linux.git/drivers/char/ttyprintk.c, branch v3.10

ttyprintk: Fix NULL pointer deref by setting tty_port ops after initializing port

2013-05-21T17:13:23+00:00

tty_port_init() zeroes out the tty port, which means that we have to set the
ops pointer /after/, not before this call.  Otherwise, tty_port_open will crash
when it tries to deref ops, which is now a NULL pointer.

Signed-off-by: Darrick J. Wong 
Signed-off-by: Greg Kroah-Hartman

TTY: call tty_port_destroy in the rest of drivers

2012-11-16T01:20:58+00:00

After commit "TTY: move tty buffers to tty_port", the tty buffers are
not freed in some drivers. This is because tty_port_destructor is not
called whenever a tty_port is freed. This was an assumption I counted
with but was unfortunately untrue. So fix the drivers to fulfil this
assumption.

To be sure, the TTY buffers (and later some stuff) are gone along with
the tty_port, we have to call tty_port_destroy at tear-down places.
This is mostly where the structure containing a tty_port is freed.
This patch does exactly that -- put tty_port_destroy at those places.

Signed-off-by: Jiri Slaby 
Signed-off-by: Greg Kroah-Hartman

TTY: tty_alloc_driver() returns error pointers

2012-08-16T19:07:23+00:00

We changed these from alloc_tty_driver() to tty_alloc_driver() so the
error handling needs to modified to check for IS_ERR() instead of NULL.

Signed-off-by: Dan Carpenter 
Acked-by: Jiri Slaby 
Signed-off-by: Greg Kroah-Hartman

TTY: use tty_port_link_device

2012-08-13T23:50:19+00:00

So now for those drivers that can use neither tty_port_install nor
tty_port_register_driver but still have tty_port available before
tty_register_driver we use newly added tty_port_link_device.

The rest of the drivers that still do not provide tty_struct <->
tty_port link will have to be converted to implement
tty->ops->install.

Signed-off-by: Jiri Slaby 
Acked-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

TTY: add support for unnumbered device nodes

2012-08-13T23:45:38+00:00

This allows drivers like ttyprintk to avoid hacks to create an
unnumbered node in /dev. It used to set TTY_DRIVER_DYNAMIC_DEV in
flags and call device_create on its own. That is incorrect, because
TTY_DRIVER_DYNAMIC_DEV may be set only if tty_register_device is
called explicitly.

Signed-off-by: Jiri Slaby 
Acked-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

TTY: ttyprintk, initialize tty_port earlier

2012-08-10T20:29:57+00:00

After tty_register_driver is called, it is too late to initialize a
guy with which we operate in open. When a process already called
open(2) on that node, the structures may be in use uninitialized.

Move the initialization prior to tty_register_driver.

Signed-off-by: Jiri Slaby 
Cc: Samo Pogacnik 
Signed-off-by: Greg Kroah-Hartman

TTY: ttyprintk, don't touch behind tty->write_buf

2012-08-10T20:29:57+00:00

If a user provides a buffer larger than a tty->write_buf chunk and
passes '\r' at the end of the buffer, we touch an out-of-bound memory.

Add a check there to prevent this.

Signed-off-by: Jiri Slaby 
Cc: stable@vger.kernel.org (everything maintained past v2.6.37)
Cc: Samo Pogacnik 
Signed-off-by: Greg Kroah-Hartman

TTY: ttyprintk, unregister tty driver on failure

2012-08-10T20:29:57+00:00

When the tty_printk driver fails to create a node in sysfs, the system
crashes. It is because the driver registers a tty driver and frees it
without deregistering it first. The fix is easy: add a call to
tty_unregister_driver to the fail path.

This is very unlikely to happen in usual environment => no need for
stable.

The crash occurs at some place where we iterate over tty drivers
first. It may look like this:
BUG: unable to handle kernel paging request at ffffffffffffff84
IP: [] tty_open+0xd6/0x650
PGD 1a0d067 PUD 1a0e067 PMD 0
Oops: 0000 [#1] PREEMPT SMP
Modules linked in:
CPU 0
Pid: 1183, comm: boot.localnet Tainted: G        W    3.5.0-rc7-next-20120716+ #369 Bochs Bochs
RIP: 0010:[]  [] tty_open+0xd6/0x650
RSP: 0018:ffff8800162b3b98  EFLAGS: 00010207
RAX: 0000000000000000 RBX: ffff880016ba6200 RCX: 0000000000002208
RDX: 0000000000000000 RSI: 00000000000000d0 RDI: ffffffff81a35080
RBP: ffff8800162b3c08 R08: ffffffff81276f42 R09: 0000000000400040
R10: ffff8800161dc005 R11: ffff8800188ee048 R12: 0000000000000000
R13: ffffffffffffff58 R14: 0000000000400040 R15: 0000000000008000
FS:  00007f3684abd700(0000) GS:ffff880018e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffff84 CR3: 000000001503e000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process boot.localnet (pid: 1183, threadinfo ffff8800162b2000, task ffff8800188c5880)
Stack:
 ffff8800162b3c08 ffffffff81363d63 ffffffff81a62940 ffff8800189b4e88
 ffff8800188c5880 ffffffff81123180 0000000000000000 ffffffff18b20600
 0000000000000000 ffff8800189b4e88 ffff880016ba6200 ffff880018b20600
Call Trace:
 [] ? kobj_lookup+0x103/0x160
 [] ? mount_fs+0x110/0x110
 [] chrdev_open+0x9c/0x1a0
 [] ? cdev_put+0x30/0x30
 [] do_dentry_open.isra.19+0x1e6/0x270
 [] finish_open+0x65/0xa0
 [] do_last.isra.52+0x26e/0xd80
 [] ? inode_permission+0x13/0x50
 [] ? link_path_walk+0x63/0x940
 [] path_openat+0xab/0x3d0
 [] do_filp_open+0x3d/0xa0
 [] ? alloc_fd+0xd2/0x120
 [] do_sys_open+0xf3/0x1d0
 [] sys_open+0x1c/0x20
 [] system_call_fastpath+0x16/0x1b

Signed-off-by: Jiri Slaby 
Cc: Samo Pogacnik 
Signed-off-by: Greg Kroah-Hartman

TTY: remove re-assignments to tty_driver members

2012-03-08T19:37:58+00:00

All num, magic and owner are set by alloc_tty_driver. No need to
re-set them on each allocation site.

pti driver sets something different to what it passes to
alloc_tty_driver. It is not a bug, since we don't use the lines
parameter in any way. Anyway this is fixed, and now we do the right
thing.

Signed-off-by: Jiri Slaby 
Acked-by: Tilman Schmidt 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2011-11-07T03:44:47+00:00

* 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux: (230 commits)
  Revert "tracing: Include module.h in define_trace.h"
  irq: don't put module.h into irq.h for tracking irqgen modules.
  bluetooth: macroize two small inlines to avoid module.h
  ip_vs.h: fix implicit use of module_get/module_put from module.h
  nf_conntrack.h: fix up fallout from implicit moduleparam.h presence
  include: replace linux/module.h with "struct module" wherever possible
  include: convert various register fcns to macros to avoid include chaining
  crypto.h: remove unused crypto_tfm_alg_modname() inline
  uwb.h: fix implicit use of asm/page.h for PAGE_SIZE
  pm_runtime.h: explicitly requires notifier.h
  linux/dmaengine.h: fix implicit use of bitmap.h and asm/page.h
  miscdevice.h: fix up implicit use of lists and types
  stop_machine.h: fix implicit use of smp.h for smp_processor_id
  of: fix implicit use of errno.h in include/linux/of.h
  of_platform.h: delete needless include 
  acpi: remove module.h include from platform/aclinux.h
  miscdevice.h: delete unnecessary inclusion of module.h
  device_cgroup.h: delete needless include 
  net: sch_generic remove redundant use of 
  net: inet_timewait_sock doesnt need 
  ...

Fix up trivial conflicts (other header files, and  removal of the ab3550 mfd driver) in
 - drivers/media/dvb/frontends/dibx000_common.c
 - drivers/media/video/{mt9m111.c,ov6650.c}
 - drivers/mfd/ab3550-core.c
 - include/linux/dmaengine.h