linux-stable.git/drivers/ipack/devices, branch linux-4.9.y

ipack: ipoctal: fix module reference leak

2021-10-06T08:23:42+00:00

commit bb8a4fcb2136508224c596a7e665bdba1d7c3c27 upstream.

A reference to the carrier module was taken on every open but was only
released once when the final reference to the tty struct was dropped.

Fix this by taking the module reference and initialising the tty driver
data when installing the tty.

Fixes: 82a82340bab6 ("ipoctal: get carrier driver to avoid rmmod")
Cc: stable@vger.kernel.org      # 3.18
Cc: Federico Vaga 
Acked-by: Samuel Iglesias Gonsalvez 
Signed-off-by: Johan Hovold 
Link: https://lore.kernel.org/r/20210917114622.5412-6-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman

ipack: ipoctal: fix missing allocation-failure check

2021-10-06T08:23:42+00:00

commit 445c8132727728dc297492a7d9fc074af3e94ba3 upstream.

Add the missing error handling when allocating the transmit buffer to
avoid dereferencing a NULL pointer in write() should the allocation
ever fail.

Fixes: ba4dc61fe8c5 ("Staging: ipack: add support for IP-OCTAL mezzanine board")
Cc: stable@vger.kernel.org      # 3.5
Acked-by: Samuel Iglesias Gonsalvez 
Signed-off-by: Johan Hovold 
Link: https://lore.kernel.org/r/20210917114622.5412-5-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman

ipack: ipoctal: fix tty-registration error handling

2021-10-06T08:23:42+00:00

commit cd20d59291d1790dc74248476e928f57fc455189 upstream.

Registration of the ipoctal tty devices is unlikely to fail, but if it
ever does, make sure not to deregister a never registered tty device
(and dereference a NULL pointer) when the driver is later unbound.

Fixes: 2afb41d9d30d ("Staging: ipack/devices/ipoctal: Check tty_register_device return value.")
Cc: stable@vger.kernel.org      # 3.7
Acked-by: Samuel Iglesias Gonsalvez 
Signed-off-by: Johan Hovold 
Link: https://lore.kernel.org/r/20210917114622.5412-4-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman

ipack: ipoctal: fix tty registration race

2021-10-06T08:23:41+00:00

commit 65c001df517a7bf9be8621b53d43c89f426ce8d6 upstream.

Make sure to set the tty class-device driver data before registering the
tty to avoid having a racing open() dereference a NULL pointer.

Fixes: 9c1d784afc6f ("Staging: ipack/devices/ipoctal: Get rid of ipoctal_list.")
Cc: stable@vger.kernel.org      # 3.7
Acked-by: Samuel Iglesias Gonsalvez 
Signed-off-by: Johan Hovold 
Link: https://lore.kernel.org/r/20210917114622.5412-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman

ipack: ipoctal: fix stack information leak

2021-10-06T08:23:41+00:00

commit a89936cce87d60766a75732a9e7e25c51164f47c upstream.

The tty driver name is used also after registering the driver and must
specifically not be allocated on the stack to avoid leaking information
to user space (or triggering an oops).

Drivers should not try to encode topology information in the tty device
name but this one snuck in through staging without anyone noticing and
another driver has since copied this malpractice.

Fixing the ABI is a separate issue, but this at least plugs the security
hole.

Fixes: ba4dc61fe8c5 ("Staging: ipack: add support for IP-OCTAL mezzanine board")
Cc: stable@vger.kernel.org      # 3.5
Acked-by: Samuel Iglesias Gonsalvez 
Signed-off-by: Johan Hovold 
Link: https://lore.kernel.org/r/20210917114622.5412-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman

tty: Replace ASYNC_INITIALIZED bit and update atomically

2016-04-30T16:26:55+00:00

Replace ASYNC_INITIALIZED bit in the tty_port::flags field with
TTY_PORT_INITIALIZED bit in the tty_port::iflags field. Introduce helpers
tty_port_set_initialized() and tty_port_initialized() to abstract
atomic bit ops.

Note: the transforms for test_and_set_bit() and test_and_clear_bit()
are unnecessary as the state transitions are already mutually exclusive;
the tty lock prevents concurrent open/close/hangup.

Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

ipoctal: clear break interrupt as soon as it occurs

2014-09-24T06:26:42+00:00

In some condition we receive the break interrupt but nothing is putted
in the Rx FIFO and the correspondend bit in the status register is not
set. Thus, no-one clear the interrupt and the handler will be called
forever.

This patch clear the break interrupt as soon as it occurs. Then, if the
break character '\0' is putted in the fifo we will manage it.

We can also unmask the Break interrupt but its bit in ISR is still set
on break. So I think is better to keep the registers clean.

Signed-off-by: Federico Vaga 
Acked-by: Samuel Iglesias Gonsalvez 
Signed-off-by: Greg Kroah-Hartman

ipoctal: get carrier driver to avoid rmmod

2014-09-24T06:13:13+00:00

Signed-off-by: Federico Vaga 
Acked-by: Samuel Iglesias Gonsalvez 
Signed-off-by: Greg Kroah-Hartman

ipoctal: reset function istead of duplicate code

2014-09-24T06:13:13+00:00

Signed-off-by: Federico Vaga 
Acked-by: Samuel Iglesias Gonsalvez 
Signed-off-by: Greg Kroah-Hartman

drivers/ipack/devices/ipoctal.h: Fix typo in include guard

2014-09-24T06:13:13+00:00

Signed-off-by: Rasmus Villemoes 
Acked-by: Samuel Iglesias Gonsalvez 
Signed-off-by: Greg Kroah-Hartman