linux.git/drivers/tty, branch v5.10-rc2

vt_ioctl: fix GIO_UNIMAP regression

2020-10-28T12:41:17+00:00

In commit 5ba127878722, we shuffled with the check of 'perm'. But my
brain somehow inverted the condition in 'do_unimap_ioctl' (I thought
it is ||, not &&), so GIO_UNIMAP stopped working completely.

Move the 'perm' checks back to do_unimap_ioctl and do them right again.
In fact, this reverts this part of code to the pre-5ba127878722 state.
Except 'perm' is now a bool.

Fixes: 5ba127878722 ("vt_ioctl: move perm checks level up")
Cc: stable@vger.kernel.org
Reported-by: Fabian Vogt 
Signed-off-by: Jiri Slaby 
Link: https://lore.kernel.org/r/20201026055419.30518-1-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman

vt: keyboard, extend func_buf_lock to readers

2020-10-28T12:41:02+00:00

Both read-side users of func_table/func_buf need locking. Without that,
one can easily confuse the code by repeatedly setting altering strings
like:
while (1)
	for (a = 0; a < 2; a++) {
		struct kbsentry kbs = {};
		strcpy((char *)kbs.kb_string, a ? ".\n" : "88888\n");
		ioctl(fd, KDSKBSENT, &kbs);
	}

When that program runs, one can get unexpected output by holding F1
(note the unxpected period on the last line):
.
88888
.8888

So protect all accesses to 'func_table' (and func_buf) by preexisting
'func_buf_lock'.

It is easy in 'k_fn' handler as 'puts_queue' is expected not to sleep.
On the other hand, KDGKBSENT needs a local (atomic) copy of the string
because copy_to_user can sleep. Use already allocated, but unused
'kbs->kb_string' for that purpose.

Note that the program above needs at least CAP_SYS_TTY_CONFIG.

This depends on the previous patch and on the func_buf_lock lock added
in commit 46ca3f735f34 (tty/vt: fix write/write race in ioctl(KDSKBSENT)
handler) in 5.2.

Likely fixes CVE-2020-25656.

Cc: 
Reported-by: Minh Yuan 
Signed-off-by: Jiri Slaby 
Link: https://lore.kernel.org/r/20201019085517.10176-2-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman

vt: keyboard, simplify vt_kdgkbsent

2020-10-28T12:41:02+00:00

Use 'strlen' of the string, add one for NUL terminator and simply do
'copy_to_user' instead of the explicit 'for' loop. This makes the
KDGKBSENT case more compact.

The only thing we need to take care about is NULL 'func_table[i]'. Use
an empty string in that case.

The original check for overflow could never trigger as the func_buf
strings are always shorter or equal to 'struct kbsentry's.

Cc: 
Signed-off-by: Jiri Slaby 
Link: https://lore.kernel.org/r/20201019085517.10176-1-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman

tty: serial: fsl_lpuart: LS1021A has a FIFO size of 16 words, like LS1028A

2020-10-28T12:40:25+00:00

Prior to the commit that this one fixes, the FIFO size was derived from
the read-only register LPUARTx_FIFO[TXFIFOSIZE] using the following
formula:

TX FIFO size = 2 ^ (LPUARTx_FIFO[TXFIFOSIZE] - 1)

The documentation for LS1021A is a mess. Under chapter 26.1.3 LS1021A
LPUART module special consideration, it mentions TXFIFO_SZ and RXFIFO_SZ
being equal to 4, and in the register description for LPUARTx_FIFO, it
shows the out-of-reset value of TXFIFOSIZE and RXFIFOSIZE fields as "011",
even though these registers read as "101" in reality.

And when LPUART on LS1021A was working, the "101" value did correspond
to "16 datawords", by applying the formula above, even though the
documentation is wrong again (!!!!) and says that "101" means 64 datawords
(hint: it doesn't).

So the "new" formula created by commit f77ebb241ce0 has all the premises
of being wrong for LS1021A, because it relied only on false data and no
actual experimentation.

Interestingly, in commit c2f448cff22a ("tty: serial: fsl_lpuart: add
LS1028A support"), Michael Walle applied a workaround to this by manually
setting the FIFO widths for LS1028A. It looks like the same values are
used by LS1021A as well, in fact.

When the driver thinks that it has a deeper FIFO than it really has,
getty (user space) output gets truncated.

Many thanks to Michael for pointing out where to look.

Fixes: f77ebb241ce0 ("tty: serial: fsl_lpuart: correct the FIFO depth size")
Suggested-by: Michael Walle 
Signed-off-by: Vladimir Oltean 
Link: https://lore.kernel.org/r/20201023013429.3551026-1-vladimir.oltean@nxp.com
Reviewed-by：Fugang Duan 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

tty: serial: 21285: fix lockup on open

2020-10-28T12:39:14+00:00

Commit 293f89959483 ("tty: serial: 21285: stop using the unused[]
variable from struct uart_port") introduced a bug which stops the
transmit interrupt being disabled when there are no characters to
transmit - disabling the transmit interrupt at the interrupt controller
is the only way to stop an interrupt storm. If this interrupt is not
disabled when there are no transmit characters, we end up with an
interrupt storm which prevents the machine making forward progress.

Fixes: 293f89959483 ("tty: serial: 21285: stop using the unused[] variable from struct uart_port")
Signed-off-by: Russell King 
Cc: stable 
Link: https://lore.kernel.org/r/E1kU4GS-0006lE-OO@rmk-PC.armlinux.org.uk
Signed-off-by: Greg Kroah-Hartman

Merge tag 'armsoc-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

2020-10-24T17:33:08+00:00

Pull ARM SoC platform updates from Olof Johansson:
 "SoC changes, a substantial part of this is cleanup of some of the
  older platforms that used to have a bunch of board files.

  In particular:

   - Remove non-DT i.MX platforms that haven't seen activity in years,
     it's time to remove them.

   - A bunch of cleanup and removal of platform data for TI/OMAP
     platforms, moving over to genpd for power/reset control (yay!)

   - Major cleanup of Samsung S3C24xx and S3C64xx platforms, moving them
     closer to multiplatform support (not quite there yet, but getting
     close).

  There are a few other changes too, smaller fixlets, etc. For new
  platform support, the primary ones are:

   - New SoC: Hisilicon SD5203, ARM926EJ-S platform.

   - Cpufreq support for i.MX7ULP"

* tag 'armsoc-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (121 commits)
  ARM: mstar: Select MStar intc
  ARM: stm32: Replace HTTP links with HTTPS ones
  ARM: debug: add UART early console support for SD5203
  ARM: hisi: add support for SD5203 SoC
  ARM: omap3: enable off mode automatically
  clk: imx: imx35: Remove mx35_clocks_init()
  clk: imx: imx31: Remove mx31_clocks_init()
  clk: imx: imx27: Remove mx27_clocks_init()
  ARM: imx: Remove unused definitions
  ARM: imx35: Retrieve the IIM base address from devicetree
  ARM: imx3: Retrieve the AVIC base address from devicetree
  ARM: imx3: Retrieve the CCM base address from devicetree
  ARM: imx31: Retrieve the IIM base address from devicetree
  ARM: imx27: Retrieve the CCM base address from devicetree
  ARM: imx27: Retrieve the SYSCTRL base address from devicetree
  ARM: s3c64xx: bring back notes from removed debug-macro.S
  ARM: s3c24xx: fix Wunused-variable warning on !MMU
  ARM: samsung: fix PM debug build with DEBUG_LL but !MMU
  MAINTAINERS: mark linux-samsung-soc list non-moderated
  ARM: imx: Remove remnant board file support pieces
  ...

Merge tag 'mips_5.10' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux

2020-10-16T19:40:55+00:00

Pull MIPS updates from Thomas Bogendoerfer:

 - removed support for PNX833x alias NXT_STB22x

 - included Ingenic SoC support into generic MIPS kernels

 - added support for new Ingenic SoCs

 - converted workaround selection to use Kconfig

 - replaced old boot mem functions by memblock_*

 - enabled COP2 usage in kernel for Loongson64 to make use
   of 16byte load/stores possible

 - cleanups and fixes

* tag 'mips_5.10' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (92 commits)
  MIPS: DEC: Restore bootmem reservation for firmware working memory area
  MIPS: dec: fix section mismatch
  bcm963xx_tag.h: fix duplicated word
  mips: ralink: enable zboot support
  MIPS: ingenic: Remove CPU_SUPPORTS_HUGEPAGES
  MIPS: cpu-probe: remove MIPS_CPU_BP_GHIST option bit
  MIPS: cpu-probe: introduce exclusive R3k CPU probe
  MIPS: cpu-probe: move fpu probing/handling into its own file
  MIPS: replace add_memory_region with memblock
  MIPS: Loongson64: Clean up numa.c
  MIPS: Loongson64: Select SMP in Kconfig to avoid build error
  mips: octeon: Add Ubiquiti E200 and E220 boards
  MIPS: SGI-IP28: disable use of ll/sc in kernel
  MIPS: tx49xx: move tx4939_add_memory_regions into only user
  MIPS: pgtable: Remove used PAGE_USERIO define
  MIPS: alchemy: Share prom_init implementation
  MIPS: alchemy: Fix build breakage, if TOUCHSCREEN_WM97XX is disabled
  MIPS: process: include exec.h header in process.c
  MIPS: process: Add prototype for function arch_dup_task_struct
  MIPS: idle: Add prototype for function check_wait
  ...

serial: mcf: add sysrq capability

2020-10-05T11:32:30+00:00

After some unsuccessful attempts to use sysrq over console, figured
out that port->has_sysrq should likely be enabled, as per other
architectures, this when CONFIG_SERIAL_MCF_CONSOLE is also enabled.

Tested some magic sysrq commands (h, p, t, b), they works now
properly. Commands works inside 5 secs after BREAK is sent, as
expected.

Signed-off-by: Angelo Dureghello 
Link: https://lore.kernel.org/r/20201002140545.477481-1-angelo.dureghello@timesys.com
Signed-off-by: Greg Kroah-Hartman

serial: fsl_lpuart: add sysrq support when using dma

2020-10-05T11:32:30+00:00

Add handling of magic sysrq keys when using dma/edma.

Tested by sending BREAK followed by a sysrq command inside
a 5 secs time window, by:

echo 1 > /proc/sys/kernel/sysrq

BREAK + h, t, e, b, c

Tested also sending a command after 5 secs after BREAK, that's
properly ignored.

Signed-off-by: Angelo Dureghello 
Link: https://lore.kernel.org/r/20201004161144.1307174-1-angelo.dureghello@timesys.com
Signed-off-by: Greg Kroah-Hartman

tty/sysrq: Extend the sysrq_key_table to cover capital letters

2020-10-02T12:56:06+00:00

All slots in sysrq_key_table[] are either used, reserved or at least
commented with their intended use. This patch adds capital letter versions
available, which means adding 26 more entries.

For already existing SysRq operations the user presses Alt-SysRq-, and
for the newly added ones Alt-Shift-SysRq-.

Signed-off-by: Andrzej Pietrasiewicz 
Acked-by: Daniel Vetter 
Link: https://lore.kernel.org/r/20200818112825.6445-2-andrzej.p@collabora.com
Signed-off-by: Greg Kroah-Hartman