- 14 Dec, 2015 40 commits
-
-
Peter Hurley authored
Line discipline drivers may mistakenly misuse ldisc-related fields when initializing. For example, a failure to initialize tty->receive_room in the N_GIGASET_M101 line discipline was recently found and fixed [1]. Now, the N_X25 line discipline has been discovered accessing the previous line discipline's already-freed private data [2]. Harden the ldisc interface against misuse by initializing revelant tty fields before instancing the new line discipline. [1] commit fd98e941 Author: Tilman Schmidt <tilman@imap.cc> Date: Tue Jul 14 00:37:13 2015 +0200 isdn/gigaset: reset tty->receive_room when attaching ser_gigaset [2] Report from Sasha Levin <sasha.levin@oracle.com> [ 634.336761] ================================================================== [ 634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0 [ 634.339558] Read of size 4 by task syzkaller_execu/8981 [ 634.340359] ============================================================================= [ 634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected ... [ 634.405018] Call Trace: [ 634.405277] dump_stack (lib/dump_stack.c:52) [ 634.405775] print_trailer (mm/slub.c:655) [ 634.406361] object_err (mm/slub.c:662) [ 634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236) [ 634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279) [ 634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1)) [ 634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447) [ 634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567) [ 634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879) [ 634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607) [ 634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613) [ 634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188) Cc: Tilman Schmidt <tilman@imap.cc> Cc: Sasha Levin <sasha.levin@oracle.com> Signed-off-by:Peter Hurley <peter@hurleysoftware.com> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Ben Dooks authored
Ensure that if the interrupt handler is entered then only try and do tx work if the tx irq is enabled. Signed-off-by:
Ben Dooks <ben.dooks@codethink.co.uk> Tested-by:
Carlo Caione <carlo@endlessm.com> Signed-off-by:
-
Ben Dooks authored
The tx_stop() call turns the interrupt off, but the tx_start() does not check if the interrupt is enabled. Switch it back on if there is more work to do. Signed-off-by:
-
Ben Dooks authored
As an attempt to stop issues with bad console output, ensure that both the rx and tx interrupts are disabled during the console write to avoid any problems with console and non-console being called together. This should help with the SMP case as it should stop other cores being signalled during the console write. Signed-off-by:
-
Ben Dooks authored
Use the meson_uart_tx_empty() instead of a direct read of the status register. This is easier to read and will ensure the UART's transmit state machine is idle when trying to update the baud rate. Signed-off-by:
-
Ben Dooks authored
Since disabling the transmit state machine still allows characters to be transmitted when written to the UART write FIFO, simply disable the transmit interrupt when the UART port is stopped. This has not shown an improvement with the console issues when running systemd, but seems like it should be done. Signed-off-by:
Edward Cragg <ed.cragg@codethink.co.uk> Tested-by:
-
Ben Dooks authored
Ensure the UART's transmitter is enabled when meson_console_putchar is called. If not, then the console output is corrupt (the hardware seems to try and send /something/ even if the TX is disabled). This fixes corrupt console output on events such as trying to reboot the system since the console tx may be called after drivers shutdown method has been called. Signed-off-by:
Edward Cragg <edward.cragg@codethink.co.uk> Tested-by:
-
Ben Dooks authored
The tx_empty() uart_op should only return empty if both the transmit fifo and the transmit state-machine are both idle. Add a test for the hardware's XMIT_BUSY flag. Note, this is possibly related to an issue where the port is being shutdown with paritally transmitted characters in it. Signed-off-by:
-
Ben Dooks authored
When the uart startup entry is called, do not reset the port as this could cause issues with anything left in the FIFO from a previous operation such as a console write. Move the hardware reset to probe time and simply clear the errors before enabling the port. This fixes the issue where the console could become corrupted as there where characters left in the output or output fifo when a user process such as systemd would open/close the uart to transmit characters. For example, you get: [ 3.252263] systemd[1]: Dete instead of: [ 3.338801] systemd[1]: Detected architecture arm. Signed-off-by: -
Ben Dooks authored
The meson_uart_release_port() unmaps the register area but does not release it. The meson_uart_request_port() calls devm_request_mem_region so the release should call devm_release_mem_region() for that area so that anyt subsequent use of these calls will work. This fixes an issue where the addition of reset code before registering the uart stops the console from working. Signed-off-by:
-
Russell King authored
Using relaxed IO accessors allows GCC to better optimise this code as we eliminate the heavy memory barriers - for example, GCC can now cache the address of a register across a read-modify-write sequence, rather than reloading the base address, offset and access size flag. Signed-off-by:
Russell King <rmk+kernel@arm.linux.org.uk> Reviewed-by:
-
Russell King authored
Add (incomplete) support for the ZTE UART to the AMBA PL011 driver. This is similar to the ARM and ST variants, except it has a different register address layout, and requires 32-bit accesses to the registers. Use the newly introduced register tables and access size support to cope with these differences. Signed-off-by:
-
Russell King authored
Add support for 32-bit register accesses to the AMBA PL011 UART. This is needed for ZTE UARTs, which require 32-bit accesses as opposed to the more normal 16-bit accesses. Signed-off-by:
-
Russell King authored
Remove the ST micro registers from the standard table. These registers should never be accessed in non-ST micro variants. Signed-off-by:
-
Russell King authored
As we can detect when the LCR register is split between TX and RX, we don't need three entries in the table to deal with this. Reduce this down to two entries by converting the REG_ST_LCRH_* entries to standard REG_LCRH_* and remove REG_LCRH. Signed-off-by:
-
Russell King authored
Add the ST variant register offset table to the driver. Currently, this is an identical copy of the standard version, but this will be modified in the following changes. Signed-off-by:
-
Russell King authored
Add the register offset table to the vendor data, allowing vendor differences to be described in this table. Signed-off-by:
-
Russell King authored
Add a register lookup table, which allows the register offsets to be adjusted on a per-port basis. Signed-off-by:
-
Peter Hurley authored
Instead of compare-and-set, just compute 'found'. Signed-off-by:
-
Peter Hurley authored
Add a temporary for the computed source address and substitute where appropriate. No functional change. Signed-off-by:
-
Peter Hurley authored
Merge the multiple tty_copy_to_user() calls into a single copy sequence within tty_copy_to_user(). Signed-off-by:
-
Arnd Bergmann authored
As the of-serial driver is now 8250 specific, we can move the file to a more appropriate place in teh 8250 subdirectory and adapt the Kconfig help text and file name. I'm leaving the CONFIG_SERIAL_OF_PLATFORM symbol unchanged to avoid breaking user configuration files unnecessarily. Signed-off-by:
Arnd Bergmann <arnd@arndb.de> Signed-off-by:
-
Arnd Bergmann authored
The only other user of this code was the nwp-serial driver, but that is now gone, so we can remove a couple of #ifdef statments in this driver. Signed-off-by:
-
Arnd Bergmann authored
The NWP serial driver is no longer needed, as the two users of this hardware have migrated to a much faster generation hardware, see https://en.wikipedia.org/wiki/QPACE2 for the replacement. Signed-off-by:
-
DengChao authored
The bfin-uart code uses real time with struct timeval. This will cause problems on 32-bit architectures in 2038 when time_t overflows. Since the code just needs delta value of time, it is not necessary to record them in real time. This patch changes the code to use the monotonic time instead, replaces struct timeval and do_gettimeofday() with u64 and ktime_get_ns(). Signed-off-by:
DengChao <chao.deng@linaro.org> Reviewed-by:
-
Geert Uytterhoeven authored
If NO_DMA=y: ERROR: "dma_unmap_sg" [drivers/tty/serial/mxs-auart.ko] undefined! ERROR: "dma_map_sg" [drivers/tty/serial/mxs-auart.ko] undefined! Add a dependency on HAS_DMA to fix this. Signed-off-by:Geert Uytterhoeven <geert@linux-m68k.org> Acked-by:
Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by:
-
Geert Uytterhoeven authored
If NO_DMA=y: ERROR: "dma_unmap_sg" [drivers/tty/serial/imx.ko] undefined! ERROR: "dma_map_sg" [drivers/tty/serial/imx.ko] undefined! Add a dependency on HAS_DMA to fix this. Signed-off-by: -
Geert Uytterhoeven authored
If NO_DMA=y: drivers/built-in.o: In function `atmel_release_rx_dma': atmel_serial.c:(.text+0x2502e): undefined reference to `dma_unmap_sg' drivers/built-in.o: In function `atmel_release_tx_dma': atmel_serial.c:(.text+0x25080): undefined reference to `dma_unmap_sg' drivers/built-in.o: In function `atmel_tx_dma': atmel_serial.c:(.text+0x2517a): undefined reference to `dma_sync_sg_for_cpu' drivers/built-in.o: In function `atmel_release_tx_pdc': atmel_serial.c:(.text+0x252e6): undefined reference to `dma_unmap_single' drivers/built-in.o: In function `atmel_prepare_tx_pdc': atmel_serial.c:(.text+0x2531a): undefined reference to `dma_map_single' drivers/built-in.o: In function `atmel_release_rx_pdc': atmel_serial.c:(.text+0x25362): undefined reference to `dma_unmap_single' drivers/built-in.o: In function `atmel_tx_pdc': atmel_serial.c:(.text+0x25722): undefined reference to `dma_sync_single_for_cpu' drivers/built-in.o: In function `atmel_rx_from_pdc': atmel_serial.c:(.text+0x2601a): undefined reference to `dma_sync_single_for_cpu' drivers/built-in.o: In function `atmel_rx_from_dma': atmel_serial.c:(.text+0x261b2): undefined reference to `dma_sync_sg_for_cpu' atmel_serial.c:(.text+0x26264): undefined reference to `dma_sync_sg_for_cpu' drivers/built-in.o: In function `atmel_prepare_rx_pdc': atmel_serial.c:(.text+0x262de): undefined reference to `dma_unmap_single' atmel_serial.c:(.text+0x26308): undefined reference to `dma_map_single' Add a dependency on HAS_DMA to fix this. Signed-off-by: -
Florian Achleitner authored
We found that our sc16is7xx on spi reported a TX fifo free space value (TXLVL_REG) of 255 ocassionally, which is obviously wrong, with a 64 byte fifo and caused a buffer overrun and a kernel crash. To trigger this, a large write to the tty is sufficient. The fifo fills, TXLVL_REG reads zero, but the handle_tx function does a zero-data-length write to the TX fifo anyways through sc16is7xx_fifo_write. The next TXLVL_REG read then yields 255, for unknown reasons. A subsequent read is ok. Prevent zero-data-length writes if the TX fifo is full, because they are pointless, and because they trigger wrong TXLVL read-outs. Furthermore, prevent a TX buffer overrun if the peripheral reports values larger than the buffer size and thus, don't allow the peripheral to crash the kernel. Signed-off-by:
Florian Achleitner <achleitner.florian@fronius.com> Signed-off-by:
-
Peter Hurley authored
Perform common exit for both successful and error exit handling in tty_set_ldisc(). Fixes unlikely possibility of failing to restart input kworker when switching to the same line discipline (noop case). Signed-off-by:
-
Peter Hurley authored
SERIAL_DO_RESTART is not used by these 3 drivers; remove. Signed-off-by:
-
Peter Hurley authored
tty_write_flush() has no definition and the TTY_WRITE_FLUSH() macro is never invoked; remove. Signed-off-by:
-
Peter Hurley authored
A master pty should never be a controlling tty in Linux; if the master pty is specified to ioctl(TIOCSCTTY), silently substitute the slave pty as the controlling tty. Signed-off-by:
-
Peter Hurley authored
Where possible, use dev_dbg() instead of pr_debug() Signed-off-by:
-
Peter Hurley authored
WARN() does all of these things in one statement. Signed-off-by:
-
Peter Hurley authored
Now that tty_debug() macro uses pr_debug(), the function name can be printed when using dynamic debug; printing the function name within the format string is redundant. Remove the __func__ parameter and print specifier from the format string. Add context to messages for when the function name is not printed by dynamic debug, or when dynamic debug is not enabled. Signed-off-by:
-
Peter Hurley authored
Convert remaining printk() use to pr_*() when tty is unknown or unsafe to use. Signed-off-by:
-
Peter Hurley authored
With the refactor of 'locked' from parameter to local, it's now obvious locked cannot be NULL. Remove entire conditional. Signed-off-by:
-
Peter Hurley authored
Add tty as parameter to unset_locked_termios() and extract former parameters, termios and locked, as locals. Signed-off-by:
-
Peter Hurley authored
Include the driver name in the tty_register_device_attr() error message for invalid index. Note that tty_err() cannot be used here because there is no tty; use pr_err(). Signed-off-by:
-
