From a9ed3aa9b87ee41e8ab3ff471b1331c154767e45 Mon Sep 17 00:00:00 2001 From: Dave Airlie Date: Sat, 26 Sep 2026 07:57:59 +1000 Subject: Merge tag 'drm-misc-fixes-2026-09-24' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A number of fixes: - bridge: - samsung-dsim: fix GPIO lifetime - client: Null pointer dereference fix - imagination: error handling fix, page handling fix - nouveau: fix reference leaks, double-frees, out-of-bounds accesses, use-after-frees, don't reject config without SCDC, a number of workarounds - virtio: fix memory leak, reference leaks, null pointer dereference, add pixel blend mode, cache coherency fix Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patch.msgid.link/arU22zzqUGDEco1y@houat --- drivers/accessibility/speakup/selection.c | 141 ++++++++++++++++++++++++++++++ 1 file changed, 141 insertions(+) create mode 100644 drivers/accessibility/speakup/selection.c (limited to 'drivers/accessibility/speakup/selection.c') diff --git a/drivers/accessibility/speakup/selection.c b/drivers/accessibility/speakup/selection.c new file mode 100644 index 000000000..1713ce4e0 --- /dev/null +++ b/drivers/accessibility/speakup/selection.c @@ -0,0 +1,141 @@ +// SPDX-License-Identifier: GPL-2.0 +#include /* for kmalloc */ +#include +#include +#include +#include /* for dev_warn */ +#include +#include +#include +#include +#include +#include + +#include "speakup.h" + +u16 spk_xs, spk_ys, spk_xe, spk_ye; /* our region points */ +struct vc_data *spk_sel_cons; + +struct speakup_selection_work { + struct work_struct work; + struct tiocl_selection sel; + struct tty_struct *tty; +}; + +static void __speakup_set_selection(struct work_struct *work) +{ + struct speakup_selection_work *ssw = + container_of(work, struct speakup_selection_work, work); + + struct tty_struct *tty; + struct tiocl_selection sel; + + sel = ssw->sel; + + /* this ensures we copy sel before releasing the lock below */ + rmb(); + + /* release the lock by setting tty of the struct to NULL */ + tty = xchg(&ssw->tty, NULL); + + if (spk_sel_cons != vc_cons[fg_console].d) { + spk_sel_cons = vc_cons[fg_console].d; + pr_warn("Selection: mark console not the same as cut\n"); + goto unref; + } + + console_lock(); + clear_selection(); + console_unlock(); + + set_selection_kernel(&sel, tty); + +unref: + tty_kref_put(tty); +} + +static struct speakup_selection_work speakup_sel_work = { + .work = __WORK_INITIALIZER(speakup_sel_work.work, + __speakup_set_selection) +}; + +int speakup_set_selection(struct tty_struct *tty) +{ + /* we get kref here first in order to avoid a subtle race when + * cancelling selection work. getting kref first establishes the + * invariant that if speakup_sel_work.tty is not NULL when + * speakup_cancel_selection() is called, it must be the case that a put + * kref is pending. + */ + tty_kref_get(tty); + if (cmpxchg(&speakup_sel_work.tty, NULL, tty)) { + tty_kref_put(tty); + return -EBUSY; + } + /* now we have the 'lock' by setting tty member of + * speakup_selection_work. wmb() ensures that writes to + * speakup_sel_work don't happen before cmpxchg() above. + */ + wmb(); + + speakup_sel_work.sel.xs = spk_xs + 1; + speakup_sel_work.sel.ys = spk_ys + 1; + speakup_sel_work.sel.xe = spk_xe + 1; + speakup_sel_work.sel.ye = spk_ye + 1; + speakup_sel_work.sel.sel_mode = TIOCL_SELCHAR; + + schedule_work_on(WORK_CPU_UNBOUND, &speakup_sel_work.work); + + return 0; +} + +void speakup_cancel_selection(void) +{ + struct tty_struct *tty; + + cancel_work_sync(&speakup_sel_work.work); + /* setting to null so that if work fails to run and we cancel it, + * we can run it again without getting EBUSY forever from there on. + * we need to use xchg here to avoid race with speakup_set_selection() + */ + tty = xchg(&speakup_sel_work.tty, NULL); + if (tty) + tty_kref_put(tty); +} + +static void __speakup_paste_selection(struct work_struct *work) +{ + struct speakup_selection_work *ssw = + container_of(work, struct speakup_selection_work, work); + struct tty_struct *tty = xchg(&ssw->tty, NULL); + + paste_selection(tty); + tty_kref_put(tty); +} + +static struct speakup_selection_work speakup_paste_work = { + .work = __WORK_INITIALIZER(speakup_paste_work.work, + __speakup_paste_selection) +}; + +int speakup_paste_selection(struct tty_struct *tty) +{ + tty_kref_get(tty); + if (cmpxchg(&speakup_paste_work.tty, NULL, tty)) { + tty_kref_put(tty); + return -EBUSY; + } + + schedule_work_on(WORK_CPU_UNBOUND, &speakup_paste_work.work); + return 0; +} + +void speakup_cancel_paste(void) +{ + struct tty_struct *tty; + + cancel_work_sync(&speakup_paste_work.work); + tty = xchg(&speakup_paste_work.tty, NULL); + if (tty) + tty_kref_put(tty); +} -- cgit v1.3.1