re: vt: add support for smput/rmput escape codes

re: vt: add support for smput/rmput escape codes

[Colin King (gmail)]

[-- Attachment #1.1.1: Type: text/plain, Size: 1679 bytes --]

Hi,

Static analysis on linux-next detected an issue with the following commit:

commit 23743ba64709a9c137c1b928f8b8e00d846af9cc
Author: Calixte Pernot <calixte.pernot@grenoble-inp.org>
Date:   Mon Aug 25 14:56:09 2025 +0200

     vt: add support for smput/rmput escape codes


The issue is as follows in drivers/tty/vt/vt.c function vc_deallocate, 
with my nodes prefixed by #####

struct vc_data *vc_deallocate(unsigned int currcons)
{
         struct vc_data *vc = NULL;    #### vc is set to null


         WARN_CONSOLE_UNLOCKED();

         if (vc_cons_allocated(currcons)) {
                 struct vt_notifier_param param;

		##### vs is only set in this if block

                 param.vc = vc = vc_cons[currcons].d;
				
			

                 atomic_notifier_call_chain(&vt_notifier_list, 
VT_DEALLOCATE, &param);
                 vcs_remove_sysfs(currcons);
                 visual_deinit(vc);
                 con_free_unimap(vc);
                 put_pid(vc->vt_pid);
                 vc_uniscr_set(vc, NULL);
                 kfree(vc->vc_screenbuf);
                 vc_cons[currcons].d = NULL;
         }

	##### vc is potentially null and being dereferenced below:

         if (vc->vc_saved_screen != NULL) {
                 kfree(vc->vc_saved_screen);
                 vc->vc_saved_screen = NULL;
         }
         return vc;
}


The issue is that vc is only set in the if (vc_cons_allocated(currcons)) 
if block, and when it is not set, we end up with a null pointer 
de-reference on the if (vc->vc_saved_screen != NULL) check.

I suggest moving that latter check into the earlier if block.

Colin

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 4901 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]

[PATCH v3] vt: add support for smput/rmput escape codes

[Calixte Pernot]

From: Calixte Pernot <c@lixte.email>

Support "\e[?1049h" and "\e[?1049l" escape codes.
This patch allows programs to enter and leave alternate screens.
This feature is widely available in graphical terminal emulators and mostly
used by fullscreen terminal-based user interfaces such as text editors.
Most editors such as vim and nano assume this escape code in not supported
and will not try to print the escape sequence if TERM=linux.
To try out this patch, run `TERM=xterm-256color vim` inside a VT.

Signed-off-by: Calixte Pernot <calixte.pernot@grenoble-inp.org>
---
 drivers/tty/vt/vt.c            | 58 ++++++++++++++++++++++++++++++++++
 include/linux/console_struct.h |  3 ++
 2 files changed, 61 insertions(+)

diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 62049ceb3..d9e4eb3f0 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -141,6 +141,7 @@ static const struct consw *con_driver_map[MAX_NR_CONSOLES];
 static int con_open(struct tty_struct *, struct file *);
 static void vc_init(struct vc_data *vc, int do_clear);
 static void gotoxy(struct vc_data *vc, int new_x, int new_y);
+static void restore_cur(struct vc_data *vc);
 static void save_cur(struct vc_data *vc);
 static void reset_terminal(struct vc_data *vc, int do_clear);
 static void con_flush_chars(struct tty_struct *tty);
@@ -1344,6 +1345,10 @@ struct vc_data *vc_deallocate(unsigned int currcons)
 		kfree(vc->vc_screenbuf);
 		vc_cons[currcons].d = NULL;
 	}
+	if (vc->vc_saved_screen != NULL) {
+		kfree(vc->vc_saved_screen);
+		vc->vc_saved_screen = NULL;
+	}
 	return vc;
 }
 
@@ -1878,6 +1883,45 @@ static int get_bracketed_paste(struct tty_struct *tty)
 	return vc->vc_bracketed_paste;
 }
 
+/* console_lock is held */
+static void enter_alt_screen(struct vc_data *vc)
+{
+	unsigned int size = vc->vc_rows * vc->vc_cols * 2;
+
+	if (vc->vc_saved_screen != NULL)
+		return; /* Already inside an alt-screen */
+	vc->vc_saved_screen = kmemdup((u16 *)vc->vc_origin, size, GFP_KERNEL);
+	if (vc->vc_saved_screen == NULL)
+		return;
+	vc->vc_saved_rows = vc->vc_rows;
+	vc->vc_saved_cols = vc->vc_cols;
+	save_cur(vc);
+	/* clear entire screen */
+	csi_J(vc, CSI_J_FULL);
+}
+
+/* console_lock is held */
+static void leave_alt_screen(struct vc_data *vc)
+{
+	unsigned int rows = min(vc->vc_saved_rows, vc->vc_rows);
+	unsigned int cols = min(vc->vc_saved_cols, vc->vc_cols);
+	u16 *src, *dest;
+
+	if (vc->vc_saved_screen == NULL)
+		return; /* Not inside an alt-screen */
+	for (unsigned int r = 0; r < rows; r++) {
+		src = vc->vc_saved_screen + r * vc->vc_saved_cols;
+		dest = ((u16 *)vc->vc_origin) + r * vc->vc_cols;
+		memcpy(dest, src, 2 * cols);
+	}
+	restore_cur(vc);
+	/* Update the entire screen */
+	if (con_should_update(vc))
+		do_update_region(vc, vc->vc_origin, vc->vc_screenbuf_size / 2);
+	kfree(vc->vc_saved_screen);
+	vc->vc_saved_screen = NULL;
+}
+
 enum {
 	CSI_DEC_hl_CURSOR_KEYS	= 1,	/* CKM: cursor keys send ^[Ox/^[[x */
 	CSI_DEC_hl_132_COLUMNS	= 3,	/* COLM: 80/132 mode switch */
@@ -1888,6 +1932,7 @@ enum {
 	CSI_DEC_hl_MOUSE_X10	= 9,
 	CSI_DEC_hl_SHOW_CURSOR	= 25,	/* TCEM */
 	CSI_DEC_hl_MOUSE_VT200	= 1000,
+	CSI_DEC_hl_ALT_SCREEN	= 1049,
 	CSI_DEC_hl_BRACKETED_PASTE = 2004,
 };
 
@@ -1944,6 +1989,12 @@ static void csi_DEC_hl(struct vc_data *vc, bool on_off)
 		case CSI_DEC_hl_BRACKETED_PASTE:
 			vc->vc_bracketed_paste = on_off;
 			break;
+		case CSI_DEC_hl_ALT_SCREEN:
+			if (on_off)
+				enter_alt_screen(vc);
+			else
+				leave_alt_screen(vc);
+			break;
 		}
 }
 
@@ -2182,6 +2233,13 @@ static void reset_terminal(struct vc_data *vc, int do_clear)
 	vc->vc_deccm		= global_cursor_default;
 	vc->vc_decim		= 0;
 
+	if (vc->vc_saved_screen != NULL) {
+		kfree(vc->vc_saved_screen);
+		vc->vc_saved_screen = NULL;
+		vc->vc_saved_rows = 0;
+		vc->vc_saved_cols = 0;
+	}
+
 	vt_reset_keyboard(vc->vc_num);
 
 	vc->vc_cursor_type = cur_default;
diff --git a/include/linux/console_struct.h b/include/linux/console_struct.h
index 59b4fec5f..13b35637b 100644
--- a/include/linux/console_struct.h
+++ b/include/linux/console_struct.h
@@ -159,6 +159,9 @@ struct vc_data {
 	struct uni_pagedict *uni_pagedict;
 	struct uni_pagedict **uni_pagedict_loc; /* [!] Location of uni_pagedict variable for this console */
 	u32 **vc_uni_lines;			/* unicode screen content */
+	u16		*vc_saved_screen;
+	unsigned int	vc_saved_cols;
+	unsigned int	vc_saved_rows;
 	/* additional information is in vt_kern.h */
 };
 
-- 
2.51.0

Re: [PATCH v3] vt: add support for smput/rmput escape codes

[Jiri Slaby]

On 09. 09. 25, 22:26, Calixte Pernot wrote:
> From: Calixte Pernot <c@lixte.email>
> 
> Support "\e[?1049h" and "\e[?1049l" escape codes.
> This patch allows programs to enter and leave alternate screens.
> This feature is widely available in graphical terminal emulators and mostly
> used by fullscreen terminal-based user interfaces such as text editors.
> Most editors such as vim and nano assume this escape code in not supported
> and will not try to print the escape sequence if TERM=linux.
> To try out this patch, run `TERM=xterm-256color vim` inside a VT.
> 
> Signed-off-by: Calixte Pernot <calixte.pernot@grenoble-inp.org>
> ---
>   drivers/tty/vt/vt.c            | 58 ++++++++++++++++++++++++++++++++++
>   include/linux/console_struct.h |  3 ++
>   2 files changed, 61 insertions(+)
> 
> diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
> index 62049ceb3..d9e4eb3f0 100644
> --- a/drivers/tty/vt/vt.c
> +++ b/drivers/tty/vt/vt.c
> @@ -141,6 +141,7 @@ static const struct consw *con_driver_map[MAX_NR_CONSOLES];
>   static int con_open(struct tty_struct *, struct file *);
>   static void vc_init(struct vc_data *vc, int do_clear);
>   static void gotoxy(struct vc_data *vc, int new_x, int new_y);
> +static void restore_cur(struct vc_data *vc);
>   static void save_cur(struct vc_data *vc);
>   static void reset_terminal(struct vc_data *vc, int do_clear);
>   static void con_flush_chars(struct tty_struct *tty);
> @@ -1344,6 +1345,10 @@ struct vc_data *vc_deallocate(unsigned int currcons)
>   		kfree(vc->vc_screenbuf);
>   		vc_cons[currcons].d = NULL;
>   	}
> +	if (vc->vc_saved_screen != NULL) {
> +		kfree(vc->vc_saved_screen);
> +		vc->vc_saved_screen = NULL;
> +	}

Yes, that's the bug. (I am not sure why are you sending this?)

thanks,
-- 
js
suse labs

Re: [PATCH v3] vt: add support for smput/rmput escape codes

[Calixte Pernot]

Yep, I don't know what went wrong here.

I didn't see the commit you sent to fix this issue, so I tried to send a 
new patch that fixes the issue, but I somehow sent the wrong patch. Sorry.

Thank you for your fix.

On 9/10/25 08:43, Jiri Slaby wrote:
> On 09. 09. 25, 22:26, Calixte Pernot wrote:
>> From: Calixte Pernot <c@lixte.email>
>>
>> Support "\e[?1049h" and "\e[?1049l" escape codes.
>> This patch allows programs to enter and leave alternate screens.
>> This feature is widely available in graphical terminal emulators and 
>> mostly
>> used by fullscreen terminal-based user interfaces such as text editors.
>> Most editors such as vim and nano assume this escape code in not 
>> supported
>> and will not try to print the escape sequence if TERM=linux.
>> To try out this patch, run `TERM=xterm-256color vim` inside a VT.
>>
>> Signed-off-by: Calixte Pernot <calixte.pernot@grenoble-inp.org>
>> ---
>>   drivers/tty/vt/vt.c            | 58 ++++++++++++++++++++++++++++++++++
>>   include/linux/console_struct.h |  3 ++
>>   2 files changed, 61 insertions(+)
>>
>> diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
>> index 62049ceb3..d9e4eb3f0 100644
>> --- a/drivers/tty/vt/vt.c
>> +++ b/drivers/tty/vt/vt.c
>> @@ -141,6 +141,7 @@ static const struct consw 
>> *con_driver_map[MAX_NR_CONSOLES];
>>   static int con_open(struct tty_struct *, struct file *);
>>   static void vc_init(struct vc_data *vc, int do_clear);
>>   static void gotoxy(struct vc_data *vc, int new_x, int new_y);
>> +static void restore_cur(struct vc_data *vc);
>>   static void save_cur(struct vc_data *vc);
>>   static void reset_terminal(struct vc_data *vc, int do_clear);
>>   static void con_flush_chars(struct tty_struct *tty);
>> @@ -1344,6 +1345,10 @@ struct vc_data *vc_deallocate(unsigned int 
>> currcons)
>>           kfree(vc->vc_screenbuf);
>>           vc_cons[currcons].d = NULL;
>>       }
>> +    if (vc->vc_saved_screen != NULL) {
>> +        kfree(vc->vc_saved_screen);
>> +        vc->vc_saved_screen = NULL;
>> +    }
>
> Yes, that's the bug. (I am not sure why are you sending this?)
>
> thanks,

Re: vt: add support for smput/rmput escape codes

[Jiri Slaby]

On 09. 09. 25, 21:15, Colin King (gmail) wrote:
> Hi,
> 
> Static analysis on linux-next detected an issue with the following commit:
> 
> commit 23743ba64709a9c137c1b928f8b8e00d846af9cc
> Author: Calixte Pernot <calixte.pernot@grenoble-inp.org>
> Date:   Mon Aug 25 14:56:09 2025 +0200
> 
>      vt: add support for smput/rmput escape codes
> 
> 
> The issue is as follows in drivers/tty/vt/vt.c function vc_deallocate, 
> with my nodes prefixed by #####
> 
> struct vc_data *vc_deallocate(unsigned int currcons)
> {
...
>      ##### vc is potentially null and being dereferenced below:
> 
>          if (vc->vc_saved_screen != NULL) {
>                  kfree(vc->vc_saved_screen);
>                  vc->vc_saved_screen = NULL;
>          }
>          return vc;
> }
> 
> 
> The issue is that vc is only set in the if (vc_cons_allocated(currcons)) 
> if block, and when it is not set, we end up with a null pointer de- 
> reference on the if (vc->vc_saved_screen != NULL) check.
> 
> I suggest moving that latter check into the earlier if block.

Agreed:
https://lore.kernel.org/all/tencent_CAD45DB31906CF890DBB25AB0DED12205D07@qq.com/

thanks,
-- 
js
suse labs