kernel/linux.git/drivers/tty/tty_io.c, branch v5.4.50

tty: fix compat TIOCGSERIAL checking wrong function ptr

2020-03-25T07:25:52+00:00

commit 6e622cd8bd888c7fa3ee2b7dfb3514ab53b21570 upstream. Commit 77654350306a ("take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl()") changed the compat version of TIOCGSERIAL to start checking for the presence of the ->set_serial function pointer rather than ->get_serial. This appears to be a copy-and-paste error, since ->get_serial is the function pointer that is called as well as the pointer that is checked by the non-compat version of TIOCGSERIAL. Fix this by checking the correct function pointer. Fixes: 77654350306a ("take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl()") Cc: # v4.20+ Signed-off-by: Eric Biggers Acked-by: Jiri Slaby Link: https://lore.kernel.org/r/20200224182044.234553-3-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman

tty: fix compat TIOCGSERIAL leaking uninitialized memory

2020-03-25T07:25:52+00:00

commit 17329563a97df3ba474eca5037c1336e46e14ff8 upstream. Commit 77654350306a ("take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl()") changed the compat version of TIOCGSERIAL to start copying a whole 'serial_struct32' to userspace rather than individual fields, but failed to initialize all padding and fields -- namely the hole after the 'iomem_reg_shift' field, and the 'reserved' field. Fix this by initializing the struct to zero. [v2: use sizeof, and convert the adjacent line for consistency.] Reported-by: syzbot+8da9175e28eadcb203ce@syzkaller.appspotmail.com Fixes: 77654350306a ("take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl()") Cc: # v4.20+ Signed-off-by: Eric Biggers Acked-by: Jiri Slaby Link: https://lore.kernel.org/r/20200224182044.234553-2-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman

drivers: Introduce device lookup variants by device type

2019-07-30T11:07:42+00:00

Add a helper to match a device by its type and provide wrappers for {bus/class/driver}_find_device() APIs. Cc: Alexander Shishkin Cc: Arnd Bergmann Cc: Harald Freudenberger Cc: Heiko Carstens Cc: linux-usb@vger.kernel.org Cc: Oliver Neukum Cc: Sebastian Andrzej Siewior Cc: Tomas Winkler Cc: "Rafael J. Wysocki" Cc: Greg Kroah-Hartman Cc: Ulf Hansson Cc: Joe Perches Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20190723221838.12024-5-suzuki.poulose@arm.com Signed-off-by: Greg Kroah-Hartman

tty: tty_io: fix driver refcount imbalance on error path

2019-05-24T08:09:12+00:00

tty_lookup_driver take a reference to the struct tty_driver, but forget to release it on the error path, lead to a memory leak. add a tty_driver_kref_put before error return. Signed-off-by: Lin Yi Signed-off-by: Greg Kroah-Hartman

tty: update obsolete termios comment

2019-04-25T09:58:56+00:00

Update an obsolete comment referring to the termios_locked structure which was removed over a decade ago by commit fe6e29fdb1a7 ("tty: simplify ktermios allocation"). While at it, fix the "Thus" typo. Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman

Revert "tty: pty: Fix race condition between release_one_tty and pty_write"

2019-03-29T14:47:40+00:00

This reverts commit b9ca5f8560af244489b4a1bc1ae88b341f24bc95 as 0-day shows it has a circular locking dependency. Fixes: b9ca5f8560af ("tty: pty: Fix race condition between release_one_tty and pty_write") Reported-by: kernel test robot Cc: Sahara Cc: stable Signed-off-by: Greg Kroah-Hartman

tty: pty: Fix race condition between release_one_tty and pty_write

2019-03-27T16:28:23+00:00

Especially when a linked tty is used such as pty, the linked tty port's buf works have not been cancelled while master tty port's buf work has been cancelled. Since release_one_tty and flush_to_ldisc run in workqueue threads separately, when pty_cleanup happens and link tty port is freed, flush_to_ldisc tries to access freed port and port->itty, eventually it causes a panic. This patch utilizes the magic value with holding the tty_mutex to check if the tty->link is valid. Fixes: 2b022ab7542d ("pty: cancel pty slave port buf's work in tty_release") Signed-off-by: Sahara Cc: stable Signed-off-by: Greg Kroah-Hartman

tty: ldisc: add sysctl to prevent autoloading of ldiscs

2019-01-30T08:31:30+00:00

By default, the kernel will automatically load the module of any line dicipline that is asked for. As this sometimes isn't the safest thing to do, provide a sysctl to disable this feature. By default, we set this to 'y' as that is the historical way that Linux has worked, and we do not want to break working systems. But in the future, perhaps this can default to 'n' to prevent this functionality. Signed-off-by: Greg Kroah-Hartman Reviewed-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman

tty: Handle problem if line discipline does not have receive_buf

2019-01-21T16:41:02+00:00

Some tty line disciplines do not have a receive buf callback, so properly check for that before calling it. If they do not have this callback, just eat the character quietly, as we can't fail this call. Reported-by: Jann Horn Cc: stable Signed-off-by: Greg Kroah-Hartman

tty: Don't hold ldisc lock in tty_reopen() if ldisc present

2019-01-11T16:03:42+00:00

Try to get reference for ldisc during tty_reopen(). If ldisc present, we don't need to do tty_ldisc_reinit() and lock the write side for line discipline semaphore. Effectively, it optimizes fast-path for tty_reopen(), but more importantly it won't interrupt ongoing IO on the tty as no ldisc change is needed. Fixes user-visible issue when tty_reopen() interrupted login process for user with a long password, observed and reported by Lukas. Fixes: c96cf923a98d ("tty: Don't block on IO when ldisc change is pending") Fixes: 83d817f41070 ("tty: Hold tty_ldisc_lock() during tty_reopen()") Cc: Jiri Slaby Reported-by: Lukas F. Hartmann Tested-by: Lukas F. Hartmann Cc: stable Signed-off-by: Dmitry Safonov Signed-off-by: Greg Kroah-Hartman