linux/drivers/char
Linus Torvalds 386f40c86d Revert "tty: fix a little bug in scrup, vt.c"
This reverts commit 962400e8fd, which was
entirely bogus.

The code used to multiply the character offset by "vc->vc_cols", and
that's actually correct, because 'd' itself is an 'unsigned short'.  So
the pointer arithmetic already takes the size of a VGA character into
account.  Changing it to use vc_size_row (which is just "vc_cols"
shifted up to take the size of the character into account) ends up
multiplying with the VGA character size twice.

This got reported as bugs for various other subsystems, because what it
actually results in is writing the 16-bit vc_video_erase_char pattern
(usually 0x0720: 0x07 is the default attribute, 0x20 is ASCII space)
into some random other allocation.

So Markus ended up reporting this as a ext4 bug, while to Torsten Kaiser
it looked like a problem with KMS or libata.  Jeff Chua saw it in
different places.

And finally - Justin Mattock had slab poisoning enabled, and saw it as a
slab poison overwritten.  And bisected and reverted this to verify the
buggy commit.

Reported-by: Markus Trippelsdorf <markus@trippelsdorf.de>
Reported-by: Torsten Kaiser <just.for.lkml@googlemail.com>
Reported-by: Jeff Chua <jeff.chua.linux@gmail.com>
Reported-by: Justin P. Mattock <justinmattock@gmail.com>
Reported-bisected-and-tested-by: Justin P. Mattock <justinmattock@gmail.com>
Acked-by: Dave Airlie <airlied@redhat.com>
Cc: Frank Pan <frankpzh@gmail.com>
Cc: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2010-06-06 20:44:04 -07:00
..
agp agp/uninorth: Fix oops caused by flushing too much 2010-06-02 17:50:37 +10:00
hw_random
ip2
ipmi
mwave
pcmcia
rio
tpm
xilinx_hwicap
.gitignore
amiserial.c
apm-emulation.c
applicom.c
applicom.h
bfin_jtag_comm.c
bfin-otp.c
briq_panel.c
bsr.c
cd1865.h
consolemap.c
cp437.uni
cs5535_gpio.c
cyclades.c
defkeymap.c_shipped
defkeymap.map
digi1.h
digiFep1.h
digiPCI.h
ds1302.c
ds1620.c
dsp56k.c
dtlk.c
efirtc.c
epca.c
epca.h
epcaconfig.h
generic_nvram.c
generic_serial.c
genrtc.c
hangcheck-timer.c
hpet.c
hvc_beat.c
hvc_console.c
hvc_console.h
hvc_irq.c
hvc_iseries.c
hvc_iucv.c
hvc_rtas.c
hvc_udbg.c
hvc_vio.c
hvc_xen.c
hvcs.c
hvsi.c
i8k.c
isicom.c
istallion.c
Kconfig ramoops: add HAS_IOMEM dependency 2010-06-04 15:21:44 -07:00
keyboard.c
lp.c
Makefile
mbcs.c
mbcs.h
mem.c
misc.c
mmtimer.c
moxa.c
moxa.h
mspec.c
mxser.c
mxser.h
n_gsm.c TTY/n_gsm: potential double lock 2010-06-04 13:37:17 -07:00
n_hdlc.c
n_r3964.c
n_tty.c
nozomi.c
nsc_gpio.c
nvram.c
nwbutton.c
nwbutton.h
nwflash.c
pc8736x_gpio.c
ppdev.c
ps3flash.c
pty.c
ramoops.c
random.c
raw.c
riscom8_reg.h
riscom8.c
riscom8.h
rocket_int.h
rocket.c
rocket.h
rtc.c
scc.h
scx200_gpio.c
selection.c
ser_a2232.c
ser_a2232.h
ser_a2232fw.ax
ser_a2232fw.h
serial167.c
snsc_event.c
snsc.c
snsc.h
sonypi.c
specialix_io8.h
specialix.c
stallion.c
sx.c
sx.h
sxboards.h
sxwindow.h
synclink_gt.c
synclink.c
synclinkmp.c
sysrq.c
tb0219.c
tlclk.c
toshiba.c
tty_audit.c
tty_buffer.c
tty_io.c
tty_ioctl.c
tty_ldisc.c
tty_port.c
uv_mmtimer.c
vc_screen.c
viotape.c
virtio_console.c virtio: console: Fix crash when port is unplugged and blocked for write 2010-06-03 22:39:19 +09:30
vme_scc.c
vt_ioctl.c vt_ioctl: return -EFAULT on copy_from_user errors 2010-06-04 13:37:18 -07:00
vt.c Revert "tty: fix a little bug in scrup, vt.c" 2010-06-06 20:44:04 -07:00