The patch titled vt: incomplete initialization of vc_tab_stop has been removed from the -mm tree. Its filename was vt-incomplete-initialization-of-vc_tab_stop.patch This patch was dropped because it was merged into mainline or a subsystem tree The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: vt: incomplete initialization of vc_tab_stop From: Wolfgang Kroworsch <wolfgang@xxxxxxxxxxxx> Problem 1 (see patch below): vc_tab_stop is declared as an array of 8 unsigned ints in struct vc_data in include/linux/console_struct.h . In drivers/char/vt.c only 5 of these 8 unsigned ints get initialized leading to unintended tabulator placement on displays with more than 160 columns text. Problem 2 (open): Upcoming displays will have more than 256 columns of text leading to invalid memory access in drivers/char/vt.c during tabulator calculations: if (vc->vc_tab_stop[vc->vc_x >> 5] & (1 << (vc->vc_x & 31))) break; Signed-off-by: Wolfgang Kroworsch <wolfgang@xxxxxxxxxxxx> Cc: Alan Cox <alan@xxxxxxxxxxxxxxxxxxx> Cc: Christoph Hellwig <hch@xxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- drivers/char/vt.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff -puN drivers/char/vt.c~vt-incomplete-initialization-of-vc_tab_stop drivers/char/vt.c --- a/drivers/char/vt.c~vt-incomplete-initialization-of-vc_tab_stop +++ a/drivers/char/vt.c @@ -1644,7 +1644,10 @@ static void reset_terminal(struct vc_dat vc->vc_tab_stop[1] = vc->vc_tab_stop[2] = vc->vc_tab_stop[3] = - vc->vc_tab_stop[4] = 0x01010101; + vc->vc_tab_stop[4] = + vc->vc_tab_stop[5] = + vc->vc_tab_stop[6] = + vc->vc_tab_stop[7] = 0x01010101; vc->vc_bell_pitch = DEFAULT_BELL_PITCH; vc->vc_bell_duration = DEFAULT_BELL_DURATION; @@ -1935,7 +1938,10 @@ static void do_con_trol(struct tty_struc vc->vc_tab_stop[1] = vc->vc_tab_stop[2] = vc->vc_tab_stop[3] = - vc->vc_tab_stop[4] = 0; + vc->vc_tab_stop[4] = + vc->vc_tab_stop[5] = + vc->vc_tab_stop[6] = + vc->vc_tab_stop[7] = 0; } return; case 'm': _ Patches currently in -mm which might be from wolfgang@xxxxxxxxxxxx are -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html