kernel/linux.git/drivers/tty/rocket.c, branch v4.4.239

tty: rocket, avoid OOB access

2020-05-02T15:20:48+00:00

commit 7127d24372bf23675a36edc64d092dc7fd92ebe8 upstream. init_r_port can access pc104 array out of bounds. pc104 is a 2D array defined to have 4 members. Each member has 8 submembers. * we can have more than 4 (PCI) boards, i.e. [board] can be OOB * line is not modulo-ed by anything, so the first line on the second board can be 4, on the 3rd 12 or alike (depending on previously registered boards). It's zero only on the first line of the first board. So even [line] can be OOB, quite soon (with the 2nd registered board already). This code is broken for ages, so just avoid the OOB accesses and don't try to fix it as we would need to find out the correct line number. Use the default: RS232, if we are out. Generally, if anyone needs to set the interface types, a module parameter is past the last thing that should be used for this purpose. The parameters' description says it's for ISA cards anyway. Signed-off-by: Jiri Slaby Cc: stable Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Link: https://lore.kernel.org/r/20200417105959.15201-2-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman

tty: rocket: fix incorrect forward declaration of 'rp_init()'

2019-07-10T07:56:44+00:00

[ Upstream commit 423ea3255424b954947d167681b71ded1b8fca53 ] Make the forward declaration actually match the real function definition, something that previous versions of gcc had just ignored. This is another patch to fix new warnings from gcc-9 before I start the merge window pulls. I don't want to miss legitimate new warnings just because my system update brought a new compiler with new warnings. Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin

tty: rocket: Fix possible buffer overwrite on register_PCI

2018-09-19T20:48:57+00:00

[ Upstream commit 0419056ec8fd01ddf5460d2dba0491aad22657dd ] If number of isa and pci boards exceed NUM_BOARDS on the path rp_init()->init_PCI()->register_PCI() then buffer overwrite occurs in register_PCI() on assign rcktpt_io_addr[i]. The patch adds check on upper bound for index of registered board in register_PCI. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Anton Vasilyev Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

tty: Remove tty_port::close_wait

2015-10-18T04:11:29+00:00

With the removal of tty_wait_until_sent_from_close(), tty drivers no longer wait during open for parallel closes to complete (instead, the tty core waits before calling the driver open() method). Thus, the close_wait waitqueue is no longer used for waiting. Remove struct tty_port::close_wait. Signed-off-by: Peter Hurley Signed-off-by: Greg Kroah-Hartman

tty: Remove ASYNC_CLOSING checks in open()/hangup() methods

2015-10-18T04:11:29+00:00

Since at least before 2.6.30, tty drivers that do not drop the tty lock while closing cannot observe ASYNC_CLOSING set while holding the tty lock; this includes the tty driver's open() and hangup() methods, since the tty core calls these methods holding the tty lock. For these drivers, waiting for ASYNC_CLOSING to clear while opening is not required, since this condition cannot occur. Similarly, even when the open() method drops and reacquires the tty lock after blocking, ASYNC_CLOSING cannot be set (again, for drivers that do not drop the tty lock while closing). Now that tty port drivers no longer drop the tty lock while closing (since 'tty: Remove tty_wait_until_sent_from_close()'), the same conditions apply: waiting for ASYNC_CLOSING to clear while opening is not required, nor is re-checking ASYNC_CLOSING after dropping and reacquiring the tty lock while blocking (eg., in *_block_til_ready()). Note: The ASYNC_CLOSING flag state is still maintained since several bitrotting drivers use it for (dubious) other purposes. Signed-off-by: Peter Hurley Signed-off-by: Greg Kroah-Hartman

TTY: fix misspelling of current function in string

2015-01-09T22:38:15+00:00

Replace a misspelled function name by %s and then __func__. This was done using Coccinelle, including the use of Levenshtein distance, as proposed by Rasmus Villemoes. Signed-off-by: Julia Lawall Signed-off-by: Greg Kroah-Hartman

tty: remove DEFINE_PCI_DEVICE_TABLE macro

2013-12-09T01:09:07+00:00

Don't use DEFINE_PCI_DEVICE_TABLE macro, because this macro is not preferred. Signed-off-by: Jingoo Han Signed-off-by: Greg Kroah-Hartman

TTY: rocket, fix more no-PCI warnings

2013-05-20T19:15:59+00:00

Commit "TTY: rocket, fix compilation warning" fixed a compilation warning, but there was still a problem with !CONFIG_PCI configs. So fix them for good by coupling the PCI functions together and moving them inside a common #ifdef. Signed-off-by: Jiri Slaby Reported-by: kbuild test robot Signed-off-by: Greg Kroah-Hartman

TTY: rocket, fix compilation warning

2013-04-15T18:00:59+00:00

When CONFIG_PCI is unset, we see these warnings in rocket: drivers/tty/rocket.c:3140:13: warning: 'rmSpeakerReset' defined but not used drivers/tty/rocket.c:2599:12: warning: 'sPCIInitController' defined but not used Fix those by moving the functions to one place and make them depend on CONFIG_PCI. Signed-off-by: Jiri Slaby Reported-by: Toralf Foerster Signed-off-by: Greg Kroah-Hartman

TTY: cleanup tty->hw_stopped uses

2013-03-18T23:24:30+00:00

tty->hw_stopped is set only by drivers to remember HW state. If it is never set to 1 in a particular driver, there is no need to check it in the driver at all. Remove such checks. Signed-off-by: Jiri Slaby Signed-off-by: Greg Kroah-Hartman