linux-stable.git/drivers/tty, branch v4.7.7

serial: 8250: added acces i/o products quad and octal serial cards

2016-09-24T08:09:31+00:00

commit c8d192428f52f244130b84650ad616df09f2b1e1 upstream.

Added devices ids for acces i/o products quad and octal serial cards
that make use of existing Pericom PI7C9X7954 and PI7C9X7958
configurations .

Signed-off-by: Jimi Damon 
Signed-off-by: Greg Kroah-Hartman

serial: 8250_mid: fix divide error bug if baud rate is 0

2016-09-24T08:09:31+00:00

commit 47b34d2ef266e2c283b514d65c8963c2ccd42474 upstream.

Since the commit c1a67b48f6a5 ("serial: 8250_pci: replace switch-case by
formula for Intel MID"), the 8250 driver crashes in the byt_set_termios()
function with a divide error. This is caused by the fact that a baud rate of 0
(B0) is not handled properly. Fix it by falling back to B9600 in this case.

Reported-by: "Mendez Salinas, Fernando" 
Fixes: c1a67b48f6a5 ("serial: 8250_pci: replace switch-case by formula for Intel MID")
Signed-off-by: Andy Shevchenko 
Signed-off-by: Greg Kroah-Hartman

tty/serial: atmel: fix RS485 half duplex with DMA

2016-08-20T16:10:49+00:00

commit 0058f0871efe7b01c6f2b3046c68196ab73e96da upstream.

When using DMA, half duplex doesn't work properly because rx is not stopped
before starting tx. Ensure we call atmel_stop_rx() in the DMA case.

Signed-off-by: Alexandre Belloni 
Acked-by: Nicolas Ferre 
Signed-off-by: Greg Kroah-Hartman

serial: samsung: Fix ERR pointer dereference on deferred probe

2016-08-20T16:10:49+00:00

commit e51e4d8a185de90424b03f30181b35f29c46a25a upstream.

When the clk_get() of "uart" clock returns EPROBE_DEFER, the next re-probe
finishes with success but uses invalid (ERR_PTR) values.  This leads to
dereferencing of ERR_PTR stored under ourport->clk:

	12c30000.serial: Controller clock not found
	(...)
	12c30000.serial: ttySAC3 at MMIO 0x12c30000 (irq = 61, base_baud = 0) is a S3C6400/10
	Unable to handle kernel paging request at virtual address fffffdfb

	(clk_prepare) from [] (s3c24xx_serial_pm+0x20/0x128)
	(s3c24xx_serial_pm) from [] (uart_change_pm+0x38/0x40)
	(uart_change_pm) from [] (uart_add_one_port+0x31c/0x44c)
	(uart_add_one_port) from [] (s3c24xx_serial_probe+0x2a8/0x418)
	(s3c24xx_serial_probe) from [] (platform_drv_probe+0x50/0xb0)
	(platform_drv_probe) from [] (driver_probe_device+0x1f4/0x2b0)
	(driver_probe_device) from [] (bus_for_each_drv+0x44/0x8c)
	(bus_for_each_drv) from [] (__device_attach+0x9c/0x100)
	(__device_attach) from [] (bus_probe_device+0x84/0x8c)
	(bus_probe_device) from [] (deferred_probe_work_func+0x60/0x8c)
	(deferred_probe_work_func) from [] (process_one_work+0x120/0x328)
	(process_one_work) from [] (worker_thread+0x2c/0x4ac)
	(worker_thread) from [] (kthread+0xd8/0xf4)
	(kthread) from [] (ret_from_fork+0x14/0x3c)

The first unsuccessful clk_get() causes s3c24xx_serial_init_port() to
exit with failure but the s3c24xx_uart_port is left half-configured
(e.g. port->mapbase is set, clk contains ERR_PTR).  On next re-probe,
the function s3c24xx_serial_init_port() will exit early with success
because of configured port->mapbase and driver will use old values,
including the ERR_PTR as clock.

Fix this by cleaning the port->mapbase on error path so each re-probe
will initialize all of the port settings.

Fixes: 60e93575476f ("serial: samsung: enable clock before clearing pending interrupts during init")
Signed-off-by: Krzysztof Kozlowski 
Reviewed-by: Javier Martinez Canillas 
Tested-by: Javier Martinez Canillas 
Tested-by: Kevin Hilman 
Signed-off-by: Greg Kroah-Hartman

tty: serial: msm: Don't read off end of tx fifo

2016-08-20T16:10:49+00:00

commit 30acf549ca1e81859a67590ab9ecfce3d1050a0b upstream.

For dm uarts in pio mode tx data is transferred to the fifo register 4
bytes at a time, but care is not taken when these 4 bytes spans the end
of the xmit buffer so the loop might read up to 3 bytes past the buffer
and then skip the actual data at the beginning of the buffer.

Fix this by, analogous to the DMA case, make sure the chunk doesn't
wrap the xmit buffer.

Fixes: 3a878c430fd6 ("tty: serial: msm: Add TX DMA support")
Cc: Ivan Ivanov 
Reported-by: Frank Rowand 
Reported-by: Nicolas Dechesne 
Signed-off-by: Bjorn Andersson 
Acked-by: Andy Gross 
Tested-by: Frank Rowand 
Reviewed-by: Stephen Boyd 
Signed-off-by: Greg Kroah-Hartman

serial: mvebu-uart: free the IRQ in ->shutdown()

2016-08-16T07:35:00+00:00

commit c2c1659b4f8f9e19fe82a4fd06cca4b3d59090ce upstream.

As suggested by the serial port infrastructure documentation, the IRQ is
requested in ->startup(). However, it is never freed in the ->shutdown()
hook.

With simple systems that open the serial port once for all and always
have at least one process that keep the serial port opened, there was no
problem. But with a more complicated system (*cough* systemd *cough*),
the serial port is opened/closed many times, which at some point no
processes having the serial port open at all. Due to this ->startup()
gets called again, tries to request_irq() again, which fails.

Fixes: 30530791a7a0 ("serial: mvebu-uart: initial support for Armada-3700 serial port")
Cc: Ofer Heifetz 
Signed-off-by: Thomas Petazzoni 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

2016-07-23T03:10:48+00:00

Pull input fixes from Dmitry Torokhov:
 "A few more fixes for the input subsystem:

   - restore naming for tsc2005 touchscreens as some userspace match on it
   - fix out of bound access in legacy keyboard driver
   - fixup in RMI4 driver

  Everything is tagged for stable as well"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: tsc200x - report proper input_dev name
  tty/vt/keyboard: fix OOB access in do_compute_shiftstate()
  Input: synaptics-rmi4 - fix maximum size check for F12 control register 8

tty/vt/keyboard: fix OOB access in do_compute_shiftstate()

2016-07-21T00:50:23+00:00

The size of individual keymap in drivers/tty/vt/keyboard.c is NR_KEYS,
which is currently 256, whereas number of keys/buttons in input device (and
therefor in key_down) is much larger - KEY_CNT - 768, and that can cause
out-of-bound access when we do

	sym = U(key_maps[0][k]);

with large 'k'.

To fix it we should not attempt iterating beyond smaller of NR_KEYS and
KEY_CNT.

Also while at it let's switch to for_each_set_bit() instead of open-coding
it.

Reported-by: Sasha Levin 
Reviewed-by: Guenter Roeck 
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov

devpts: fix null pointer dereference on failed memory allocation

2016-06-26T18:39:00+00:00

An ENOMEM when creating a pair tty in tty_ldisc_setup causes a null
pointer dereference in devpts_kill_index because tty->link->driver_data
is NULL.  The oops was triggered with the pty stressor in stress-ng when
in a low memory condition.

tty_init_dev tries to clean up a tty_ldisc_setup ENOMEM error by calling
release_tty, however, this ultimately tries to clean up the NULL pair'd
tty in pty_unix98_remove, triggering the Oops.

Add check to pty_unix98_remove to only clean up fsi if it is not NULL.

Ooops:

[   23.020961] Oops: 0000 [#1] SMP
[   23.020976] Modules linked in: ppdev snd_hda_codec_generic snd_hda_intel snd_hda_codec parport_pc snd_hda_core snd_hwdep parport snd_pcm input_leds joydev snd_timer serio_raw snd soundcore i2c_piix4 mac_hid ib_iser rdma_cm iw_cm ib_cm ib_core configfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi autofs4 btrfs raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel qxl aes_x86_64 ttm lrw gf128mul glue_helper ablk_helper drm_kms_helper cryptd syscopyarea sysfillrect psmouse sysimgblt floppy fb_sys_fops drm pata_acpi jitterentropy_rng drbg ansi_cprng
[   23.020978] CPU: 0 PID: 1452 Comm: stress-ng-pty Not tainted 4.7.0-rc4+ #2
[   23.020978] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[   23.020979] task: ffff88007ba30000 ti: ffff880078ea8000 task.ti: ffff880078ea8000
[   23.020981] RIP: 0010:[]  [] ida_remove+0x1f/0x120
[   23.020981] RSP: 0018:ffff880078eabb60  EFLAGS: 00010a03
[   23.020982] RAX: 4444444444444567 RBX: 0000000000000000 RCX: 000000000000001f
[   23.020982] RDX: 000000000000014c RSI: 000000000000026f RDI: 0000000000000000
[   23.020982] RBP: ffff880078eabb70 R08: 0000000000000004 R09: 0000000000000036
[   23.020983] R10: 000000000000026f R11: 0000000000000000 R12: 000000000000026f
[   23.020983] R13: 000000000000026f R14: ffff88007c944b40 R15: 000000000000026f
[   23.020984] FS:  00007f9a2f3cc700(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000
[   23.020984] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   23.020985] CR2: 0000000000000010 CR3: 000000006c81b000 CR4: 00000000001406f0
[   23.020988] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   23.020988] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   23.020988] Stack:
[   23.020989]  0000000000000000 000000000000026f ffff880078eabb90 ffffffff812a5a99
[   23.020990]  0000000000000000 00000000fffffff4 ffff880078eabba8 ffffffff814f9cbe
[   23.020991]  ffff88007965c800 ffff880078eabbc8 ffffffff814eef43 fffffffffffffff4
[   23.020991] Call Trace:
[   23.021000]  [] devpts_kill_index+0x29/0x50
[   23.021002]  [] pty_unix98_remove+0x2e/0x50
[   23.021006]  [] release_tty+0xb3/0x1b0
[   23.021007]  [] tty_init_dev+0xd4/0x1c0
[   23.021011]  [] ptmx_open+0xae/0x190
[   23.021013]  [] chrdev_open+0xbf/0x1b0
[   23.021015]  [] do_dentry_open+0x203/0x310
[   23.021016]  [] ? cdev_put+0x30/0x30
[   23.021017]  [] vfs_open+0x54/0x80
[   23.021018]  [] ? may_open+0x8c/0x100
[   23.021019]  [] path_openat+0x2eb/0x1440
[   23.021020]  [] ? putname+0x54/0x60
[   23.021022]  [] ? n_tty_ioctl_helper+0x27/0x100
[   23.021023]  [] do_filp_open+0x91/0x100
[   23.021024]  [] ? getname_flags+0x56/0x1f0
[   23.021026]  [] ? __alloc_fd+0x46/0x190
[   23.021027]  [] do_sys_open+0x124/0x210
[   23.021028]  [] SyS_open+0x1e/0x20
[   23.021035]  [] entry_SYSCALL_64_fastpath+0x1e/0xa8
[   23.021044] Code: 63 28 45 31 e4 eb dd 0f 1f 44 00 00 55 4c 63 d6 48 ba 89 88 88 88 88 88 88 88 4c 89 d0 b9 1f 00 00 00 48 f7 e2 48 89 e5 41 54 53 <8b> 47 10 48 89 fb 8d 3c c5 00 00 00 00 48 c1 ea 09 b8 01 00 00
[   23.021045] RIP  [] ida_remove+0x1f/0x120
[   23.021045]  RSP 
[   23.021046] CR2: 0000000000000010

Signed-off-by: Colin Ian King 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

tty: vt: Fix soft lockup in fbcon cursor blink timer.

2016-06-25T17:41:13+00:00

We are getting somewhat random soft lockups with this signature:

[   86.992215] [] el1_irq+0xa0/0x10c
[   86.997082] [] cursor_timer_handler+0x30/0x54
[   87.002991] [] call_timer_fn+0x54/0x1a8
[   87.008378] [] run_timer_softirq+0x1c4/0x2bc
[   87.014200] [] __do_softirq+0x114/0x344
[   87.019590] [] irq_exit+0x74/0x98
[   87.024458] [] __handle_domain_irq+0x98/0xfc
[   87.030278] [] gic_handle_irq+0x94/0x190

This is caused by the vt visual_init() function calling into
fbcon_init() with a vc_cur_blink_ms value of zero.  This is a
transient condition, as it is later set to a non-zero value.  But, if
the timer happens to expire while the blink rate is zero, it goes into
an endless loop, and we get soft lockup.

The fix is to initialize vc_cur_blink_ms before calling the con_init()
function.

Signed-off-by: David Daney 
Cc: stable@vger.kernel.org
Acked-by: Pavel Machek 
Tested-by: Ming Lei 
Acked-by: Scot Doyle 
Tested-by: Henrique de Moraes Holschuh 
Signed-off-by: Greg Kroah-Hartman