linux/drivers/tty
Grzegorz Halat a1ad1cc970 vt/fbcon: deinitialize resources in visual_init() after failed memory allocation
After memory allocation failure vc_allocate() doesn't clean up data
which has been initialized in visual_init(). In case of fbcon this
leads to divide-by-0 in fbcon_init() on next open of the same tty.

memory allocation in vc_allocate() may fail here:
1097:     vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_KERNEL);

on next open() fbcon_init() skips vc_font.data initialization:
1088:     if (!p->fontdata) {

division by zero in fbcon_init() happens here:
1149:     new_cols /= vc->vc_font.width;

Additional check is needed in fbcon_deinit() to prevent
usage of uninitialized vc_screenbuf:

1251:        if (vc->vc_hi_font_mask && vc->vc_screenbuf)
1252:                set_vc_hi_font(vc, false);

Crash:

 #6 [ffffc90001eafa60] divide_error at ffffffff81a00be4
    [exception RIP: fbcon_init+463]
    RIP: ffffffff814b860f  RSP: ffffc90001eafb18  RFLAGS: 00010246
...
 #7 [ffffc90001eafb60] visual_init at ffffffff8154c36e
 #8 [ffffc90001eafb80] vc_allocate at ffffffff8154f53c
 #9 [ffffc90001eafbc8] con_install at ffffffff8154f624
...

Signed-off-by: Grzegorz Halat <ghalat@redhat.com>
Reviewed-by: Oleksandr Natalenko <oleksandr@redhat.com>
Acked-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-05-24 17:08:18 +02:00
..
hvc RISC-V Patches for the 5.2 Merge Window, Part 1 v3 2019-05-19 09:56:36 -07:00
ipwireless tty: add SPDX identifiers to Kconfig and Makefiles 2019-04-04 18:48:43 +02:00
serdev tty: add SPDX identifiers to Kconfig and Makefiles 2019-04-04 18:48:43 +02:00
serial tty: max310x: Fix external crystal register setup 2019-05-21 12:18:17 +02:00
vt vt/fbcon: deinitialize resources in visual_init() after failed memory allocation 2019-05-24 17:08:18 +02:00
amiserial.c kill TIOCSERGSTRUCT 2018-10-13 00:50:53 -04:00
cyclades.c cyclades: switch to ->[sg]et_serial() 2018-10-13 00:50:30 -04:00
ehv_bytechan.c tty: Convert to using %pOFn instead of device_node.name 2018-09-18 16:07:25 +02:00
goldfish.c headers: separate linux/mod_devicetable.h from linux/platform_device.h 2018-07-07 17:52:26 +02:00
isicom.c isicom: switch to ->[sg]et_serial() 2018-10-13 00:50:31 -04:00
Kconfig docs: serial: convert docs to ReST and rename to *.rst 2019-04-25 11:37:42 +02:00
Makefile tty: Add NULL TTY driver 2019-04-16 15:21:34 +02:00
mips_ejtag_fdc.c tty: Remove redundant license text 2017-11-08 13:08:12 +01:00
moxa.c moxa: switch to ->[sg]et_serial() 2018-10-13 00:50:32 -04:00
moxa.h tty: moxa: Add support for CMSPAR 2017-11-28 15:32:33 +01:00
mxser.c mxser: switch to ->[sg]et_serial() 2018-10-13 00:50:32 -04:00
mxser.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
n_gsm.c tty: n_gsm: Mark expected switch fall-throughs 2019-02-26 12:30:44 +01:00
n_hdlc.c tty/n_hdlc: mark expected switch fall-through 2019-02-14 10:49:19 +01:00
n_null.c tty: Remove redundant license text 2017-11-08 13:08:12 +01:00
n_r3964.c tty: Don't block on IO when ldisc change is pending 2018-12-05 12:16:33 +01:00
n_tracerouter.c tty: Remove redundant license text 2017-11-08 13:08:12 +01:00
n_tracesink.c tty: Remove redundant license text 2017-11-08 13:08:12 +01:00
n_tracesink.h tty: Remove redundant license text 2017-11-08 13:08:12 +01:00
n_tty.c n_tty: check for negative and zero space return from tty_write_room 2019-04-16 15:21:33 +02:00
nozomi.c tty/nozomi: use pci_iomap instead of ioremap_nocache 2019-02-12 10:26:45 +01:00
pty.c Revert "tty: pty: Fix race condition between release_one_tty and pty_write" 2019-03-29 15:47:40 +01:00
rocket_int.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rocket.c TTY/Serial patches for 5.2-rc1 2019-05-08 10:07:28 -07:00
rocket.h tty: rocket: Remove RCPK_GET_STRUCT ioctl 2019-04-25 11:58:56 +02:00
synclink_gt.c synclink_gt(): fix compat_ioctl() 2018-10-13 00:50:52 -04:00
synclink.c tty/synclink: remove ISA support 2019-02-12 08:51:33 +01:00
synclinkmp.c synclink: reduce pointless checks in ->ioctl() 2018-10-13 00:50:43 -04:00
sysrq.c panic: avoid the extra noise dmesg 2019-05-14 19:52:51 -07:00
tty_audit.c audit: join tty records to their syscall 2019-02-07 21:33:54 -05:00
tty_baudrate.c termios, tty/tty_baudrate.c: fix buffer overrun 2018-11-08 03:36:45 -08:00
tty_buffer.c tty: increase the default flip buffer limit to 2*640K 2019-01-30 12:03:58 +01:00
tty_io.c tty: update obsolete termios comment 2019-04-25 11:58:56 +02:00
tty_ioctl.c move compat handling of tty ioctls to tty_compat_ioctl() 2018-09-14 11:12:17 -04:00
tty_jobctrl.c tty: fix read of tty->pgrp outside of ctrl_lock 2019-03-28 01:28:23 +09:00
tty_ldisc.c tty: ldisc: add sysctl to prevent autoloading of ldiscs 2019-01-30 09:31:30 +01:00
tty_ldsem.c tty/ldsem: Decrement wait_readers on timeouted down_read() 2018-12-05 12:16:33 +01:00
tty_mutex.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
tty_port.c Revert "tty: fix NULL pointer issue when tty_port ops is not set" 2019-04-16 15:21:34 +02:00
ttynull.c tty: Add NULL TTY driver 2019-04-16 15:21:34 +02:00
vcc.c tty: fix up a few remaining files without SPDX identifiers 2019-04-04 18:48:43 +02:00