Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'tty-4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull tty/serial fixes from Greg KH:
"Here are a number of small tty and serial driver fixes for 4.5-rc4
that resolve some reported issues.
One of them got reverted as it wasn't correct based on testing, and
all have been in linux-next for a while"
* tag 'tty-4.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
Revert "8250: uniphier: allow modular build with 8250 console"
pty: make sure super_block is still valid in final /dev/tty close
pty: fix possible use after free of tty->driver_data
tty: Add support for PCIe WCH382 2S multi-IO card
serial/omap: mark wait_for_xmitr as __maybe_unused
serial: omap: Prevent DoS using unprivileged ioctl(TIOCSRS485)
8250: uniphier: allow modular build with 8250 console
tty: Drop krefs for interrupted tty lock
+79
-7
+20
-1
drivers/tty/pty.c
+20
-1
drivers/tty/pty.c
···
681
681
/* this is called once with whichever end is closed last */
682
682
static void pty_unix98_shutdown(struct tty_struct *tty)
683
683
{
684
-
devpts_kill_index(tty->driver_data, tty->index);
684
+
struct inode *ptmx_inode;
685
+
686
+
if (tty->driver->subtype == PTY_TYPE_MASTER)
687
+
ptmx_inode = tty->driver_data;
688
+
else
689
+
ptmx_inode = tty->link->driver_data;
690
+
devpts_kill_index(ptmx_inode, tty->index);
691
+
devpts_del_ref(ptmx_inode);
685
692
}
686
693
687
694
static const struct tty_operations ptm_unix98_ops = {
···
779
772
780
773
set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
781
774
tty->driver_data = inode;
775
+
776
+
/*
777
+
* In the case where all references to ptmx inode are dropped and we
778
+
* still have /dev/tty opened pointing to the master/slave pair (ptmx
779
+
* is closed/released before /dev/tty), we must make sure that the inode
780
+
* is still valid when we call the final pty_unix98_shutdown, thus we
781
+
* hold an additional reference to the ptmx inode. For the same /dev/tty
782
+
* last close case, we also need to make sure the super_block isn't
783
+
* destroyed (devpts instance unmounted), before /dev/tty is closed and
784
+
* on its release devpts_kill_index is called.
785
+
*/
786
+
devpts_add_ref(inode);
782
787
783
788
tty_add_file(tty, filp);
784
789
+21
drivers/tty/serial/8250/8250_pci.c
+21
drivers/tty/serial/8250/8250_pci.c
···
1941
1941
#define PCIE_VENDOR_ID_WCH 0x1c00
1942
1942
#define PCIE_DEVICE_ID_WCH_CH382_2S1P 0x3250
1943
1943
#define PCIE_DEVICE_ID_WCH_CH384_4S 0x3470
1944
+
#define PCIE_DEVICE_ID_WCH_CH382_2S 0x3253
1944
1945
1945
1946
#define PCI_VENDOR_ID_PERICOM 0x12D8
1946
1947
#define PCI_DEVICE_ID_PERICOM_PI7C9X7951 0x7951
···
2638
2637
.subdevice = PCI_ANY_ID,
2639
2638
.setup = pci_wch_ch353_setup,
2640
2639
},
2640
+
/* WCH CH382 2S card (16850 clone) */
2641
+
{
2642
+
.vendor = PCIE_VENDOR_ID_WCH,
2643
+
.device = PCIE_DEVICE_ID_WCH_CH382_2S,
2644
+
.subvendor = PCI_ANY_ID,
2645
+
.subdevice = PCI_ANY_ID,
2646
+
.setup = pci_wch_ch38x_setup,
2647
+
},
2641
2648
/* WCH CH382 2S1P card (16850 clone) */
2642
2649
{
2643
2650
.vendor = PCIE_VENDOR_ID_WCH,
···
2964
2955
pbn_fintek_4,
2965
2956
pbn_fintek_8,
2966
2957
pbn_fintek_12,
2958
+
pbn_wch382_2,
2967
2959
pbn_wch384_4,
2968
2960
pbn_pericom_PI7C9X7951,
2969
2961
pbn_pericom_PI7C9X7952,
···
3784
3774
.uart_offset = 8,
3785
3775
.base_baud = 115200,
3786
3776
.first_offset = 0x40,
3777
+
},
3778
+
[pbn_wch382_2] = {
3779
+
.flags = FL_BASE0,
3780
+
.num_ports = 2,
3781
+
.base_baud = 115200,
3782
+
.uart_offset = 8,
3783
+
.first_offset = 0xC0,
3787
3784
},
3788
3785
[pbn_wch384_4] = {
3789
3786
.flags = FL_BASE0,
···
5590
5573
{ PCI_VENDOR_ID_WCH, PCI_DEVICE_ID_WCH_CH353_2S1PF,
5591
5574
PCI_ANY_ID, PCI_ANY_ID,
5592
5575
0, 0, pbn_b0_bt_2_115200 },
5576
+
5577
+
{ PCIE_VENDOR_ID_WCH, PCIE_DEVICE_ID_WCH_CH382_2S,
5578
+
PCI_ANY_ID, PCI_ANY_ID,
5579
+
0, 0, pbn_wch382_2 },
5593
5580
5594
5581
{ PCIE_VENDOR_ID_WCH, PCIE_DEVICE_ID_WCH_CH384_4S,
5595
5582
PCI_ANY_ID, PCI_ANY_ID,
+7
-3
drivers/tty/serial/omap-serial.c
+7
-3
drivers/tty/serial/omap-serial.c
···
1165
1165
1166
1166
#define BOTH_EMPTY (UART_LSR_TEMT | UART_LSR_THRE)
1167
1167
1168
-
static void wait_for_xmitr(struct uart_omap_port *up)
1168
+
static void __maybe_unused wait_for_xmitr(struct uart_omap_port *up)
1169
1169
{
1170
1170
unsigned int status, tmout = 10000;
1171
1171
···
1343
1343
1344
1344
/* Enable or disable the rs485 support */
1345
1345
static int
1346
-
serial_omap_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
1346
+
serial_omap_config_rs485(struct uart_port *port, struct serial_rs485 *rs485)
1347
1347
{
1348
1348
struct uart_omap_port *up = to_uart_omap_port(port);
1349
1349
unsigned int mode;
···
1356
1356
up->ier = 0;
1357
1357
serial_out(up, UART_IER, 0);
1358
1358
1359
+
/* Clamp the delays to [0, 100ms] */
1360
+
rs485->delay_rts_before_send = min(rs485->delay_rts_before_send, 100U);
1361
+
rs485->delay_rts_after_send = min(rs485->delay_rts_after_send, 100U);
1362
+
1359
1363
/* store new config */
1360
-
port->rs485 = *rs485conf;
1364
+
port->rs485 = *rs485;
1361
1365
1362
1366
/*
1363
1367
* Just as a precaution, only allow rs485
+1
-2
drivers/tty/tty_io.c
+1
-2
drivers/tty/tty_io.c
···
2066
2066
if (tty) {
2067
2067
mutex_unlock(&tty_mutex);
2068
2068
retval = tty_lock_interruptible(tty);
2069
+
tty_kref_put(tty); /* drop kref from tty_driver_lookup_tty() */
2069
2070
if (retval) {
2070
2071
if (retval == -EINTR)
2071
2072
retval = -ERESTARTSYS;
2072
2073
goto err_unref;
2073
2074
}
2074
-
/* safe to drop the kref from tty_driver_lookup_tty() */
2075
-
tty_kref_put(tty);
2076
2075
retval = tty_reopen(tty);
2077
2076
if (retval < 0) {
2078
2077
tty_unlock(tty);
+6
-1
drivers/tty/tty_mutex.c
+6
-1
drivers/tty/tty_mutex.c
···
21
21
22
22
int tty_lock_interruptible(struct tty_struct *tty)
23
23
{
24
+
int ret;
25
+
24
26
if (WARN(tty->magic != TTY_MAGIC, "L Bad %p\n", tty))
25
27
return -EIO;
26
28
tty_kref_get(tty);
27
-
return mutex_lock_interruptible(&tty->legacy_mutex);
29
+
ret = mutex_lock_interruptible(&tty->legacy_mutex);
30
+
if (ret)
31
+
tty_kref_put(tty);
32
+
return ret;
28
33
}
29
34
30
35
void __lockfunc tty_unlock(struct tty_struct *tty)
+20
fs/devpts/inode.c
+20
fs/devpts/inode.c
···
575
575
mutex_unlock(&allocated_ptys_lock);
576
576
}
577
577
578
+
/*
579
+
* pty code needs to hold extra references in case of last /dev/tty close
580
+
*/
581
+
582
+
void devpts_add_ref(struct inode *ptmx_inode)
583
+
{
584
+
struct super_block *sb = pts_sb_from_inode(ptmx_inode);
585
+
586
+
atomic_inc(&sb->s_active);
587
+
ihold(ptmx_inode);
588
+
}
589
+
590
+
void devpts_del_ref(struct inode *ptmx_inode)
591
+
{
592
+
struct super_block *sb = pts_sb_from_inode(ptmx_inode);
593
+
594
+
iput(ptmx_inode);
595
+
deactivate_super(sb);
596
+
}
597
+
578
598
/**
579
599
* devpts_pty_new -- create a new inode in /dev/pts/
580
600
* @ptmx_inode: inode of the master
+4
include/linux/devpts_fs.h
+4
include/linux/devpts_fs.h
···
19
19
20
20
int devpts_new_index(struct inode *ptmx_inode);
21
21
void devpts_kill_index(struct inode *ptmx_inode, int idx);
22
+
void devpts_add_ref(struct inode *ptmx_inode);
23
+
void devpts_del_ref(struct inode *ptmx_inode);
22
24
/* mknod in devpts */
23
25
struct inode *devpts_pty_new(struct inode *ptmx_inode, dev_t device, int index,
24
26
void *priv);
···
34
32
/* Dummy stubs in the no-pty case */
35
33
static inline int devpts_new_index(struct inode *ptmx_inode) { return -EINVAL; }
36
34
static inline void devpts_kill_index(struct inode *ptmx_inode, int idx) { }
35
+
static inline void devpts_add_ref(struct inode *ptmx_inode) { }
36
+
static inline void devpts_del_ref(struct inode *ptmx_inode) { }
37
37
static inline struct inode *devpts_pty_new(struct inode *ptmx_inode,
38
38
dev_t device, int index, void *priv)
39
39
{