- 02 Feb, 2015 38 commits
-
-
Peter Hurley authored
The pty driver does not clear its write buffer when commanded. This is to avoid an apparent deadlock between parallel flushes from both pty ends; specifically when handling either BRK or INTR input. However, parallel flushes from this source is not possible since the pty master can never be set to BRKINT or ISIG. Parallel flushes from other sources are possible but these do not threaten deadlocks. Annotate the tty buffer mutex for lockdep to represent the nested tty_buffer locking which occurs when the pty slave is processing input (its buffer mutex held) and receives INTR or BRK and acquires the linked tty buffer mutex via tty_buffer_flush(). Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Peter Hurley authored
Besides nested legacy_mutex locking which is required on pty pair teardown, other nested pty operations require lock subclassing. Move lock subclass definition to tty interface header, include/linux/tty.h, and document its use. Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Peter Hurley authored
In canon mode, the read buffer head will advance over the buffer tail if the input > 4095 bytes without receiving a line termination char. Discard additional input until a line termination is received. Before evaluating for overflow, the 'room' value is normalized for I_PARMRK and 1 byte is reserved for line termination (even in !icanon mode, in case the mode is switched). The following table shows the transform: actual buffer | 'room' value before overflow calc space avail | !I_PARMRK | I_PARMRK -------------------------------------------------- 0 | -1 | -1 1 | 0 | 0 2 | 1 | 0 3 | 2 | 0 4+ | 3 | 1 When !icanon or when icanon and the read buffer contains newlines, normalized 'room' values of -1 and 0 are clamped to 0, and 'overflow' is 0, so read_head is not adjusted and the input i/o loop exits (setting no_room if called from flush_to_ldisc()). No input is discarded since the reader does have input available to read which ensures forward progress. When icanon and the read buffer does not contain newlines and the normalized 'room' value is 0, then overflow and room are reset to 1, so that the i/o loop will process the next input char normally (except for parity errors which are ignored). Thus, erasures, signalling chars, 7-bit mode, etc. will continue to be handled properly. If the input char processed was not a line termination char, then the canon_head index will not have advanced, so the normalized 'room' value will now be -1 and 'overflow' will be set, which indicates the read_head can safely be reset, effectively erasing the last char processed. If the input char processed was a line termination, then the canon_head index will have advanced, so 'overflow' is cleared to 0, the read_head is not reset, and 'room' is cleared to 0, which exits the i/o loop (because the reader now have input available to read which ensures forward progress). Note that it is possible for a line termination to be received, and for the reader to copy the line to the user buffer before the input i/o loop is ready to process the next input char. This is why the i/o loop recomputes the room/overflow state with every input char while handling overflow. Finally, if the input data was processed without receiving a line termination (so that overflow is still set), the pty driver must receive a write wakeup. A pty writer may be waiting to write more data in n_tty_write() but without unthrottling here that wakeup will not arrive, and forward progress will halt. (Normally, the pty writer is woken when the reader reads data out of the buffer and more space become available). Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Peter Hurley authored
If PARMRK is enabled, the available read buffer space computation is overly-pessimistic, which results in severely throttled i/o, even in the absence of parity errors. For example, if the 4k read buffer contains 1k processed data, the input worker will compute available space of 333 bytes, despite 3k being available. At 1365 chars of processed data, 0 space available is computed. *Divide remaining space* by 3, truncating down (if left == 2, left = 0). Reported-by: Christian Riesch <christian.riesch@omicron.at> Conflicts: drivers/tty/n_tty.c Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Peter Hurley authored
Add commit_head buffer index, which the producer-side publishes after input processing in non-canon mode. This ensures the consumer-side observes correctly-ordered writes in non-canonical mode (ie., the buffer data is written before the buffer index is advanced). Fix consumer-side uses of read_cnt() to use commit_head instead. Add required memory barriers to the tail index to guarantee the consumer-side has completed the loads before the producer-side begins writing new data. Open-code the producer-side receive_room() into the i/o loop. Remove no-longer-referenced receive_room(). Based on work by Christian Riesch <christian.riesch@omicron.at> Cc: Christian Riesch <christian.riesch@omicron.at> Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Peter Hurley authored
The adjustments performed by receive_room() are to ensure a line termination can always be written to the read buffer. However, these adjustments are irrelevant to the throttle threshold (because the threshold < buffer limit). Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Peter Hurley authored
The tty driver will be mistakenly throttled if a line termination has not been received, and the line exceeds 3967 chars. Thus, it is possible for the driver to stop sending when it has not yet sent the newline. This does not apply to the pty driver. Don't throttle until at least one line termination has been received. Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Peter Hurley authored
The input worker never reschedules itself; it only processes input until either there is no more input or the read buffer is full. So the reader is responsible for restarting the input worker only if the read buffer was previously full (no_room == 1) _and_ space is now available to process more input because the reader has consumed data from the read buffer. However, computing the actual space available is not required to determine if the reader has consumed data from the read buffer. This condition is evaluated in 5 situations, each of which the space avail is already known: 1. n_tty_flush_buffer() - the read buffer is empty; kick the worker 2. n_tty_set_termios() - no data has been consumed; do not kick the worker (although it may have kicked the reader so data _will be_ consumed) 3. n_tty_check_unthrottle - avail space > 3968; kick the worker 4. n_tty_read, before leaving - only kick the worker if the reader has moved the tail. This prevents unnecessarily kicking the worker when timeout-style reading is used. 5. n_tty_read, before sleeping - although it is possible for the read buffer to be full and input_available_p() to be false, this can only happen when the input worker is racing the reader, in which case the reader will have been woken and won't sleep. Rename n_tty_set_room() to n_tty_kick_worker() to reflect what the function actually does. Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Tomasz Figa authored
This patch adds stdout-path property to chosen nodes of Exynos4 boards to enable use of earlycon feature without the need to hardcode port number in kernel itself. Signed-off-by: Tomasz Figa <t.figa@samsung.com> Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Tomasz Figa authored
This patch adds support for early console initialized from device tree and kernel command line to all variants of Samsung serial driver. Signed-off-by: Tomasz Figa <t.figa@samsung.com> [mszyprow: added support for command line based initialization, fixed comments, added documentation] Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com> Tested-by: Alim Akhtar <alim.akhtar@samsung.com> Tested-by: Chanwoo Choi <cw00.choi@samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Hisashi Nakamura authored
When fifo overrun happened, the interrupt status refers to SCLSR register in R-Car SCIF and HSCIF. Thus, overrun handling takes SCLSR register into account. Signed-off-by: Hisashi Nakamura <hisashi.nakamura.ak@renesas.com> Signed-off-by: Yoshihiro Kaneko <ykaneko0929@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Yoshihiro Kaneko authored
Since the driver cannot return from overrun error if characters are output during overrun process, use dev_dbg() instead of dev_notice() to log the error message of overrun in syslog. Based on a patch by Hisashi Nakamura. Signed-off-by: Yoshihiro Kaneko <ykaneko0929@gmail.com> Acked-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Andy Shevchenko authored
If we would like to send amount of data less than FIFO size we better would do this via PIO mode. Otherwise the overhead could be significant. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Andy Shevchenko authored
Since we return in the first branch the second one doesn't require an additional else keyword. The patch removes it. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Sergei Shtylyov authored
In order to make it possible to restore from hibernation not only in Linux but also in e.g. U-Boot, we have to use sci_{suspend|remove}() for the PM {freeze| thaw|restore}() methods. It's handy to achieve this by using SIMPLE_DEV_PM_OPS() macro, however we have to annotate sci_{suspend|remove}() with '__maybe_unused' in order to avoid compilation warnings when CONFIG_PM_SLEEP is undefined. Based on orignal patch by Mikhail Ulyanov <mikhail.ulyanov@cogentembedded.com>. Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Peter Hurley authored
The pty_space() computation is broken; the space already consumed in the tty buffer is not accounted for. Use tty_buffer_set_limit(), which enforces the limit automatically. Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Nathan Rossi authored
The implementation of flushing the RX FIFO breaks in a number of cases, it is impossible to ensure an complete flush of the RX FIFO due to the hardware not allowing the use of the FIFOs when the receiver is disabled (Reading from the FIFO register does not remove it from the FIFO when the RX_EN=0 or RX_DIS=1). Additionally during an initial set_termios call where RX_DIS=1 causes a hang waiting forever for the RX FIFO to empty. On top of this the FIFO will be cleared by the use of the RXRST bits on the Control Register, making the RX flush pointless (as it does not preserve the data read anyway). Due to the TXRST the TX FIFO and transmitter can be interrupted during frame trasmission, causing corruption and additionally data lost in the FIFO. Most other serial drivers do not flush or clear the FIFOs during a termios configuration change and as such do not have issues with corruption. For this UART controller is it required that the TXRST/RXRST bit be flagged during the change, this means that the data in the FIFO will be dropped when changing configuration. In order to prevent data loss and corruption of the transmitted data, wait until the TX FIFO is empty before changing the configuration. The performance of this may cause the set_termios call to take a longer amount of time especially on lower baud rates, however it is comparable to the same performance hit that a console_write call costs. Signed-off-by: Nathan Rossi <nathan.rossi@xilinx.com> Acked-by: Anirudha Sarangi <anirudh@xilinx.com> Acked-by: Harini Katakam <harinik@xilinx.com> Signed-off-by: Michal Simek <michal.simek@xilinx.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Arnd Bergmann authored
Building an arm allmodconfig kernel triggers a lengthy but harmless warning in the isicom driver: drvers/tty/isicom.c: In function 'isicom_send_break': uapi/linux/swab.h:13:15: warning: integer overflow in expression [-Woverflow] (((__u16)(x) & (__u16)0x00ffU) << 8) | \ ^ uapi/linux/swab.h:107:2: note: in expansion of macro '___constant_swab16' ___constant_swab16(x) : \ ^ uapi/linux/byteorder/big_endian.h:34:43: note: in expansion of macro '__swab16' #define __cpu_to_le16(x) ((__force __le16)__swab16((x))) ^ linux/byteorder/generic.h:89:21: note: in expansion of macro '__cpu_to_le16' #define cpu_to_le16 __cpu_to_le16 ^ include/asm/io.h:270:6: note: in expansion of macro 'cpu_to_le16' cpu_to_le16(v),__io(p)); }) ^ drivers/tty/isicom.c:1058:2: note: in expansion of macro 'outw' outw((length & 0xff00), base); ^ Apparently, the problem is related to the fact that the value 0xff00, when used as a 16-bit number, is negative and passed into bitwise operands of the generic byte swapping code. Marking the input argument as unsigned in both technically correct and avoids the warning. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Fabio Estevam authored
There is no need to explicitly zero the 'ret' variable as it is properly initialized in a few lines below as: ret = serial_mxs_probe_dt(s, pdev); Remove the unneeded zeroing of 'ret'. Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Fabio Estevam authored
We should check whether platform_get_irq() failed, and in the case of error this needs to be propagated. Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Fabio Estevam authored
The irq number is only used inside the probe function, so there is no need to keep it in the private mxs_auart_port structure. Use a local 'irq' variable for storing the irq number instead. Also make its type of 'int' as platform_get_irq() may fail and return a negative number. Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Baruch Siach authored
The Digicolor USART hardware does not support detecting the BREAK condition. This means that we can't support sysrq on this hardware. Remove all reference to sysrq from the code. This also fixes build when sysrq is disabled: drivers/tty/serial/digicolor-usart.c: In function 'digicolor_uart_console_write': drivers/tty/serial/digicolor-usart.c:407:33: error: 'struct uart_port' has no member named 'sysrq' Reported-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Peter Hurley authored
When the kernel command line parameter, no_console_suspend, is used, the console should continue to output console messages during and after system suspend. For a serial console, the serial core ensures that the device is not shutdown when no_console_suspend is specified. However, the default operation of the pnp bus will disable and suspend the device and no further output occurs. When registering the 8250 port, if the serial device is a console set the PNP_CONSOLE capability, which prevents device power-off if consoles are not suspending. Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Peter Hurley authored
If the serial console is an ACPI PNP device, the PNP bus always powers down the device at system suspend, even though the no_console_suspend command line parameter is specified (eg., when debugging suspend/resume). Add PNP_CONSOLE capability, which when set, prevents calling both the ->disable() and ->suspend() PNP protocol methods if console suspend is disabled. Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Pramod Gurav authored
unregister_console() will be called from uart_remove_one_port() while removing the platform driver. So not necessary to call it in driver exit path. Signed-off-by: Pramod Gurav <pramod.gurav@smartplayin.com> Reviewed-by: Stephen Boyd <sboyd@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Pramod Gurav authored
The change does following: - baud, flow, bits, parity were being overwritten as they were being reinitialized after parsing. Initialize them when they are declared so that user provided setting are not overwritten. - msm_set_baud_rate() is anyway called in uart_set_options when it calls msm_set_termios(). msm_reset() is called when we change the baud rate. Hence doing away with both of these calls. - CR_CMD_PROTECTION_EN and CR_TX_ENABLE settings are done in msm_set_baud_rate. So do away with this here. Signed-off-by: Pramod Gurav <pramod.gurav@smartplayin.com> Reviewed-by: Stephen Boyd <sboyd@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Heikki Krogerus authored
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Andy Shevchenko authored
Intel Moorestown platform support was removed few years ago. This is a follow up which removes Moorestown specific code for the serial devices. It includes mrst_max3110 and earlyprintk bits. This was used on SFI (Medfield, Clovertrail) based platforms as well, though new ones use normal serial interface for the console service. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: David Cohen <david.a.cohen@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Fabio Estevam authored
When running an userspace program that does a 'tcflush(fd, TCIOFLUSH)' call we still see the last received character in the URXD register afterwards. Clear UCR2_SRST bit so that the UART FIFO is flushed properly. Since UCR2_SRST also resets some UART registers, we need to save and restore some of them. Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com> Tested-by: Fugang Duan <B38611@freescale.com> Acked-by: Jason Liu <r64343@freecale.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Stefan Agner authored
On uart buffer flush, serial core resets the circular buffer. If a DMA transfer is in progress at that time, the callback lpuart_dma_tx_complete will move buffer's tail unconditionally, hence tail moves beyond head. Use the flush_buffer hook to terminate the DMA imeaditely and avoid lpuart_dma_tx_complete being called in this situation. This bug often showed up while shutdown and lead to duplicate serial console output. Signed-off-by: Stefan Agner <stefan@agner.ch> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Yuan Yao authored
For power management support, we should disable TX and TX interrupt so that kernel can prepare for deep sleep. Retain RX and RX interrupt for wakeup the kernel when receive the input character. Signed-off-by: Yuan Yao <yao.yuan@freescale.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Stefan Agner authored
To end a DMA transfer which did not consume a whole buffer (e.g. one character only), a RX timer is used. When lots of data are received the DMA transfer will complete and setup another DMA transfer, which in turn might complete again. In this cases, it is not necessary to abort the DMA transfers using the RX timer. This change pushes the RX timer timeout into the future each time a DMA transfer completed. Aborting the DMA was not very harmful, since the next received character lead to setup of another RX DMA. Signed-off-by: Stefan Agner <stefan@agner.ch> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Stefan Agner authored
Move the DMA channel request to probe to avoid requesting the DMA channel on each opening of the ttyLPx device. This also fixes a potential issue that TX channel is not freed when only RX channel allocation fails. The DMA channels are now handled independently, so one could use UART with DMA only in TX direction for instance. Signed-off-by: Stefan Agner <stefan@agner.ch> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Stefan Agner authored
When the UART is in DMA receive mode (RDMAS set) and one character just arrived while another interrupt is handled (e.g. TX), the RDRF (receiver data register full flag) is set due to the water level of 1. But since the DMA will take care of this character, there is no need to handle it by calling lpuart_prepare_rx. Handling it leads to adding the RX timeout timer twice: [ 74.336698] Kernel BUG at 80053070 [verbose debug info unavailable] [ 74.342999] Internal error: Oops - BUG: 0 [#1] ARM0:00.00 khungtaskd [ 74.347817] Modules linked in: 0 S 0.0 0.0 0:00.00 writeback [ 74.350926] CPU: 0 PID: 0 Comm: swapper Not tainted 3.19.0-rc3-00001-g39d78e2 #1788 [ 74.358617] Hardware name: Freescale Vybrid VF610 (Device Tree)t [ 74.364563] task: 807a7678 ti: 8079c000 task.ti: 8079c000 kblockd [ 74.370002] PC is at add_timer+0x24/0x28.0 0.0 0:00.09 kworker/u2:1 [ 74.373960] LR is at lpuart_int+0x15c/0x3d8 [ 74.378171] pc : [<80053070>] lr : [<802e0d88>] psr: a0010193 [ 74.378171] sp : 8079de10 ip : 8079de20 fp : 8079de1c [ 74.389694] r10: 807d44c0 r9 : 8688c300 r8 : 00000013 [ 74.394943] r7 : 20010193 r6 : 00000000 r5 : 000000a0 r4 : 86997210 [ 74.401498] r3 : ffffa7da r2 : 80817868 r1 : 86997210 r0 : 86997344 [ 74.408052] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel [ 74.415489] Control: 10c5387d Table: 8611c059 DAC: 00000015 [ 74.421265] Process swapper (pid: 0, stack limit = 0x8079c230) ... Solve this by only execute the receiver path (lpuart_prepare_rx) if the DMA receive mode (RDMAS) is not set. Also, make sure the flag is cleared on initialization, in case it has been left set. This can be best reproduced using UART as a serial console, then running top while dd'ing data into the terminal. Signed-off-by: Stefan Agner <stefan@agner.ch> Cc: stable <stable@vger.kernel.org> # 3.14 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Stefan Agner authored
If the serial port gets closed while a RX transfer is in progress, the timer might fire after the serial port shutdown finished. This leads in a NULL pointer dereference: [ 7.508324] Unable to handle kernel NULL pointer dereference at virtual address 00000000 [ 7.516590] pgd = 86348000 [ 7.519445] [00000000] *pgd=86179831, *pte=00000000, *ppte=00000000 [ 7.526145] Internal error: Oops: 17 [#1] ARM [ 7.530611] Modules linked in: [ 7.533876] CPU: 0 PID: 123 Comm: systemd Not tainted 3.19.0-rc3-00004-g5b11ea7 #1778 [ 7.541827] Hardware name: Freescale Vybrid VF610 (Device Tree) [ 7.547862] task: 861c3400 ti: 86ac8000 task.ti: 86ac8000 [ 7.553392] PC is at lpuart_timer_func+0x24/0xf8 [ 7.558127] LR is at lpuart_timer_func+0x20/0xf8 [ 7.562857] pc : [<802df99c>] lr : [<802df998>] psr: 600b0113 [ 7.562857] sp : 86ac9b90 ip : 86ac9b90 fp : 86ac9bbc [ 7.574467] r10: 80817180 r9 : 80817b98 r8 : 80817998 [ 7.579803] r7 : 807acee0 r6 : 86989000 r5 : 00000100 r4 : 86997210 [ 7.586444] r3 : 86ac8000 r2 : 86ac9bc0 r1 : 86997210 r0 : 00000000 [ 7.593085] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user [ 7.600341] Control: 10c5387d Table: 86348059 DAC: 00000015 [ 7.606203] Process systemd (pid: 123, stack limit = 0x86ac8230) Setup the timer on UART startup which allows to delete the timer unconditionally on shutdown. This also saves the initialization on each transfer. Signed-off-by: Stefan Agner <stefan@agner.ch> Cc: stable <stable@vger.kernel.org> # 3.14 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Peter Hurley authored
Commit 26df6d13 ("tty: Add EXTPROC support for LINEMODE") allows a process which has opened a pty master to send _any_ signal to the process group of the pty slave. Although potentially exploitable by a malicious program running a setuid program on a pty slave, it's unknown if this exploit currently exists. Limit to signals actually used. Cc: Theodore Ts'o <tytso@mit.edu> Cc: Howard Chu <hyc@symas.com> Cc: One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> Cc: Jiri Slaby <jslaby@suse.cz> Cc: <stable@vger.kernel.org> # 2.6.36+ Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Nicolas Pitre authored
The vcs device's poll/fasync support relies on the vt notifier to signal changes to the screen content. Notifier invocations were missing for changes that comes through the selection interface though. Fix that. Tested with BRLTTY 5.2. Signed-off-by: Nicolas Pitre <nico@linaro.org> Cc: Dave Mielke <dave@mielke.cc> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Dave Airlie authored
These two copy to/from VGA memory, however on the Silicon Motion SMI750 VGA card on a 64-bit system cause console corruption. This is due to the hw being buggy and not handling a 64-bit transaction correctly. We could try and create a 32-bit version of these routines, but I'm not sure the optimisation is worth much today. Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1132826 Tested-by: Huawei engineering. Signed-off-by: Dave Airlie <airlied@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
- 18 Jan, 2015 2 commits
-
-
Greg Kroah-Hartman authored
We want those tty fixes in that release in this branch as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Linus Torvalds authored
-