = *b++; + if (c == 10 || c == 13 || c == 8 || vc->vc_need_wrap) { +- if (cnt > 0) { +- if (con_is_visible(vc)) +- vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, vc->vc_x); +- vc->vc_x += cnt; +- if (vc->vc_need_wrap) +- vc->vc_x--; +- cnt = 0; +- } ++ if (cnt && con_is_visible(vc)) ++ vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, start_x); ++ cnt = 0; + if (c == 8) { /* backspace */ + bs(vc); + start = (ushort *)vc->vc_pos; +- myx = vc->vc_x; ++ start_x = vc->vc_x; + continue; + } + if (c != 13) + lf(vc); + cr(vc); + start = (ushort *)vc->vc_pos; +- myx = vc->vc_x; ++ start_x = vc->vc_x; + if (c == 10 || c == 13) + continue; + } ++ vc_uniscr_putc(vc, c); + scr_writew((vc->vc_attr << 8) + c, (unsigned short *)vc->vc_pos); + notify_write(vc, c); + cnt++; +- if (myx == vc->vc_cols - 1) { +- vc->vc_need_wrap = 1; +- continue; +- } +- vc->vc_pos += 2; +- myx++; +- } +- if (cnt > 0) { +- if (con_is_visible(vc)) +- vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, vc->vc_x); +- vc->vc_x += cnt; +- if (vc->vc_x == vc->vc_cols) { +- vc->vc_x--; ++ if (vc->vc_x == vc->vc_cols - 1) { + vc->vc_need_wrap = 1; ++ } else { ++ vc->vc_pos += 2; ++ vc->vc_x++; + } + } ++ if (cnt && con_is_visible(vc)) ++ vc->vc_sw->con_putcs(vc, start, cnt, vc->vc_y, start_x); + set_cursor(vc); + notify_update(vc); +