linux-kernel - [PATCH] vt: Fix non-blinking cursor regression

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <575cb82102aa59a7a8e34248821b78e1dd844777.1579701673.git.lukas@wunner.de>
Date:   Wed, 22 Jan 2020 15:17:30 +0100
From:   Lukas Wunner <lukas@...ner.de>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Jiri Slaby <jslaby@...e.com>, Nicolas Pitre <nico@...xnic.net>
Cc:     Mikulas Patocka <mpatocka@...hat.com>,
        Matthew Whitehead <tedheadster@...il.com>,
        Daniel Vetter <daniel.vetter@...ll.ch>,
        Arvind Sankar <nivedita@...m.mit.edu>,
        linux-kernel@...r.kernel.org
Subject: [PATCH] vt: Fix non-blinking cursor regression

Since commit a6dbe4427559 ("vt: perform safe console erase in the right
order"), when userspace clears both the scrollback buffer and the screen
by writing "\e[3J" to an fbdev virtual console, the cursor stops blinking
if that virtual console is not in the foreground.  I'm witnessing this
on every boot of Raspbian since updating to v4.19.37+ because agetty
writes the sequence to /dev/tty6 while the console is still switched to
/dev/tty1.  Switching consoles once makes the cursor blink again.

The commit added an invocation of ->con_switch() to flush_scrollback().
Normally this is only invoked from switch_screen() to switch consoles.
switch_screen() updates *vc->vc_display_fg to the new console and
fbcon_switch() updates ops->currcon.  Because the commit only invokes
fbcon_switch() but doesn't update *vc->vc_display_fg, it performs an
incomplete console switch.

When fb_flashcursor() subsequently blinks the cursor, it retrieves the
foreground console from ops->currcon.  Because *vc->vc_display_fg wasn't
updated, con_is_visible() incorrectly returns false and as a result,
fb_flashcursor() bails out without blinking the cursor.

The invocation of ->con_switch() appears to have been erroneous.  After
all, why should a console switch be performed when clearing the screen?
The commit message doesn't provide a rationale either.  So delete it.

Fixes: a6dbe4427559 ("vt: perform safe console erase in the right order")
Signed-off-by: Lukas Wunner <lukas@...ner.de>
Cc: stable@...r.kernel.org # v5.1+
Cc: Nicolas Pitre <nico@...xnic.net>
Cc: Mikulas Patocka <mpatocka@...hat.com>
Cc: Matthew Whitehead <tedheadster@...il.com>
---
 drivers/tty/vt/vt.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 35d21cdb60d0..eb25fb4ca05f 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -938,8 +938,6 @@ static void flush_scrollback(struct vc_data *vc)
 	set_origin(vc);
 	if (vc->vc_sw->con_flush_scrollback)
 		vc->vc_sw->con_flush_scrollback(vc);
-	else
-		vc->vc_sw->con_switch(vc);
 }

 /*
-- 
2.24.0