<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-stable.git/drivers/tty, branch v3.12.7</title>
<subtitle>Linux kernel stable tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/'/>
<entry>
<title>serial: 8250_dw: add new ACPI IDs</title>
<updated>2014-01-09T20:25:08+00:00</updated>
<author>
<name>Mika Westerberg</name>
<email>mika.westerberg@linux.intel.com</email>
</author>
<published>2013-12-10T10:56:59+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=54146f38fb9d3d29452b56b5b7c34c34821ad40a'/>
<id>54146f38fb9d3d29452b56b5b7c34c34821ad40a</id>
<content type='text'>
commit d24c195f90cb1adb178d26d84c722d4b9e551e05 upstream.

Newer Intel PCHs with LPSS have the same Designware controllers than
Haswell but ACPI IDs are different. Add these IDs to the driver list.

Signed-off-by: Mika Westerberg &lt;mika.westerberg@linux.intel.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit d24c195f90cb1adb178d26d84c722d4b9e551e05 upstream.

Newer Intel PCHs with LPSS have the same Designware controllers than
Haswell but ACPI IDs are different. Add these IDs to the driver list.

Signed-off-by: Mika Westerberg &lt;mika.westerberg@linux.intel.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>TTY: pmac_zilog, check existence of ports in pmz_console_init()</title>
<updated>2014-01-09T20:25:07+00:00</updated>
<author>
<name>Geert Uytterhoeven</name>
<email>geert@linux-m68k.org</email>
</author>
<published>2013-11-22T15:47:26+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=a58c081ac497b13e937ea1c5af9653186373df7d'/>
<id>a58c081ac497b13e937ea1c5af9653186373df7d</id>
<content type='text'>
commit dc1dc2f8a5dd863bf2e79f338fc3ae29e99c683a upstream.

When booting a multi-platform m68k kernel on a non-Mac with "console=ttyS0"
on the kernel command line, it crashes with:

Unable to handle kernel NULL pointer dereference at virtual address   (null)
Oops: 00000000
PC: [&lt;0013ad28&gt;] __pmz_startup+0x32/0x2a0
...
Call Trace: [&lt;002c5d3e&gt;] pmz_console_setup+0x64/0xe4

The normal tty driver doesn't crash, because init_pmz() checks
pmz_ports_count again after calling pmz_probe().

In the serial console initialization path, pmz_console_init() doesn't do
this, causing the driver to crash later.

Add a check for pmz_ports_count to fix this.

Signed-off-by: Geert Uytterhoeven &lt;geert@linux-m68k.org&gt;
Cc: Finn Thain &lt;fthain@telegraphics.com.au&gt;
Cc: Benjamin Herrenschmidt &lt;benh@kernel.crashing.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit dc1dc2f8a5dd863bf2e79f338fc3ae29e99c683a upstream.

When booting a multi-platform m68k kernel on a non-Mac with "console=ttyS0"
on the kernel command line, it crashes with:

Unable to handle kernel NULL pointer dereference at virtual address   (null)
Oops: 00000000
PC: [&lt;0013ad28&gt;] __pmz_startup+0x32/0x2a0
...
Call Trace: [&lt;002c5d3e&gt;] pmz_console_setup+0x64/0xe4

The normal tty driver doesn't crash, because init_pmz() checks
pmz_ports_count again after calling pmz_probe().

In the serial console initialization path, pmz_console_init() doesn't do
this, causing the driver to crash later.

Add a check for pmz_ports_count to fix this.

Signed-off-by: Geert Uytterhoeven &lt;geert@linux-m68k.org&gt;
Cc: Finn Thain &lt;fthain@telegraphics.com.au&gt;
Cc: Benjamin Herrenschmidt &lt;benh@kernel.crashing.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>n_tty: Fix apparent order of echoed output</title>
<updated>2014-01-09T20:25:07+00:00</updated>
<author>
<name>Peter Hurley</name>
<email>peter@hurleysoftware.com</email>
</author>
<published>2013-12-09T23:06:07+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=8416877c8da5a637321121d8cad70419dd27fe59'/>
<id>8416877c8da5a637321121d8cad70419dd27fe59</id>
<content type='text'>
commit 1075a6e2dc7e2a96efc417b98dd98f57fdae985d upstream.

With block processing of echoed output, observed output order is still
required. Push completed echoes and echo commands prior to output.

Introduce echo_mark echo buffer index, which tracks completed echo
commands; ie., those submitted via commit_echoes but which may not
have been committed. Ensure that completed echoes are output prior
to subsequent terminal writes in process_echoes().

Fixes newline/prompt output order in cooked mode shell.

Reported-by: Karl Dahlke &lt;eklhad@comcast.net&gt;
Reported-by: Mikulas Patocka &lt;mpatocka@redhat.com&gt;
Signed-off-by: Peter Hurley &lt;peter@hurleysoftware.com&gt;
Tested-by: Karl Dahlke &lt;eklhad@comcast.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 1075a6e2dc7e2a96efc417b98dd98f57fdae985d upstream.

With block processing of echoed output, observed output order is still
required. Push completed echoes and echo commands prior to output.

Introduce echo_mark echo buffer index, which tracks completed echo
commands; ie., those submitted via commit_echoes but which may not
have been committed. Ensure that completed echoes are output prior
to subsequent terminal writes in process_echoes().

Fixes newline/prompt output order in cooked mode shell.

Reported-by: Karl Dahlke &lt;eklhad@comcast.net&gt;
Reported-by: Mikulas Patocka &lt;mpatocka@redhat.com&gt;
Signed-off-by: Peter Hurley &lt;peter@hurleysoftware.com&gt;
Tested-by: Karl Dahlke &lt;eklhad@comcast.net&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>tty: Fix hang at ldsem_down_read()</title>
<updated>2014-01-09T20:25:07+00:00</updated>
<author>
<name>Peter Hurley</name>
<email>peter@hurleysoftware.com</email>
</author>
<published>2013-12-12T02:11:58+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=ab69be3e59d79c56bfe16930f0c761daf4837e48'/>
<id>ab69be3e59d79c56bfe16930f0c761daf4837e48</id>
<content type='text'>
commit cf872776fc84128bb779ce2b83a37c884c3203ae upstream.

When a controlling tty is being hung up and the hang up is
waiting for a just-signalled tty reader or writer to exit, and a new tty
reader/writer tries to acquire an ldisc reference concurrently with the
ldisc reference release from the signalled reader/writer, the hangup
can hang. The new reader/writer is sleeping in ldsem_down_read() and the
hangup is sleeping in ldsem_down_write() [1].

The new reader/writer fails to wakeup the waiting hangup because the
wrong lock count value is checked (the old lock count rather than the new
lock count) to see if the lock is unowned.

Change helper function to return the new lock count if the cmpxchg was
successful; document this behavior.

[1] edited dmesg log from reporter

SysRq : Show Blocked State
  task                        PC stack   pid father
systemd         D ffff88040c4f0000     0     1      0 0x00000000
 ffff88040c49fbe0 0000000000000046 ffff88040c4a0000 ffff88040c49ffd8
 00000000001d3980 00000000001d3980 ffff88040c4a0000 ffff88040593d840
 ffff88040c49fb40 ffffffff810a4cc0 0000000000000006 0000000000000023
Call Trace:
 [&lt;ffffffff810a4cc0&gt;] ? sched_clock_cpu+0x9f/0xe4
 [&lt;ffffffff810a4cc0&gt;] ? sched_clock_cpu+0x9f/0xe4
 [&lt;ffffffff810a4cc0&gt;] ? sched_clock_cpu+0x9f/0xe4
 [&lt;ffffffff810a4cc0&gt;] ? sched_clock_cpu+0x9f/0xe4
 [&lt;ffffffff817a6649&gt;] schedule+0x24/0x5e
 [&lt;ffffffff817a588b&gt;] schedule_timeout+0x15b/0x1ec
 [&lt;ffffffff810a4cc0&gt;] ? sched_clock_cpu+0x9f/0xe4
 [&lt;ffffffff817aa691&gt;] ? _raw_spin_unlock_irq+0x24/0x26
 [&lt;ffffffff817aa10c&gt;] down_read_failed+0xe3/0x1b9
 [&lt;ffffffff817aa26d&gt;] ldsem_down_read+0x8b/0xa5
 [&lt;ffffffff8142b5ca&gt;] ? tty_ldisc_ref_wait+0x1b/0x44
 [&lt;ffffffff8142b5ca&gt;] tty_ldisc_ref_wait+0x1b/0x44
 [&lt;ffffffff81423f5b&gt;] tty_write+0x7d/0x28a
 [&lt;ffffffff814241f5&gt;] redirected_tty_write+0x8d/0x98
 [&lt;ffffffff81424168&gt;] ? tty_write+0x28a/0x28a
 [&lt;ffffffff8115d03f&gt;] do_loop_readv_writev+0x56/0x79
 [&lt;ffffffff8115e604&gt;] do_readv_writev+0x1b0/0x1ff
 [&lt;ffffffff8116ea0b&gt;] ? do_vfs_ioctl+0x32a/0x489
 [&lt;ffffffff81167d9d&gt;] ? final_putname+0x1d/0x3a
 [&lt;ffffffff8115e6c7&gt;] vfs_writev+0x2e/0x49
 [&lt;ffffffff8115e7d3&gt;] SyS_writev+0x47/0xaa
 [&lt;ffffffff817ab822&gt;] system_call_fastpath+0x16/0x1b
bash            D ffffffff81c104c0     0  5469   5302 0x00000082
 ffff8800cf817ac0 0000000000000046 ffff8804086b22a0 ffff8800cf817fd8
 00000000001d3980 00000000001d3980 ffff8804086b22a0 ffff8800cf817a48
 000000000000b9a0 ffff8800cf817a78 ffffffff81004675 ffff8800cf817a44
Call Trace:
 [&lt;ffffffff81004675&gt;] ? dump_trace+0x165/0x29c
 [&lt;ffffffff810a4cc0&gt;] ? sched_clock_cpu+0x9f/0xe4
 [&lt;ffffffff8100edda&gt;] ? save_stack_trace+0x26/0x41
 [&lt;ffffffff817a6649&gt;] schedule+0x24/0x5e
 [&lt;ffffffff817a588b&gt;] schedule_timeout+0x15b/0x1ec
 [&lt;ffffffff810a4cc0&gt;] ? sched_clock_cpu+0x9f/0xe4
 [&lt;ffffffff817a9f03&gt;] ? down_write_failed+0xa3/0x1c9
 [&lt;ffffffff817aa691&gt;] ? _raw_spin_unlock_irq+0x24/0x26
 [&lt;ffffffff817a9f0b&gt;] down_write_failed+0xab/0x1c9
 [&lt;ffffffff817aa300&gt;] ldsem_down_write+0x79/0xb1
 [&lt;ffffffff817aada3&gt;] ? tty_ldisc_lock_pair_timeout+0xa5/0xd9
 [&lt;ffffffff817aada3&gt;] tty_ldisc_lock_pair_timeout+0xa5/0xd9
 [&lt;ffffffff8142bf33&gt;] tty_ldisc_hangup+0xc4/0x218
 [&lt;ffffffff81423ab3&gt;] __tty_hangup+0x2e2/0x3ed
 [&lt;ffffffff81424a76&gt;] disassociate_ctty+0x63/0x226
 [&lt;ffffffff81078aa7&gt;] do_exit+0x79f/0xa11
 [&lt;ffffffff81086bdb&gt;] ? get_signal_to_deliver+0x206/0x62f
 [&lt;ffffffff810b4bfb&gt;] ? lock_release_holdtime.part.8+0xf/0x16e
 [&lt;ffffffff81079b05&gt;] do_group_exit+0x47/0xb5
 [&lt;ffffffff81086c16&gt;] get_signal_to_deliver+0x241/0x62f
 [&lt;ffffffff810020a7&gt;] do_signal+0x43/0x59d
 [&lt;ffffffff810f2af7&gt;] ? __audit_syscall_exit+0x21a/0x2a8
 [&lt;ffffffff810b4bfb&gt;] ? lock_release_holdtime.part.8+0xf/0x16e
 [&lt;ffffffff81002655&gt;] do_notify_resume+0x54/0x6c
 [&lt;ffffffff817abaf8&gt;] int_signal+0x12/0x17

Reported-by: Sami Farin &lt;sami.farin@gmail.com&gt;
Signed-off-by: Peter Hurley &lt;peter@hurleysoftware.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit cf872776fc84128bb779ce2b83a37c884c3203ae upstream.

When a controlling tty is being hung up and the hang up is
waiting for a just-signalled tty reader or writer to exit, and a new tty
reader/writer tries to acquire an ldisc reference concurrently with the
ldisc reference release from the signalled reader/writer, the hangup
can hang. The new reader/writer is sleeping in ldsem_down_read() and the
hangup is sleeping in ldsem_down_write() [1].

The new reader/writer fails to wakeup the waiting hangup because the
wrong lock count value is checked (the old lock count rather than the new
lock count) to see if the lock is unowned.

Change helper function to return the new lock count if the cmpxchg was
successful; document this behavior.

[1] edited dmesg log from reporter

SysRq : Show Blocked State
  task                        PC stack   pid father
systemd         D ffff88040c4f0000     0     1      0 0x00000000
 ffff88040c49fbe0 0000000000000046 ffff88040c4a0000 ffff88040c49ffd8
 00000000001d3980 00000000001d3980 ffff88040c4a0000 ffff88040593d840
 ffff88040c49fb40 ffffffff810a4cc0 0000000000000006 0000000000000023
Call Trace:
 [&lt;ffffffff810a4cc0&gt;] ? sched_clock_cpu+0x9f/0xe4
 [&lt;ffffffff810a4cc0&gt;] ? sched_clock_cpu+0x9f/0xe4
 [&lt;ffffffff810a4cc0&gt;] ? sched_clock_cpu+0x9f/0xe4
 [&lt;ffffffff810a4cc0&gt;] ? sched_clock_cpu+0x9f/0xe4
 [&lt;ffffffff817a6649&gt;] schedule+0x24/0x5e
 [&lt;ffffffff817a588b&gt;] schedule_timeout+0x15b/0x1ec
 [&lt;ffffffff810a4cc0&gt;] ? sched_clock_cpu+0x9f/0xe4
 [&lt;ffffffff817aa691&gt;] ? _raw_spin_unlock_irq+0x24/0x26
 [&lt;ffffffff817aa10c&gt;] down_read_failed+0xe3/0x1b9
 [&lt;ffffffff817aa26d&gt;] ldsem_down_read+0x8b/0xa5
 [&lt;ffffffff8142b5ca&gt;] ? tty_ldisc_ref_wait+0x1b/0x44
 [&lt;ffffffff8142b5ca&gt;] tty_ldisc_ref_wait+0x1b/0x44
 [&lt;ffffffff81423f5b&gt;] tty_write+0x7d/0x28a
 [&lt;ffffffff814241f5&gt;] redirected_tty_write+0x8d/0x98
 [&lt;ffffffff81424168&gt;] ? tty_write+0x28a/0x28a
 [&lt;ffffffff8115d03f&gt;] do_loop_readv_writev+0x56/0x79
 [&lt;ffffffff8115e604&gt;] do_readv_writev+0x1b0/0x1ff
 [&lt;ffffffff8116ea0b&gt;] ? do_vfs_ioctl+0x32a/0x489
 [&lt;ffffffff81167d9d&gt;] ? final_putname+0x1d/0x3a
 [&lt;ffffffff8115e6c7&gt;] vfs_writev+0x2e/0x49
 [&lt;ffffffff8115e7d3&gt;] SyS_writev+0x47/0xaa
 [&lt;ffffffff817ab822&gt;] system_call_fastpath+0x16/0x1b
bash            D ffffffff81c104c0     0  5469   5302 0x00000082
 ffff8800cf817ac0 0000000000000046 ffff8804086b22a0 ffff8800cf817fd8
 00000000001d3980 00000000001d3980 ffff8804086b22a0 ffff8800cf817a48
 000000000000b9a0 ffff8800cf817a78 ffffffff81004675 ffff8800cf817a44
Call Trace:
 [&lt;ffffffff81004675&gt;] ? dump_trace+0x165/0x29c
 [&lt;ffffffff810a4cc0&gt;] ? sched_clock_cpu+0x9f/0xe4
 [&lt;ffffffff8100edda&gt;] ? save_stack_trace+0x26/0x41
 [&lt;ffffffff817a6649&gt;] schedule+0x24/0x5e
 [&lt;ffffffff817a588b&gt;] schedule_timeout+0x15b/0x1ec
 [&lt;ffffffff810a4cc0&gt;] ? sched_clock_cpu+0x9f/0xe4
 [&lt;ffffffff817a9f03&gt;] ? down_write_failed+0xa3/0x1c9
 [&lt;ffffffff817aa691&gt;] ? _raw_spin_unlock_irq+0x24/0x26
 [&lt;ffffffff817a9f0b&gt;] down_write_failed+0xab/0x1c9
 [&lt;ffffffff817aa300&gt;] ldsem_down_write+0x79/0xb1
 [&lt;ffffffff817aada3&gt;] ? tty_ldisc_lock_pair_timeout+0xa5/0xd9
 [&lt;ffffffff817aada3&gt;] tty_ldisc_lock_pair_timeout+0xa5/0xd9
 [&lt;ffffffff8142bf33&gt;] tty_ldisc_hangup+0xc4/0x218
 [&lt;ffffffff81423ab3&gt;] __tty_hangup+0x2e2/0x3ed
 [&lt;ffffffff81424a76&gt;] disassociate_ctty+0x63/0x226
 [&lt;ffffffff81078aa7&gt;] do_exit+0x79f/0xa11
 [&lt;ffffffff81086bdb&gt;] ? get_signal_to_deliver+0x206/0x62f
 [&lt;ffffffff810b4bfb&gt;] ? lock_release_holdtime.part.8+0xf/0x16e
 [&lt;ffffffff81079b05&gt;] do_group_exit+0x47/0xb5
 [&lt;ffffffff81086c16&gt;] get_signal_to_deliver+0x241/0x62f
 [&lt;ffffffff810020a7&gt;] do_signal+0x43/0x59d
 [&lt;ffffffff810f2af7&gt;] ? __audit_syscall_exit+0x21a/0x2a8
 [&lt;ffffffff810b4bfb&gt;] ? lock_release_holdtime.part.8+0xf/0x16e
 [&lt;ffffffff81002655&gt;] do_notify_resume+0x54/0x6c
 [&lt;ffffffff817abaf8&gt;] int_signal+0x12/0x17

Reported-by: Sami Farin &lt;sami.farin@gmail.com&gt;
Signed-off-by: Peter Hurley &lt;peter@hurleysoftware.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>n_tty: Fix missing newline echo</title>
<updated>2013-12-12T06:37:55+00:00</updated>
<author>
<name>Peter Hurley</name>
<email>peter@hurleysoftware.com</email>
</author>
<published>2013-11-29T17:56:10+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=8aa61f36bb68b7544a7c955658e29556f866bb6a'/>
<id>8aa61f36bb68b7544a7c955658e29556f866bb6a</id>
<content type='text'>
commit 39434abd942c8e4b9c14c06a03b3245beaf8467f upstream.

When L_ECHONL is on, newlines are echoed regardless of the L_ECHO
state; if set, ensure accumulated echoes are flushed before finishing
the current input processing and before more output.

Reported-by: Jason Gunthorpe &lt;jgunthorpe@obsidianresearch.com
Tested-by: Jason Gunthorpe &lt;jgunthorpe@obsidianresearch.com&gt;
Signed-off-by: Peter Hurley &lt;peter@hurleysoftware.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 39434abd942c8e4b9c14c06a03b3245beaf8467f upstream.

When L_ECHONL is on, newlines are echoed regardless of the L_ECHO
state; if set, ensure accumulated echoes are flushed before finishing
the current input processing and before more output.

Reported-by: Jason Gunthorpe &lt;jgunthorpe@obsidianresearch.com
Tested-by: Jason Gunthorpe &lt;jgunthorpe@obsidianresearch.com&gt;
Signed-off-by: Peter Hurley &lt;peter@hurleysoftware.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>n_tty: Ensure reader restarts worker for next reader</title>
<updated>2013-12-04T19:05:41+00:00</updated>
<author>
<name>Peter Hurley</name>
<email>peter@hurleysoftware.com</email>
</author>
<published>2013-11-07T18:59:46+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=b4a1a4cc91f62441214ae75aff9a2834bc7f5c10'/>
<id>b4a1a4cc91f62441214ae75aff9a2834bc7f5c10</id>
<content type='text'>
commit 42458f41d08f0873299e830464c1232a6839297d upstream.

A departing reader must restart a flush_to_ldisc() worker _before_
the next reader enters the read loop; this is to avoid the new reader
concluding no more i/o is available and prematurely exiting, when the
old reader simply hasn't re-started the worker yet.

Signed-off-by: Peter Hurley &lt;peter@hurleysoftware.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 42458f41d08f0873299e830464c1232a6839297d upstream.

A departing reader must restart a flush_to_ldisc() worker _before_
the next reader enters the read loop; this is to avoid the new reader
concluding no more i/o is available and prematurely exiting, when the
old reader simply hasn't re-started the worker yet.

Signed-off-by: Peter Hurley &lt;peter@hurleysoftware.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>tty: Reset hupped state on open</title>
<updated>2013-12-04T19:05:41+00:00</updated>
<author>
<name>Peter Hurley</name>
<email>peter@hurleysoftware.com</email>
</author>
<published>2013-11-19T13:46:27+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=a4839c4c246a66ec0bb40aaa78aeeca4fd38f252'/>
<id>a4839c4c246a66ec0bb40aaa78aeeca4fd38f252</id>
<content type='text'>
commit d4855e1fc03c2bb32dd64badf51cec5a2a26ab2a upstream.

A common security idiom is to hangup the current tty (via vhangup())
after forking but before execing a root shell. This hangs up any
existing opens which other processes may have and ensures subsequent
opens have the necessary permissions to open the root shell tty/pty.

Reset the TTY_HUPPED state after the driver has successfully
returned the opened tty (perform the reset while the tty is locked
to avoid racing with concurrent hangups).

Reported-by: Heorhi Valakhanovich &lt;valahanovich@tut.by&gt;
Signed-off-by: Peter Hurley &lt;peter@hurleysoftware.com&gt;
Tested-by: Heorhi Valakhanovich &lt;valahanovich@tut.by&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit d4855e1fc03c2bb32dd64badf51cec5a2a26ab2a upstream.

A common security idiom is to hangup the current tty (via vhangup())
after forking but before execing a root shell. This hangs up any
existing opens which other processes may have and ensures subsequent
opens have the necessary permissions to open the root shell tty/pty.

Reset the TTY_HUPPED state after the driver has successfully
returned the opened tty (perform the reset while the tty is locked
to avoid racing with concurrent hangups).

Reported-by: Heorhi Valakhanovich &lt;valahanovich@tut.by&gt;
Signed-off-by: Peter Hurley &lt;peter@hurleysoftware.com&gt;
Tested-by: Heorhi Valakhanovich &lt;valahanovich@tut.by&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>n_tty: Fix echo overrun tail computation</title>
<updated>2013-12-04T19:05:40+00:00</updated>
<author>
<name>Peter Hurley</name>
<email>peter@hurleysoftware.com</email>
</author>
<published>2013-11-08T14:42:18+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=a5ce6dc48a0d0304c7f6588100cf89163a0cea56'/>
<id>a5ce6dc48a0d0304c7f6588100cf89163a0cea56</id>
<content type='text'>
commit 6f2225363c205e186c1465c2c7c84f17c1635504 upstream.

Commit cbfd0340ae1993378fd47179db949e050e16e697,
'n_tty: Process echoes in blocks', introduced an error when
consuming the echo buffer tail to prevent buffer overrun, where
the incorrect operation code byte is checked to determine how
far to advance the tail to the next echo byte.

Check the correct byte for the echo operation code byte.

Signed-off-by: Peter Hurley &lt;peter@hurleysoftware.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 6f2225363c205e186c1465c2c7c84f17c1635504 upstream.

Commit cbfd0340ae1993378fd47179db949e050e16e697,
'n_tty: Process echoes in blocks', introduced an error when
consuming the echo buffer tail to prevent buffer overrun, where
the incorrect operation code byte is checked to determine how
far to advance the tail to the next echo byte.

Check the correct byte for the echo operation code byte.

Signed-off-by: Peter Hurley &lt;peter@hurleysoftware.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>tty: incorrect test of echo_buf() result for ECHO_OP_START</title>
<updated>2013-12-04T19:05:40+00:00</updated>
<author>
<name>Roel Kluin</name>
<email>roel.kluin@gmail.com</email>
</author>
<published>2013-10-11T20:08:49+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=eac07f36b141b81c58080a878215b4ca110d090f'/>
<id>eac07f36b141b81c58080a878215b4ca110d090f</id>
<content type='text'>
commit c476f6584b0011741b4f0316f1ac4aa3a99403e1 upstream.

test echo_buf() result for ECHO_OP_START

Signed-off-by: Roel Kluin &lt;roel.kluin@gmail.com&gt;
Acked-by: Peter Hurley &lt;peter@hurleysoftware.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit c476f6584b0011741b4f0316f1ac4aa3a99403e1 upstream.

test echo_buf() result for ECHO_OP_START

Signed-off-by: Roel Kluin &lt;roel.kluin@gmail.com&gt;
Acked-by: Peter Hurley &lt;peter@hurleysoftware.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>n_tty: Fix 4096-byte canonical reads</title>
<updated>2013-12-04T19:05:40+00:00</updated>
<author>
<name>Peter Hurley</name>
<email>peter@hurleysoftware.com</email>
</author>
<published>2013-11-22T12:16:25+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=cba44dab11c8119a361d4962dc170b05012fe397'/>
<id>cba44dab11c8119a361d4962dc170b05012fe397</id>
<content type='text'>
commit c77569d2f3ef7844ee4ac7005a57da6898b302a8 upstream.

Although the maximum allowable canonical line is specified to
be 255 bytes (MAX_CANON), the practical limit has actually been
the size of the line discipline read buffer (N_TTY_BUF_SIZE == 4096).

Commit 32f13521ca68bc624ff6effc77f308a52b038bf0,
n_tty: Line copy to user buffer in canonical mode, limited the
line copy to 4095 bytes. With a completely full line discipline
read buffer and a userspace buffer &gt; 4095, _no_ data was copied,
and the read() syscall returned 0, indicating EOF.

Fix the interval arithmetic to compute the correct number of bytes
to copy to userspace in the range [1..4096].

Signed-off-by: Peter Hurley &lt;peter@hurleysoftware.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit c77569d2f3ef7844ee4ac7005a57da6898b302a8 upstream.

Although the maximum allowable canonical line is specified to
be 255 bytes (MAX_CANON), the practical limit has actually been
the size of the line discipline read buffer (N_TTY_BUF_SIZE == 4096).

Commit 32f13521ca68bc624ff6effc77f308a52b038bf0,
n_tty: Line copy to user buffer in canonical mode, limited the
line copy to 4095 bytes. With a completely full line discipline
read buffer and a userspace buffer &gt; 4095, _no_ data was copied,
and the read() syscall returned 0, indicating EOF.

Fix the interval arithmetic to compute the correct number of bytes
to copy to userspace in the range [1..4096].

Signed-off-by: Peter Hurley &lt;peter@hurleysoftware.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
</feed>
