After memory allocation failure vc_allocate() doesn't clean up data which has been initialized in visual_init(). In case of fbcon this leads to divide-by-0 in fbcon_init() on next open of the same tty. memory allocation in vc_allocate() may fail here: 1097: vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_KERNEL); on next open() fbcon_init() skips vc_font.data initialization: 1088: if (!p->fontdata) { division by zero in fbcon_init() happens here: 1149: new_cols /= vc->vc_font.width; Additional check is needed in fbcon_deinit() to prevent usage of uninitialized vc_screenbuf: 1251: if (vc->vc_hi_font_mask && vc->vc_screenbuf) 1252: set_vc_hi_font(vc, false); Crash: #6 [ffffc90001eafa60] divide_error at ffffffff81a00be4 [exception RIP: fbcon_init+463] RIP: ffffffff814b860f RSP: ffffc90001eafb18 RFLAGS: 00010246 ... #7 [ffffc90001eafb60] visual_init at ffffffff8154c36e #8 [ffffc90001eafb80] vc_allocate at ffffffff8154f53c #9 [ffffc90001eafbc8] con_install at ffffffff8154f624 ... Signed-off-by: Grzegorz Halat <ghalat@redhat.com> Reviewed-by: Oleksandr Natalenko <oleksandr@redhat.com> Acked-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
---|---|---|
.. | ||
hvc | ||
ipwireless | ||
serdev | ||
serial | ||
vt | ||
Kconfig | ||
Makefile | ||
amiserial.c | ||
cyclades.c | ||
ehv_bytechan.c | ||
goldfish.c | ||
isicom.c | ||
mips_ejtag_fdc.c | ||
moxa.c | ||
moxa.h | ||
mxser.c | ||
mxser.h | ||
n_gsm.c | ||
n_hdlc.c | ||
n_null.c | ||
n_r3964.c | ||
n_tracerouter.c | ||
n_tracesink.c | ||
n_tracesink.h | ||
n_tty.c | ||
nozomi.c | ||
pty.c | ||
rocket.c | ||
rocket.h | ||
rocket_int.h | ||
synclink.c | ||
synclink_gt.c | ||
synclinkmp.c | ||
sysrq.c | ||
tty_audit.c | ||
tty_baudrate.c | ||
tty_buffer.c | ||
tty_io.c | ||
tty_ioctl.c | ||
tty_jobctrl.c | ||
tty_ldisc.c | ||
tty_ldsem.c | ||
tty_mutex.c | ||
tty_port.c | ||
ttynull.c | ||
vcc.c |