linux-stable.git/drivers/net/irda, branch linux-4.5.y

net: irda: Fix use-after-free in irtty_open()

2016-04-12T14:33:28+00:00

commit 401879c57f01cbf2da204ad2e8db910525c6dbea upstream.

The N_IRDA line discipline may access the previous line discipline's closed
and already-fre private data on open [1].

The tty->disc_data field _never_ refers to valid data on entry to the
line discipline's open() method. Rather, the ldisc is expected to
initialize that field for its own use for the lifetime of the instance
(ie. from open() to close() only).

[1]
    ==================================================================
    BUG: KASAN: use-after-free in irtty_open+0x422/0x550 at addr ffff8800331dd068
    Read of size 4 by task a.out/13960
    =============================================================================
    BUG kmalloc-512 (Tainted: G    B          ): kasan: bad access detected
    -----------------------------------------------------------------------------
    ...
    Call Trace:
     [] __asan_report_load4_noabort+0x3e/0x40 mm/kasan/report.c:279
     [] irtty_open+0x422/0x550 drivers/net/irda/irtty-sir.c:436
     [] tty_ldisc_open.isra.2+0x60/0xa0 drivers/tty/tty_ldisc.c:447
     [] tty_set_ldisc+0x1a0/0x940 drivers/tty/tty_ldisc.c:567
     [<     inline     >] tiocsetd drivers/tty/tty_io.c:2650
     [] tty_ioctl+0xace/0x1fd0 drivers/tty/tty_io.c:2883
     [<     inline     >] vfs_ioctl fs/ioctl.c:43
     [] do_vfs_ioctl+0x57c/0xe60 fs/ioctl.c:607
     [<     inline     >] SYSC_ioctl fs/ioctl.c:622
     [] SyS_ioctl+0x74/0x80 fs/ioctl.c:613
     [] entry_SYSCALL_64_fastpath+0x16/0x7a

Reported-and-tested-by: Dmitry Vyukov 
Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

net/irda: bfin_sir: remove duplicate defines

2016-01-21T18:45:45+00:00

The defconfig build of blackfin is failing with the error:

arch/blackfin/include/asm/bfin_serial.h:269:0: warning: "port_membase" redefined
drivers/net/irda/bfin_sir.h:85:0: note: this is the location of the previous definition
arch/blackfin/include/asm/bfin_serial.h:382:0: warning: "get_lsr_cache" redefined
drivers/net/irda/bfin_sir.h:86:0: note: this is the location of the previous definition
arch/blackfin/include/asm/bfin_serial.h:383:0: warning: "put_lsr_cache" redefined
drivers/net/irda/bfin_sir.h:87:0: note: this is the location of the previous definition

port_membase, get_lsr_cache, put_lsr_cache are already defined in the
architecture files, no need to define them again in the driver.

Signed-off-by: Sudip Mukherjee 
Signed-off-by: David S. Miller

irda: toim3232-sir: delete some dead code

2016-01-08T18:25:33+00:00

I noticed this code because it has a typo in the module_param(),
the "trs" at the end of "toim3232fliptrs" should be "rts".  But it's
dead code so instead of fixing it, I just deleted it.

Signed-off-by: Dan Carpenter 
Signed-off-by: David S. Miller

net: irda: pxaficp_ir: dmaengine conversion

2015-09-29T05:32:48+00:00

Convert pxaficp_ir to dmaengine. As pxa architecture is shifting from
raw DMA registers access to pxa_dma dmaengine driver, convert this
driver to dmaengine.

Signed-off-by: Robert Jarzmik 
Tested-by: Petr Cvek 
Signed-off-by: David S. Miller

net: irda: pxaficp_ir: convert to readl and writel

2015-09-29T05:32:48+00:00

Convert the pxa IRDA driver to readl and writel primitives, and remove
another set of direct registers access. This leaves only the DMA
registers access, which will be dealt with dmaengine conversion.

Signed-off-by: Robert Jarzmik 
Tested-by: Petr Cvek 
Signed-off-by: David S. Miller

net: irda: pxaficp_ir: use sched_clock() for time management

2015-09-29T05:32:48+00:00

Instead of using directly the OS timer through direct register access,
use the standard sched_clock(), which will end up in OSCR reading
anyway.

This is a first step for direct access register removal and machine
specific code removal from this driver.

This commit changes the behavior, as previously the minimum turnaround
time was counted in 76ns steps, while with this patch it is counted in
microsecond steps. The strictly equal formula would have been :
	    while ((sched_clock() - si->last_clk) * 76 < mtt)

Signed-off-by: Robert Jarzmik 
Signed-off-by: David S. Miller

irda: ali-ircc: Fix deadlock in ali_ircc_sir_change_speed()

2015-09-11T23:18:33+00:00

ali_ircc_sir_change_speed() is always called with self->lock held,
so acquiring the lock inside it leads to unavoidable deadlock.

Call graph:
ali_ircc_sir_change_speed() is called from ali_ircc_change_speed()
  ali_ircc_fir_hard_xmit() under spin_lock_irqsave(&self->lock, flags);
  ali_ircc_sir_hard_xmit() under spin_lock_irqsave(&self->lock, flags);
  ali_ircc_net_ioctl() under spin_lock_irqsave(&self->lock, flags);
  ali_ircc_dma_xmit_complete()
    ali_ircc_fir_interrupt()
      ali_ircc_interrupt() under spin_lock(&self->lock);
  ali_ircc_sir_write_wakeup()
    ali_ircc_sir_interrupt()
      ali_ircc_interrupt() under spin_lock(&self->lock);

The patch removes spin_lock/unlock from ali_ircc_sir_change_speed().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov 
Signed-off-by: David S. Miller

irda: irda-usb: use msecs_to_jiffies for conversions

2015-05-25T21:39:21+00:00

API compliance scanning with coccinelle flagged:

Converting milliseconds to jiffies by "val * HZ / 1000" is technically
is not a clean solution as it does not handle all corner cases correctly.
By changing the conversion to use msecs_to_jiffies(val) conversion is
correct in all cases.

in the current code:
  mod_timer(&self->rx_defer_timer, jiffies + (10 * HZ / 1000));
for HZ < 100 (e.g. CONFIG_HZ == 64|32 in alpha) this effectively results
in no delay at all.

Patch was compile tested for x86_64_defconfig (implies CONFIG_USB_IRDA=m)

Patch is against 4.1-rc4 (localversion-next is -next-20150522)

Signed-off-by: Nicholas Mc Guire 
Signed-off-by: David S. Miller

irda: vlsi_ir: Replace timeval with ktime_t

2015-01-12T02:39:40+00:00

The vlsi ir driver uses 'timeval', which we try to remove in the kernel
because all 32-bit time types will break in the year 2038.

This patch also changes do_gettimeofday() to ktime_get() accordingly,
since ktime_get returns a ktime_t, but do_gettimeofday returns a
struct timeval, and the other reason is that ktime_get() uses
the monotonic clock.

This patch uses ktime_us_delta to get the elapsed time of microsecond,
and uses div_s64_rem to get what seconds & microseconds time elapsed
for printing.

This patch also changes the function 'vlsi_hard_start_xmit' to do the
same things as the others drivers, that is passing the remaining time
into udelay() instead of looping until enough time has passed.

Signed-off-by: Chunyan Zhang 
Reviewed-by: Arnd Bergmann 
Signed-off-by: David S. Miller

irda: stir4200: Replace timeval with ktime_t

2015-01-12T02:39:40+00:00

The stir4200 driver uses 'timeval', which we try to remove in the kernel
because all 32-bit time types will break in the year 2038.

This patch also changes do_gettimeofday() to ktime_get() accordingly,
since ktime_get returns a ktime_t, but do_gettimeofday returns a
struct timeval, and the other reason is that ktime_get() uses
the monotonic clock.

This patch uses ktime_us_delta to get the elapsed time of microsecond.

Signed-off-by: Chunyan Zhang 
Reviewed-by: Arnd Bergmann 
Signed-off-by: David S. Miller