- 13 Apr, 2012 1 commit
-
-
Jiri Slaby authored
A -next commit "TTY: HVC, use tty from tty_port" switched the driver to use tty_port helper for tty refcounting. But it omitted to remove manual tty refcounting from open, close and hangup. So now we are getting random crashes caused by use-after-free: Unable to handle kernel paging request for data at address 0xc0000003f9d550 Faulting instruction address: 0xc0000000001b7f40 Oops: Kernel access of bad area, sig: 11 [#1] ... NIP: c0000000001b7f40 LR: c0000000001b7f14 CTR: c0000000000e04f0 ... NIP [c0000000001b7f40] .__kmalloc+0x70/0x230 LR [c0000000001b7f14] .__kmalloc+0x44/0x230 Call Trace: [c0000003f68bf930] [c0000003f68bf9b0] 0xc0000003f68bf9b0 (unreliable) [c0000003f68bf9e0] [c0000000001e5424] .alloc_fdmem+0x24/0x70 [c0000003f68bfa60] [c0000000001e54f8] .alloc_fdtable+0x88/0x130 [c0000003f68bfaf0] [c0000000001e5924] .dup_fd+0x384/0x450 [c0000003f68bfbd0] [c00000000009a310] .copy_process+0x880/0x11d0 [c0000003f68bfcd0] [c00000000009aee0] .do_fork+0x70/0x400 [c0000003f68bfdc0] [c0000000000141c4] .sys_clone+0x54/0x70 [c0000003f68bfe30] [c000000000009aa0] .ppc_clone+0x8/0xc Fix that by complete removal of tty_kref_get/put in open/close/hangup paths. Signed-off-by:
Jiri Slaby <jslaby@suse.cz> Reported-and-tested-by:
Michael Neuling <mikey@neuling.org> Cc: Stephen Rothwell <sfr@canb.auug.org.au> Cc: ppc-dev <linuxppc-dev@lists.ozlabs.org> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
- 10 Apr, 2012 1 commit
-
-
Jiri Slaby authored
Commit "ISDN: i4l, remove cvs crap" removed definition of isdn_tty_revision, but there is still a user. So this causes linking errors. This was hidden from my radar because the variable was not declared in any header. Instead isdn_common.c declares it locally. So remove this variable also from isdn_common.c, because there is really no way to find out the version. Git commit or tag is... Reported-by:
Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by:
-
- 09 Apr, 2012 38 commits
-
-
Xiaobing Tu authored
tty_buffer_request_room is well protected, but while after it returns, it releases the port->lock. tty->buf.tail might be modified by either irq handler or other threads. The patch adds more protection by holding the lock across tty buffer finding and buffer filling. Signed-off-by:
Alek Du <alek.du@intel.com> Signed-off-by:
Xiaobing Tu <xiaobing.tu@intel.com> Cc: Jiri Slaby <jslaby@suse.cz> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by:
-
Michael Gehring authored
set_get_cmap() ignored the result of {get,put}_user(), causing ioctl(vt, {G,P}IO_CMAP, 0xdeadbeef) to silently fail. Another side effect of this: calling the PIO_CMAP ioctl with an invalid buffer would zero the default colormap and the palette for all vts (all colors set to black). Leave the default colormap intact and return -EFAULT when reading/writing to the userspace buffer fails. Signed-off-by:Michael Gehring <mg@ebfe.org> Signed-off-by:
-
Tomoya MORINAGA authored
Add initialize variable to prevent duplicate free memory. Signed-off-by:
Tomoya MORINAGA <tomoya.rohm@gmail.com> Signed-off-by:
-
Tomoya MORINAGA authored
Currently, occurring line status interrupt, returned value is not set in interrupt handler function. As a result, 0 can be returned. This patch adds setting returned value. Signed-off-by:
-
Tomoya MORINAGA authored
Signed-off-by:
-
Tomoya MORINAGA authored
Signed-off-by:
-
Tomoya MORINAGA authored
%02x format is easier to understand better than %d. Signed-off-by:
-
Tomoya MORINAGA authored
Target uart register access size is 8bit. However, 32bit is used at 2 points. This patch modifies type "unsigned int" to "unsigned char". Signed-off-by:
-
Tomoya MORINAGA authored
Signed-off-by:
-
Jiri Slaby authored
This means converting an atomic counter to a counter protected by lock. This is the first step needed to convert the rest of the code to the tty_port helpers. Signed-off-by:
-
Jiri Slaby authored
tty_wakeup is safe to be called from all contexts. No need to schedule a work for that. Let us call it directly like in other drivers. This allows us to kill another member of rfcomm_dev structure. Signed-off-by:
-
Jiri Slaby authored
Switch the refcounting from manual atomic plays with refcounter to the one offered by tty_port. Signed-off-by:
-
Jiri Slaby authored
And use tty from there. Signed-off-by:
-
Jiri Slaby authored
Signed-off-by:
-
Jiri Slaby authored
Signed-off-by:
-
Jiri Slaby authored
And use count from there. Signed-off-by:
-
Jiri Slaby authored
Since the code is identical, use the tty_port_block_til_ready helper instead of re-implemented variant. The code does not perform rtsdts handling, hence we do not need to provide tty port hooks for them. The default ones will be used instead. The only necessary thing is to provide tty_port_operations. It is empty, but has to be there... Signed-off-by:
Greg Ungerer <gerg@uclinux.org> Signed-off-by:
-
Jiri Slaby authored
And refcount that properly. Signed-off-by:
-
Jiri Slaby authored
We need tty at some places, but info->tty might be NULL at those. Let us propagate tty from callers where we know we have a valid tty. This will make a switch to tty refcounting simpler. Signed-off-by:
-
Jiri Slaby authored
Signed-off-by:
-
Jiri Slaby authored
Signed-off-by:
-
Jiri Slaby authored
Signed-off-by:
-
Jiri Slaby authored
And use count and blocked_count from that. Signed-off-by:
-
Jiri Slaby authored
All the needed stuff is moved to 68328serial.c now. Signed-off-by:
-
Jiri Slaby authored
flags passed to local_irq_save/restore should be ulong. Switch tehem to that. Otherwise we get compilation warnings: .../68328serial.c:248:9: warning: comparison of distinct pointer types lacks a cast [enabled by default] .../68328serial.c:257:9: warning: comparison of distinct pointer types lacks a cast [enabled by default] Signed-off-by:
-
Jiri Slaby authored
- empty functions - unused global variables Signed-off-by:
-
Jiri Slaby authored
Not everything from struct m68k_serial is really used. So remove unused or only-set members of that structure. Next step is to move it to 68328serial.c and remove 68328serial.h completely. This change also takes status_handle and batten_down_hatches away since they use break_abort but do nothing. Signed-off-by:
-
Jiri Slaby authored
serial_state in 68328serial.h is a duplicated structure. One is defined in linux/serial.h. So let us use that instead. And since the serial flags are identical, use ones from there too. Signed-off-by:
-
Jiri Slaby authored
It does not make the driver less racy though. Close and hangup should be rewritten and tty refcounting used properly. Signed-off-by:
David Sterba <dsterba@suse.cz> Signed-off-by:
-
Jiri Slaby authored
And use count from that. Signed-off-by:
-
Jiri Slaby authored
There are two functions which only print a status. Let us do that directly at places where they are called. Signed-off-by:
-
Jiri Slaby authored
Do not touch internal workqueue. Call tty_vhangup instead. Note that finished hangup does not necessarily mean that all processes are dead. Especially when the tty is a console. The code assumes that right now. Signed-off-by:
-
Jiri Slaby authored
Now, we switch to the refcounted model and do not need hp->lock to protect hp->tty anymore. Signed-off-by:
-
Jiri Slaby authored
- use tty, not hp->tty wherever possible - pass tty down to some functions and go to step one - do not defer tty_hangup calls -- it is as simple as schedule_work, so might be called with hp->lock held - do not defer tty buffer flips -- since the driver does not use low_latency (it cannot actually), the flip is a simple tail move plus schedule_work. It will make our life easier in the next patch. Signed-off-by:
-
Jiri Slaby authored
And use count from there. Signed-off-by:
-
Jiri Slaby authored
It is in termios cflags. So change the test in hvsi_recv_control to do the right thing. Previously it was actually testing TTY_LDISC_OPEN bit, i.e. whether an ldisc is active. And yes, it is most of the time. Signed-off-by:
-
Jiri Slaby authored
No refcounting, just a switch. The locking in the driver prevents races, so in fact the refcounting is not needed. But while we have a tty in tty_port, don't duplicate that and remove the one from hvcs_struct. Signed-off-by:
-
Jiri Slaby authored
A simple switch. Except we convert destroy_hvcs_struct to be tty_port_operations->destruct... Signed-off-by:
-
