Commit ccf791e5 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman

Merge tag 'tty-4.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

I wrote:
  "TTY/Serial driver fixes for 4.19-rc6

   Here are a number of small tty and serial driver fixes for reported
   issues for 4.19-rc6.

   One should hopefully resolve a much-reported issue that syzbot has found
   in the tty layer.  Although there are still more issues there, getting
   this fixed is nice to see finally happen.

   All of these have been in linux-next for a while with no reported
   issues."

* tag 'tty-4.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  serial: imx: restore handshaking irq for imx1
  tty: vt_ioctl: fix potential Spectre v1
  tty: Drop tty->count on tty_reopen() failure
  serial: cpm_uart: return immediately from console poll
  tty: serial: lpuart: avoid leaking struct tty_struct
  serial: mvebu-uart: Fix reporting of effective CSIZE to userspace
parents fc0c8146 7e620984
...@@ -1054,8 +1054,8 @@ static int poll_wait_key(char *obuf, struct uart_cpm_port *pinfo) ...@@ -1054,8 +1054,8 @@ static int poll_wait_key(char *obuf, struct uart_cpm_port *pinfo)
/* Get the address of the host memory buffer. /* Get the address of the host memory buffer.
*/ */
bdp = pinfo->rx_cur; bdp = pinfo->rx_cur;
while (bdp->cbd_sc & BD_SC_EMPTY) if (bdp->cbd_sc & BD_SC_EMPTY)
; return NO_POLL_CHAR;
/* If the buffer address is in the CPM DPRAM, don't /* If the buffer address is in the CPM DPRAM, don't
* convert it. * convert it.
...@@ -1090,7 +1090,11 @@ static int cpm_get_poll_char(struct uart_port *port) ...@@ -1090,7 +1090,11 @@ static int cpm_get_poll_char(struct uart_port *port)
poll_chars = 0; poll_chars = 0;
} }
if (poll_chars <= 0) { if (poll_chars <= 0) {
poll_chars = poll_wait_key(poll_buf, pinfo); int ret = poll_wait_key(poll_buf, pinfo);
if (ret == NO_POLL_CHAR)
return ret;
poll_chars = ret;
pollp = poll_buf; pollp = poll_buf;
} }
poll_chars--; poll_chars--;
......
...@@ -979,7 +979,8 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport) ...@@ -979,7 +979,8 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport)
struct circ_buf *ring = &sport->rx_ring; struct circ_buf *ring = &sport->rx_ring;
int ret, nent; int ret, nent;
int bits, baud; int bits, baud;
struct tty_struct *tty = tty_port_tty_get(&sport->port.state->port); struct tty_port *port = &sport->port.state->port;
struct tty_struct *tty = port->tty;
struct ktermios *termios = &tty->termios; struct ktermios *termios = &tty->termios;
baud = tty_get_baud_rate(tty); baud = tty_get_baud_rate(tty);
......
...@@ -2351,6 +2351,14 @@ static int imx_uart_probe(struct platform_device *pdev) ...@@ -2351,6 +2351,14 @@ static int imx_uart_probe(struct platform_device *pdev)
ret); ret);
return ret; return ret;
} }
ret = devm_request_irq(&pdev->dev, rtsirq, imx_uart_rtsint, 0,
dev_name(&pdev->dev), sport);
if (ret) {
dev_err(&pdev->dev, "failed to request rts irq: %d\n",
ret);
return ret;
}
} else { } else {
ret = devm_request_irq(&pdev->dev, rxirq, imx_uart_int, 0, ret = devm_request_irq(&pdev->dev, rxirq, imx_uart_int, 0,
dev_name(&pdev->dev), sport); dev_name(&pdev->dev), sport);
......
...@@ -511,6 +511,7 @@ static void mvebu_uart_set_termios(struct uart_port *port, ...@@ -511,6 +511,7 @@ static void mvebu_uart_set_termios(struct uart_port *port,
termios->c_iflag |= old->c_iflag & ~(INPCK | IGNPAR); termios->c_iflag |= old->c_iflag & ~(INPCK | IGNPAR);
termios->c_cflag &= CREAD | CBAUD; termios->c_cflag &= CREAD | CBAUD;
termios->c_cflag |= old->c_cflag & ~(CREAD | CBAUD); termios->c_cflag |= old->c_cflag & ~(CREAD | CBAUD);
termios->c_cflag |= CS8;
} }
spin_unlock_irqrestore(&port->lock, flags); spin_unlock_irqrestore(&port->lock, flags);
......
...@@ -1255,6 +1255,7 @@ static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct * ...@@ -1255,6 +1255,7 @@ static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *
static int tty_reopen(struct tty_struct *tty) static int tty_reopen(struct tty_struct *tty)
{ {
struct tty_driver *driver = tty->driver; struct tty_driver *driver = tty->driver;
int retval;
if (driver->type == TTY_DRIVER_TYPE_PTY && if (driver->type == TTY_DRIVER_TYPE_PTY &&
driver->subtype == PTY_TYPE_MASTER) driver->subtype == PTY_TYPE_MASTER)
...@@ -1268,10 +1269,14 @@ static int tty_reopen(struct tty_struct *tty) ...@@ -1268,10 +1269,14 @@ static int tty_reopen(struct tty_struct *tty)
tty->count++; tty->count++;
if (!tty->ldisc) if (tty->ldisc)
return tty_ldisc_reinit(tty, tty->termios.c_line); return 0;
return 0; retval = tty_ldisc_reinit(tty, tty->termios.c_line);
if (retval)
tty->count--;
return retval;
} }
/** /**
......
...@@ -32,6 +32,8 @@ ...@@ -32,6 +32,8 @@
#include <asm/io.h> #include <asm/io.h>
#include <linux/uaccess.h> #include <linux/uaccess.h>
#include <linux/nospec.h>
#include <linux/kbd_kern.h> #include <linux/kbd_kern.h>
#include <linux/vt_kern.h> #include <linux/vt_kern.h>
#include <linux/kbd_diacr.h> #include <linux/kbd_diacr.h>
...@@ -700,6 +702,8 @@ int vt_ioctl(struct tty_struct *tty, ...@@ -700,6 +702,8 @@ int vt_ioctl(struct tty_struct *tty,
if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES) if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES)
ret = -ENXIO; ret = -ENXIO;
else { else {
vsa.console = array_index_nospec(vsa.console,
MAX_NR_CONSOLES + 1);
vsa.console--; vsa.console--;
console_lock(); console_lock();
ret = vc_allocate(vsa.console); ret = vc_allocate(vsa.console);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment