summaryrefslogtreecommitdiff
path: root/drivers/tty
AgeCommit message (Collapse)Author
2019-02-14serial: 8250: enable Programmable THRE Interrupt for txHuibin Hong
Programmable THRE Interrupt mode in order to increase system performance. Change-Id: Ic1ef9ecae0c6feb00170ad97ee3c6245ca3bf068 Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>
2019-02-14serial: 8250: support rx dma mode onlyHuibin Hong
Most SOCS have only 8 or 6 channels, but have more than 16 peripherals. If those peripherals work together, some fails to request dma channel, because there are no enough channels. And maybe it's unnecessary to use dma for uart tx. It is necessary for uart rx when hardware auto flow control is not used. &uart0 { dma-names = "!tx", "rx"; // disable uart tx with dma status = "okay"; }; Change-Id: Ia74477514ba57300a4d19a5c2565ae7b5b8ab521 Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>
2019-01-16serial: 8250_dw: new baud rate and clk solutionHuibin Hong
baud rate <=1500000, except 1152000, use 24MHz baud rate > 1500000, and 1152000 use pll Change-Id: I9f52fcafdf8cc3d32be78f8408ab75873ffff680 Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>
2019-01-16serial: 8250_dw: uart wake upHuibin Hong
Add wakeup-source to uart dts node to enable uart wake up system when it receives data. Change-Id: If4e82a4d3dbaca708209553dc3693089864c782f Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>
2019-01-02serial: 8250: add /dev/ttySx when uart is enableHuibin Hong
before the patch: ls /dev/ttyS ttyS0 ttyS1 ttyS2 ttyS3 ttyS4 ttyS5 ttyS6 ttyS7 after the patch: ls /dev/ttyS ttyS3 ttyS4 ttyS6 Change-Id: I844523408751cb579bbfb50fafb7923d5c2cafdf Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>
2018-12-19Merge branch 'linux-linaro-lsk-v4.4-android' of ↵Tao Huang
git://git.linaro.org/kernel/linux-linaro-stable.git * linux-linaro-lsk-v4.4-android: (812 commits) Linux 4.4.167 mac80211: ignore NullFunc frames in the duplicate detection mac80211: fix reordering of buffered broadcast packets mac80211: ignore tx status for PS stations in ieee80211_tx_status_ext mac80211: Clear beacon_int in ieee80211_do_stop mac80211_hwsim: Timer should be initialized before device registered kgdboc: fix KASAN global-out-of-bounds bug in param_set_kgdboc_var() tty: serial: 8250_mtk: always resume the device in probe. cifs: Fix separator when building path from dentry Staging: lustre: remove two build warnings xhci: Prevent U1/U2 link pm states if exit latency is too long SUNRPC: Fix leak of krb5p encode pages virtio/s390: fix race in ccw_io_helper() virtio/s390: avoid race on vcdev->config ALSA: pcm: Fix interval evaluation with openmin/max ALSA: pcm: Call snd_pcm_unlink() conditionally at closing ALSA: pcm: Fix starvation on down_write_nonblock() ALSA: hda: Add support for AMD Stoney Ridge ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c USB: check usb_get_extra_descriptor for proper size ... Conflicts: drivers/gpu/drm/rockchip/rockchip_drm_drv.c drivers/usb/host/xhci-ring.c Change-Id: I4304b0875908403a7d88a0d77da52cea04563c11
2018-12-14Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-androidMark Brown
2018-12-13kgdboc: fix KASAN global-out-of-bounds bug in param_set_kgdboc_var()Macpaul Lin
commit dada6a43b0402eba438a17ac86fdc64ac56a4607 upstream. This patch is trying to fix KE issue due to "BUG: KASAN: global-out-of-bounds in param_set_kgdboc_var+0x194/0x198" reported by Syzkaller scan." [26364:syz-executor0][name:report8t]BUG: KASAN: global-out-of-bounds in param_set_kgdboc_var+0x194/0x198 [26364:syz-executor0][name:report&]Read of size 1 at addr ffffff900e44f95f by task syz-executor0/26364 [26364:syz-executor0][name:report&] [26364:syz-executor0]CPU: 7 PID: 26364 Comm: syz-executor0 Tainted: G W 0 [26364:syz-executor0]Call trace: [26364:syz-executor0][<ffffff9008095cf8>] dump_bacIctrace+Ox0/0x470 [26364:syz-executor0][<ffffff9008096de0>] show_stack+0x20/0x30 [26364:syz-executor0][<ffffff90089cc9c8>] dump_stack+Oxd8/0x128 [26364:syz-executor0][<ffffff90084edb38>] print_address_description +0x80/0x4a8 [26364:syz-executor0][<ffffff90084ee270>] kasan_report+Ox178/0x390 [26364:syz-executor0][<ffffff90084ee4a0>] _asan_report_loadi_noabort+Ox18/0x20 [26364:syz-executor0][<ffffff9008b092ac>] param_set_kgdboc_var+Ox194/0x198 [26364:syz-executor0][<ffffff900813af64>] param_attr_store+Ox14c/0x270 [26364:syz-executor0][<ffffff90081394c8>] module_attr_store+0x60/0x90 [26364:syz-executor0][<ffffff90086690c0>] sysfs_kl_write+Ox100/0x158 [26364:syz-executor0][<ffffff9008666d84>] kernfs_fop_write+0x27c/0x3a8 [26364:syz-executor0][<ffffff9008508264>] do_loop_readv_writev+0x114/0x1b0 [26364:syz-executor0][<ffffff9008509ac8>] do_readv_writev+0x4f8/0x5e0 [26364:syz-executor0][<ffffff9008509ce4>] vfs_writev+0x7c/Oxb8 [26364:syz-executor0][<ffffff900850ba64>] SyS_writev+Oxcc/0x208 [26364:syz-executor0][<ffffff90080883f0>] elO_svc_naked +0x24/0x28 [26364:syz-executor0][name:report&] [26364:syz-executor0][name:report&]The buggy address belongs to the variable: [26364:syz-executor0][name:report&] kgdb_tty_line+Ox3f/0x40 [26364:syz-executor0][name:report&] [26364:syz-executor0][name:report&]Memory state around the buggy address: [26364:syz-executor0] ffffff900e44f800: 00 00 00 00 00 04 fa fa fa fa fa fa 00 fa fa fa [26364:syz-executor0] ffffff900e44f880: fa fa fa fa 00 fa fa fa fa fa fa fa 00 fa fa fa [26364:syz-executor0]> ffffff900e44f900: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00 [26364:syz-executor0][name:report&] ^ [26364:syz-executor0] ffffff900e44f980: 00 fa fa fa fa fa fa fa 04 fa fa fa fa fa fa fa [26364:syz-executor0] ffffff900e44fa00: 04 fa fa fa fa fa fa fa 00 fa fa fa fa fa fa fa [26364:syz-executor0][name:report&] [26364:syz-executor0][name:panic&]Disabling lock debugging due to kernel taint [26364:syz-executor0]------------[cut here]------------ After checking the source code, we've found there might be an out-of-bounds access to "config[len - 1]" array when the variable "len" is zero. Signed-off-by: Macpaul Lin <macpaul@gmail.com> Acked-by: Daniel Thompson <daniel.thompson@linaro.org> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-12-13tty: serial: 8250_mtk: always resume the device in probe.Peter Shih
commit 100bc3e2bebf95506da57cbdf5f26b25f6da4c81 upstream. serial8250_register_8250_port calls uart_config_port, which calls config_port on the port before it tries to power on the port. So we need the port to be on before calling serial8250_register_8250_port. Change the code to always do a runtime resume in probe before registering port, and always do a runtime suspend in remove. This basically reverts the change in commit 68e5fc4a255a ("tty: serial: 8250_mtk: use pm_runtime callbacks for enabling"), but still use pm_runtime callbacks. Fixes: 68e5fc4a255a ("tty: serial: 8250_mtk: use pm_runtime callbacks for enabling") Signed-off-by: Peter Shih <pihsun@chromium.org> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-12-13kgdboc: Fix warning with module buildLaura Abbott
commit 1cd25cbb2fedbc777f3a8c3cb1ba69b645aeaa64 upstream. After 2dd453168643 ("kgdboc: Fix restrict error"), kgdboc_option_setup is now only used when built in, resulting in a warning when compiled as a module: drivers/tty/serial/kgdboc.c:134:12: warning: 'kgdboc_option_setup' defined but not used [-Wunused-function] static int kgdboc_option_setup(char *opt) ^~~~~~~~~~~~~~~~~~~ Move the function under the appropriate ifdef for builtin only. Fixes: 2dd453168643 ("kgdboc: Fix restrict error") Reported-by: Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by: Laura Abbott <labbott@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-12-13kgdboc: Fix restrict errorLaura Abbott
commit 2dd453168643d9475028cd867c57e65956a0f7f9 upstream. There's an error when compiled with restrict: drivers/tty/serial/kgdboc.c: In function ‘configure_kgdboc’: drivers/tty/serial/kgdboc.c:137:2: error: ‘strcpy’ source argument is the same as destination [-Werror=restrict] strcpy(config, opt); ^~~~~~~~~~~~~~~~~~~ As the error implies, this is from trying to use config as both source and destination. Drop the call to the function where config is the argument since nothing else happens in the function. Signed-off-by: Laura Abbott <labbott@redhat.com> Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-12-11Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-androidAmit Pundir
* linux-linaro-lsk-v4.4: (622 commits) Linux 4.4.166 drm/ast: Remove existing framebuffers before loading driver s390/mm: Check for valid vma before zapping in gmap_discard namei: allow restricted O_CREAT of FIFOs and regular files sched/core: Allow __sched_setscheduler() in interrupts when PI is not used btrfs: Ensure btrfs_trim_fs can trim the whole filesystem usb: xhci: fix uninitialized completion when USB3 port got wrong status tty: wipe buffer if not echoing data tty: wipe buffer. iwlwifi: mvm: fix regulatory domain update when the firmware starts scsi: qla2xxx: do not queue commands when unloading scsi: ufshcd: release resources if probe fails scsi: ufs: fix race between clock gating and devfreq scaling work scsi: ufshcd: Fix race between clk scaling and ungate work scsi: ufs: fix bugs related to null pointer access and array size netfilter: nf_tables: fix oops when inserting an element into a verdict map mwifiex: fix p2p device doesn't find in scan problem mwifiex: Fix NULL pointer dereference in skb_dequeue() cw1200: Don't leak memory if krealloc failes Input: xpad - add support for Xbox1 PDP Camo series gamepad ... Conflicts: Makefile arch/x86/Makefile drivers/base/power/main.c drivers/block/zram/zram_drv.c kernel/debug/kdb/kdb_io.c net/ipv6/route.c scripts/Kbuild.include Conflicts in above files are fixed as done in AOSP Change-Id: I5bd20327e0c1139c46f74e8d5916fa0530a307d3 ("Merge 4.4.165 into android-4.4"). arch/arm64/include/asm/cpufeature.h arch/arm64/kernel/cpufeature.c Conflicts in above files is due to AOSP Change-Id: I11cb874d12a7d0921f452c62b0752e0028a8e0a7 ("FROMLIST: arm64: entry: Add fake CPU feature for unmapping the kernel at EL0"), which needed a minor rebasing. Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
2018-12-01tty: wipe buffer if not echoing dataGreg Kroah-Hartman
commit b97b3d9fb57860a60592859e332de7759fd54c2e upstream. If we are not echoing the data to userspace or the console is in icanon mode, then perhaps it is a "secret" so we should wipe it once we are done with it. This mirrors the logic that the audit code has. Reported-by: aszlig <aszlig@nix.build> Tested-by: Milan Broz <gmazyland@gmail.com> Tested-by: Daniel Zatovic <daniel.zatovic@gmail.com> Tested-by: aszlig <aszlig@nix.build> Cc: Willy Tarreau <w@1wt.eu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-12-01tty: wipe buffer.Linus Torvalds
commit c9a8e5fce009e3c601a43c49ea9dbcb25d1ffac5 upstream. After we are done with the tty buffer, zero it out. Reported-by: aszlig <aszlig@nix.build> Tested-by: Milan Broz <gmazyland@gmail.com> Tested-by: Daniel Zatovic <daniel.zatovic@gmail.com> Tested-by: aszlig <aszlig@nix.build> Cc: Willy Tarreau <w@1wt.eu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-11-21termios, tty/tty_baudrate.c: fix buffer overrunH. Peter Anvin
commit 991a25194097006ec1e0d2e0814ff920e59e3465 upstream. On architectures with CBAUDEX == 0 (Alpha and PowerPC), the code in tty_baudrate.c does not do any limit checking on the tty_baudrate[] array, and in fact a buffer overrun is possible on both architectures. Add a limit check to prevent that situation. This will be followed by a much bigger cleanup/simplification patch. Signed-off-by: H. Peter Anvin (Intel) <hpa@zytor.com> Requested-by: Cc: Johan Hovold <johan@kernel.org> Cc: Jiri Slaby <jslaby@suse.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Richard Henderson <rth@twiddle.net> Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Cc: Matt Turner <mattst88@gmail.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Kate Stewart <kstewart@linuxfoundation.org> Cc: Philippe Ombredanne <pombredanne@nexb.com> Cc: Eugene Syromiatnikov <esyr@redhat.com> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-11-21sc16is7xx: Fix for multi-channel stallPhil Elwell
[ Upstream commit 8344498721059754e09d30fe255a12dab8fb03ef ] The SC16IS752 is a dual-channel device. The two channels are largely independent, but the IRQ signals are wired together as an open-drain, active low signal which will be driven low while either of the channels requires attention, which can be for significant periods of time until operations complete and the interrupt can be acknowledged. In that respect it is should be treated as a true level-sensitive IRQ. The kernel, however, needs to be able to exit interrupt context in order to use I2C or SPI to access the device registers (which may involve sleeping). Therefore the interrupt needs to be masked out or paused in some way. The usual way to manage sleeping from within an interrupt handler is to use a threaded interrupt handler - a regular interrupt routine does the minimum amount of work needed to triage the interrupt before waking the interrupt service thread. If the threaded IRQ is marked as IRQF_ONESHOT the kernel will automatically mask out the interrupt until the thread runs to completion. The sc16is7xx driver used to use a threaded IRQ, but a patch switched to using a kthread_worker in order to set realtime priorities on the handler thread and for other optimisations. The end result is non-threaded IRQ that schedules some work then returns IRQ_HANDLED, making the kernel think that all IRQ processing has completed. The work-around to prevent a constant stream of interrupts is to mark the interrupt as edge-sensitive rather than level-sensitive, but interpreting an active-low source as a falling-edge source requires care to prevent a total cessation of interrupts. Whereas an edge-triggering source will generate a new edge for every interrupt condition a level-triggering source will keep the signal at the interrupting level until it no longer requires attention; in other words, the host won't see another edge until all interrupt conditions are cleared. It is therefore vital that the interrupt handler does not exit with an outstanding interrupt condition, otherwise the kernel will not receive another interrupt unless some other operation causes the interrupt state on the device to be cleared. The existing sc16is7xx driver has a very simple interrupt "thread" (kthread_work job) that processes interrupts on each channel in turn until there are no more. If both channels are active and the first channel starts interrupting while the handler for the second channel is running then it will not be detected and an IRQ stall ensues. This could be handled easily if there was a shared IRQ status register, or a convenient way to determine if the IRQ had been deasserted for any length of time, but both appear to be lacking. Avoid this problem (or at least make it much less likely to happen) by reducing the granularity of per-channel interrupt processing to one condition per iteration, only exiting the overall loop when both channels are no longer interrupting. Signed-off-by: Phil Elwell <phil@raspberrypi.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-11-21tty: check name length in tty_find_polling_driver()Miles Chen
[ Upstream commit 33a1a7be198657c8ca26ad406c4d2a89b7162bcc ] The issue is found by a fuzzing test. If tty_find_polling_driver() recevies an incorrect input such as ',,' or '0b', the len becomes 0 and strncmp() always return 0. In this case, a null p->ops->poll_init() is called and it causes a kernel panic. Fix this by checking name length against zero in tty_find_polling_driver(). $echo ,, > /sys/module/kgdboc/parameters/kgdboc [ 20.804451] WARNING: CPU: 1 PID: 104 at drivers/tty/serial/serial_core.c:457 uart_get_baud_rate+0xe8/0x190 [ 20.804917] Modules linked in: [ 20.805317] CPU: 1 PID: 104 Comm: sh Not tainted 4.19.0-rc7ajb #8 [ 20.805469] Hardware name: linux,dummy-virt (DT) [ 20.805732] pstate: 20000005 (nzCv daif -PAN -UAO) [ 20.805895] pc : uart_get_baud_rate+0xe8/0x190 [ 20.806042] lr : uart_get_baud_rate+0xc0/0x190 [ 20.806476] sp : ffffffc06acff940 [ 20.806676] x29: ffffffc06acff940 x28: 0000000000002580 [ 20.806977] x27: 0000000000009600 x26: 0000000000009600 [ 20.807231] x25: ffffffc06acffad0 x24: 00000000ffffeff0 [ 20.807576] x23: 0000000000000001 x22: 0000000000000000 [ 20.807807] x21: 0000000000000001 x20: 0000000000000000 [ 20.808049] x19: ffffffc06acffac8 x18: 0000000000000000 [ 20.808277] x17: 0000000000000000 x16: 0000000000000000 [ 20.808520] x15: ffffffffffffffff x14: ffffffff00000000 [ 20.808757] x13: ffffffffffffffff x12: 0000000000000001 [ 20.809011] x11: 0101010101010101 x10: ffffff880d59ff5f [ 20.809292] x9 : ffffff880d59ff5e x8 : ffffffc06acffaf3 [ 20.809549] x7 : 0000000000000000 x6 : ffffff880d59ff5f [ 20.809803] x5 : 0000000080008001 x4 : 0000000000000003 [ 20.810056] x3 : ffffff900853e6b4 x2 : dfffff9000000000 [ 20.810693] x1 : ffffffc06acffad0 x0 : 0000000000000cb0 [ 20.811005] Call trace: [ 20.811214] uart_get_baud_rate+0xe8/0x190 [ 20.811479] serial8250_do_set_termios+0xe0/0x6f4 [ 20.811719] serial8250_set_termios+0x48/0x54 [ 20.811928] uart_set_options+0x138/0x1bc [ 20.812129] uart_poll_init+0x114/0x16c [ 20.812330] tty_find_polling_driver+0x158/0x200 [ 20.812545] configure_kgdboc+0xbc/0x1bc [ 20.812745] param_set_kgdboc_var+0xb8/0x150 [ 20.812960] param_attr_store+0xbc/0x150 [ 20.813160] module_attr_store+0x40/0x58 [ 20.813364] sysfs_kf_write+0x8c/0xa8 [ 20.813563] kernfs_fop_write+0x154/0x290 [ 20.813764] vfs_write+0xf0/0x278 [ 20.813951] __arm64_sys_write+0x84/0xf4 [ 20.814400] el0_svc_common+0xf4/0x1dc [ 20.814616] el0_svc_handler+0x98/0xbc [ 20.814804] el0_svc+0x8/0xc [ 20.822005] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 20.826913] Mem abort info: [ 20.827103] ESR = 0x84000006 [ 20.827352] Exception class = IABT (current EL), IL = 16 bits [ 20.827655] SET = 0, FnV = 0 [ 20.827855] EA = 0, S1PTW = 0 [ 20.828135] user pgtable: 4k pages, 39-bit VAs, pgdp = (____ptrval____) [ 20.828484] [0000000000000000] pgd=00000000aadee003, pud=00000000aadee003, pmd=0000000000000000 [ 20.829195] Internal error: Oops: 84000006 [#1] SMP [ 20.829564] Modules linked in: [ 20.829890] CPU: 1 PID: 104 Comm: sh Tainted: G W 4.19.0-rc7ajb #8 [ 20.830545] Hardware name: linux,dummy-virt (DT) [ 20.830829] pstate: 60000085 (nZCv daIf -PAN -UAO) [ 20.831174] pc : (null) [ 20.831457] lr : serial8250_do_set_termios+0x358/0x6f4 [ 20.831727] sp : ffffffc06acff9b0 [ 20.831936] x29: ffffffc06acff9b0 x28: ffffff9008d7c000 [ 20.832267] x27: ffffff900969e16f x26: 0000000000000000 [ 20.832589] x25: ffffff900969dfb0 x24: 0000000000000000 [ 20.832906] x23: ffffffc06acffad0 x22: ffffff900969e160 [ 20.833232] x21: 0000000000000000 x20: ffffffc06acffac8 [ 20.833559] x19: ffffff900969df90 x18: 0000000000000000 [ 20.833878] x17: 0000000000000000 x16: 0000000000000000 [ 20.834491] x15: ffffffffffffffff x14: ffffffff00000000 [ 20.834821] x13: ffffffffffffffff x12: 0000000000000001 [ 20.835143] x11: 0101010101010101 x10: ffffff880d59ff5f [ 20.835467] x9 : ffffff880d59ff5e x8 : ffffffc06acffaf3 [ 20.835790] x7 : 0000000000000000 x6 : ffffff880d59ff5f [ 20.836111] x5 : c06419717c314100 x4 : 0000000000000007 [ 20.836419] x3 : 0000000000000000 x2 : 0000000000000000 [ 20.836732] x1 : 0000000000000001 x0 : ffffff900969df90 [ 20.837100] Process sh (pid: 104, stack limit = 0x(____ptrval____)) [ 20.837396] Call trace: [ 20.837566] (null) [ 20.837816] serial8250_set_termios+0x48/0x54 [ 20.838089] uart_set_options+0x138/0x1bc [ 20.838570] uart_poll_init+0x114/0x16c [ 20.838834] tty_find_polling_driver+0x158/0x200 [ 20.839119] configure_kgdboc+0xbc/0x1bc [ 20.839380] param_set_kgdboc_var+0xb8/0x150 [ 20.839658] param_attr_store+0xbc/0x150 [ 20.839920] module_attr_store+0x40/0x58 [ 20.840183] sysfs_kf_write+0x8c/0xa8 [ 20.840183] sysfs_kf_write+0x8c/0xa8 [ 20.840440] kernfs_fop_write+0x154/0x290 [ 20.840702] vfs_write+0xf0/0x278 [ 20.840942] __arm64_sys_write+0x84/0xf4 [ 20.841209] el0_svc_common+0xf4/0x1dc [ 20.841471] el0_svc_handler+0x98/0xbc [ 20.841713] el0_svc+0x8/0xc [ 20.842057] Code: bad PC value [ 20.842764] ---[ end trace a8835d7de79aaadf ]--- [ 20.843134] Kernel panic - not syncing: Fatal exception [ 20.843515] SMP: stopping secondary CPUs [ 20.844289] Kernel Offset: disabled [ 20.844634] CPU features: 0x0,21806002 [ 20.844857] Memory Limit: none [ 20.845172] ---[ end Kernel panic - not syncing: Fatal exception ]--- Signed-off-by: Miles Chen <miles.chen@mediatek.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-11-21kgdboc: Passing ekgdboc to command line causes panicHe Zhe
commit 1bd54d851f50dea6af30c3e6ff4f3e9aab5558f9 upstream. kgdboc_option_setup does not check input argument before passing it to strlen. The argument would be a NULL pointer if "ekgdboc", without its value, is set in command line and thus cause the following panic. PANIC: early exception 0xe3 IP 10:ffffffff8fbbb620 error 0 cr2 0x0 [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 4.18-rc8+ #1 [ 0.000000] RIP: 0010:strlen+0x0/0x20 ... [ 0.000000] Call Trace [ 0.000000] ? kgdboc_option_setup+0x9/0xa0 [ 0.000000] ? kgdboc_early_init+0x6/0x1b [ 0.000000] ? do_early_param+0x4d/0x82 [ 0.000000] ? parse_args+0x212/0x330 [ 0.000000] ? rdinit_setup+0x26/0x26 [ 0.000000] ? parse_early_options+0x20/0x23 [ 0.000000] ? rdinit_setup+0x26/0x26 [ 0.000000] ? parse_early_param+0x2d/0x39 [ 0.000000] ? setup_arch+0x2f7/0xbf4 [ 0.000000] ? start_kernel+0x5e/0x4c2 [ 0.000000] ? load_ucode_bsp+0x113/0x12f [ 0.000000] ? secondary_startup_64+0xa5/0xb0 This patch adds a check to prevent the panic. Cc: stable@vger.kernel.org Cc: jason.wessel@windriver.com Cc: gregkh@linuxfoundation.org Cc: jslaby@suse.com Signed-off-by: He Zhe <zhe.he@windriver.com> Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-11-10tty: serial: sprd: fix error return code in sprd_probe()Gustavo A. R. Silva
[ Upstream commit ec085c5a51b768947ca481f90b66653e36b3c566 ] platform_get_irq() returns an error code, but the sprd_serial driver ignores it and always returns -ENODEV. This is not correct and, prevents -EPROBE_DEFER from being propagated properly. Also, notice that platform_get_irq() no longer returns 0 on error: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e330b9a6bb35dc7097a4f02cb1ae7b6f96df92af Print and propagate the return value of platform_get_irq on failure. This issue was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-10-10Merge branch 'linux-linaro-lsk-v4.4-android' of ↵Tao Huang
git://git.linaro.org/kernel/linux-linaro-stable.git * linux-linaro-lsk-v4.4-android: (1212 commits) ANDROID: sdcardfs: Change current->fs under lock ANDROID: sdcardfs: Don't use OVERRIDE_CRED macro ANDROID: restrict store of prefer_idle as boolean BACKPORT: arm/syscalls: Optimize address limit check UPSTREAM: syscalls: Use CHECK_DATA_CORRUPTION for addr_limit_user_check BACKPORT: arm64/syscalls: Check address limit on user-mode return BACKPORT: x86/syscalls: Check address limit on user-mode return BACKPORT: lkdtm: add bad USER_DS test UPSTREAM: bug: switch data corruption check to __must_check BACKPORT: lkdtm: Add tests for struct list corruption UPSTREAM: bug: Provide toggle for BUG on data corruption UPSTREAM: list: Split list_del() debug checking into separate function UPSTREAM: rculist: Consolidate DEBUG_LIST for list_add_rcu() BACKPORT: list: Split list_add() debug checking into separate function FROMLIST: ANDROID: binder: Add BINDER_GET_NODE_INFO_FOR_REF ioctl. BACKPORT: arm64/vdso: Fix nsec handling for CLOCK_MONOTONIC_RAW ANDROID: arm64: mm: fix 4.4.154 merge BACKPORT: zsmalloc: introduce zs_huge_class_size() BACKPORT: zram: drop max_zpage_size and use zs_huge_class_size() ANDROID: tracing: fix race condition reading saved tgids ... Change-Id: I9f23db35eb926b6fa0d7af7dbbb55c9a37d536fc
2018-10-10serial: imx: restore handshaking irq for imx1Uwe Kleine-König
commit 7e620984b62532783912312e334f3c48cdacbd5d upstream. Back in 2015 when irda was dropped from the driver imx1 was broken. This change reintroduces the support for the third interrupt of the UART. Fixes: afe9cbb1a6ad ("serial: imx: drop support for IRDA") Cc: stable <stable@vger.kernel.org> Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Reviewed-by: Leonard Crestez <leonard.crestez@nxp.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-10serial: cpm_uart: return immediately from console pollChristophe Leroy
commit be28c1e3ca29887e207f0cbcd294cefe5074bab6 upstream. kgdb expects poll function to return immediately and returning NO_POLL_CHAR when no character is available. Fixes: f5316b4aea024 ("kgdb,8250,pl011: Return immediately from console poll") Cc: Jason Wessel <jason.wessel@windriver.com> Cc: <stable@vger.kernel.org> Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-10drivers/tty: add error handling for pcmcia_loop_configZhouyang Jia
[ Upstream commit 85c634e919bd6ef17427f26a52920aeba12e16ee ] When pcmcia_loop_config fails, the lack of error-handling code may cause unexpected results. This patch adds error-handling code after calling pcmcia_loop_config. Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-03Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-androidAmit Pundir
* linux-linaro-lsk-v4.4: (783 commits) Linux 4.4.159 iw_cxgb4: only allow 1 flush on user qps HID: sony: Support DS4 dongle HID: sony: Update device ids arm64: Add trace_hardirqs_off annotation in ret_to_user ext4: don't mark mmp buffer head dirty ext4: fix online resizing for bigalloc file systems with a 1k block size ext4: fix online resize's handling of a too-small final block group ext4: recalucate superblock checksum after updating free blocks/inodes ext4: avoid divide by zero fault when deleting corrupted inline directories tty: vt_ioctl: fix potential Spectre v1 drm/nouveau/drm/nouveau: Use pm_runtime_get_noresume() in connector_detect() ocfs2: fix ocfs2 read block panic scsi: target: iscsi: Use hex2bin instead of a re-implementation neighbour: confirm neigh entries when ARP packet is received net: hp100: fix always-true check for link up state net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT ipv6: fix possible use-after-free in ip6_xmit() gso_segment: Reset skb->mac_len after modifying network header mm: shmem.c: Correctly annotate new inodes for lockdep ... Conflicts: Makefile fs/squashfs/block.c include/uapi/linux/prctl.h kernel/fork.c kernel/sys.c Trivial merge conflicts in above files. Resolved by rebasing corresponding AOSP changes. arch/arm64/mm/init.c Pick the changes from upstream version of AOSP patch "arm64: check for upper PAGE_SHIFT bits in pfn_valid" instead. Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
2018-09-29tty: vt_ioctl: fix potential Spectre v1Gustavo A. R. Silva
commit e97267cb4d1ee01ca0929638ec0fcbb0904f903d upstream. vsa.console is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: drivers/tty/vt/vt_ioctl.c:711 vt_ioctl() warn: potential spectre issue 'vc_cons' [r] Fix this by sanitizing vsa.console before using it to index vc_cons Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Reviewed-by: Alan Cox <alan@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-09-27serial: 8250: add line error logHuibin Hong
Change-Id: I69fe6f0c0857ade25e777be388fcab6261f1a533 Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>
2018-09-27serial: 8250: fix cpu and dmac access uart fifo at the same timeHuibin Hong
If cpu frequency was 1.0 GHz, bluetooth music is unstable. But it is stable when cpu frequency is 400 MHz. Although I had test the uart dma driver many days on rk3088, maybe the cpu frequency was low, and I couldn't produce the issue. In one word, the code is unlogical. The new logic is that increase the fifo water level, if dmac bursts before it, wait until dmac finishes and read the rest data. If dmac doesn't burst after it, then read data from fifo directly. Change-Id: I6fec42a0895df8a0faeba97d05fd36b761744fa2 Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>
2018-09-19tty: rocket: Fix possible buffer overwrite on register_PCIAnton Vasilyev
[ Upstream commit 0419056ec8fd01ddf5460d2dba0491aad22657dd ] If number of isa and pci boards exceed NUM_BOARDS on the path rp_init()->init_PCI()->register_PCI() then buffer overwrite occurs in register_PCI() on assign rcktpt_io_addr[i]. The patch adds check on upper bound for index of registered board in register_PCI. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-09-07Merge branch 'linux-linaro-lsk-v4.4' of ↵Tao Huang
git://git.linaro.org/kernel/linux-linaro-stable.git * linux-linaro-lsk-v4.4: (519 commits) Linux 4.4.154 cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status iscsi target: fix session creation failure handling scsi: core: Avoid that SCSI device removal through sysfs triggers a deadlock scsi: sysfs: Introduce sysfs_{un,}break_active_protection() MIPS: lib: Provide MIPS64r6 __multi3() for GCC < 7 MIPS: Correct the 64-bit DSP accumulator register size kprobes: Make list and blacklist root user read only s390/pci: fix out of bounds access during irq setup s390/qdio: reset old sbal_state flags s390: fix br_r1_trampoline for machines without exrl x86/spectre: Add missing family 6 check to microcode check x86/irqflags: Mark native_restore_fl extern inline pinctrl: freescale: off by one in imx1_pinconf_group_dbg_show() ASoC: sirf: Fix potential NULL pointer dereference ASoC: dpcm: don't merge format from invalid codec dai udl-kms: fix crash due to uninitialized memory udl-kms: handle allocation failure udl-kms: change down_interruptible to down fuse: Add missed unlock_page() to fuse_readpages_fill() ... Conflicts: Makefile arch/arm64/mm/init.c fs/squashfs/block.c include/uapi/linux/prctl.h kernel/sys.c Change-Id: Ie03b5adfbbb4ab2bf16bc55d99f0d8a9c540a53b
2018-08-22serial: 8250_dw: always set baud rate in dw8250_set_termiosChen Hu
commit dfcab6ba573445c703235ab6c83758eec12d7f28 upstream. dw8250_set_termios() doesn't set baud rate if the arg "old ktermios" is NULL. This happens during resume. Call Trace: ... [ 54.928108] dw8250_set_termios+0x162/0x170 [ 54.928114] serial8250_set_termios+0x17/0x20 [ 54.928117] uart_change_speed+0x64/0x160 [ 54.928119] uart_resume_port ... So the baud rate is not restored after S3 and breaks the apps who use UART, for example, console and bluetooth etc. We address this issue by setting the baud rate irrespective of arg "old", just like the drivers for other 8250 IPs. This is tested with Intel Broxton platform. Signed-off-by: Chen Hu <hu1.chen@intel.com> Fixes: 4e26b134bd17 ("serial: 8250_dw: clock rate handling for all ACPI platforms") Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com> Cc: stable <stable@vger.kernel.org> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-06tty: Fix data race in tty_insert_flip_string_fixed_flagDaeRyong Jeong
[ Upstream commit b6da31b2c07c46f2dcad1d86caa835227a16d9ff ] Unlike normal serials, in pty layer, there is no guarantee that multiple threads don't insert input characters at the same time. If it is happened, tty_insert_flip_string_fixed_flag can be executed concurrently. This can lead slab out-of-bounds write in tty_insert_flip_string_fixed_flag. Call sequences are as follows. CPU0 CPU1 n_tty_ioctl_helper n_tty_ioctl_helper __start_tty tty_send_xchar tty_wakeup pty_write n_hdlc_tty_wakeup tty_insert_flip_string n_hdlc_send_frames tty_insert_flip_string_fixed_flag pty_write tty_insert_flip_string tty_insert_flip_string_fixed_flag To fix the race, acquire port->lock in pty_write() before it inserts input characters to tty buffer. It prevents multiple threads from inserting input characters concurrently. The crash log is as follows: BUG: KASAN: slab-out-of-bounds in tty_insert_flip_string_fixed_flag+0xb5/ 0x130 drivers/tty/tty_buffer.c:316 at addr ffff880114fcc121 Write of size 1792 by task syz-executor0/30017 CPU: 1 PID: 30017 Comm: syz-executor0 Not tainted 4.8.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014 0000000000000000 ffff88011638f888 ffffffff81694cc3 ffff88007d802140 ffff880114fcb300 ffff880114fcc300 ffff880114fcb300 ffff88011638f8b0 ffffffff8130075c ffff88011638f940 ffff88007d802140 ffff880194fcc121 Call Trace: __dump_stack lib/dump_stack.c:15 [inline] dump_stack+0xb3/0x110 lib/dump_stack.c:51 kasan_object_err+0x1c/0x70 mm/kasan/report.c:156 print_address_description mm/kasan/report.c:194 [inline] kasan_report_error+0x1f7/0x4e0 mm/kasan/report.c:283 kasan_report+0x36/0x40 mm/kasan/report.c:303 check_memory_region_inline mm/kasan/kasan.c:292 [inline] check_memory_region+0x13e/0x1a0 mm/kasan/kasan.c:299 memcpy+0x37/0x50 mm/kasan/kasan.c:335 tty_insert_flip_string_fixed_flag+0xb5/0x130 drivers/tty/tty_buffer.c:316 tty_insert_flip_string include/linux/tty_flip.h:35 [inline] pty_write+0x7f/0xc0 drivers/tty/pty.c:115 n_hdlc_send_frames+0x1d4/0x3b0 drivers/tty/n_hdlc.c:419 n_hdlc_tty_wakeup+0x73/0xa0 drivers/tty/n_hdlc.c:496 tty_wakeup+0x92/0xb0 drivers/tty/tty_io.c:601 __start_tty.part.26+0x66/0x70 drivers/tty/tty_io.c:1018 __start_tty+0x34/0x40 drivers/tty/tty_io.c:1013 n_tty_ioctl_helper+0x146/0x1e0 drivers/tty/tty_ioctl.c:1138 n_hdlc_tty_ioctl+0xb3/0x2b0 drivers/tty/n_hdlc.c:794 tty_ioctl+0xa85/0x16d0 drivers/tty/tty_io.c:2992 vfs_ioctl fs/ioctl.c:43 [inline] do_vfs_ioctl+0x13e/0xba0 fs/ioctl.c:679 SYSC_ioctl fs/ioctl.c:694 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685 entry_SYSCALL_64_fastpath+0x1f/0xbd Signed-off-by: DaeRyong Jeong <threeearcat@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-06hvc_opal: don't set tb_ticks_per_usec in udbg_init_opal_common()Stewart Smith
[ Upstream commit 447808bf500a7cc92173266a59f8a494e132b122 ] time_init() will set up tb_ticks_per_usec based on reality. time_init() is called *after* udbg_init_opal_common() during boot. from arch/powerpc/kernel/time.c: unsigned long tb_ticks_per_usec = 100; /* sane default */ Currently, all powernv systems have a timebase frequency of 512mhz (512000000/1000000 == 0x200) - although there's nothing written down anywhere that I can find saying that we couldn't make that different based on the requirements in the ISA. So, we've been (accidentally) thwacking the (currently) correct (for powernv at least) value for tb_ticks_per_usec earlier than we otherwise would have. The "sane default" seems to be adequate for our purposes between udbg_init_opal_common() and time_init() being called, and if it isn't, then we should probably be setting it somewhere that isn't hvc_opal.c! Signed-off-by: Stewart Smith <stewart@linux.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-08-03Merge tag 'lsk-v4.4-18.07-android' of ↵Tao Huang
git://git.linaro.org/kernel/linux-linaro-stable.git LSK 18.07 v4.4-android * tag 'lsk-v4.4-18.07-android': (254 commits) Linux 4.4.143 net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL. rds: avoid unenecessary cong_update in loop transport KEYS: DNS: fix parsing multiple options netfilter: ebtables: reject non-bridge targets MIPS: Use async IPIs for arch_trigger_cpumask_backtrace() MIPS: Call dump_stack() from show_regs() rtlwifi: rtl8821ae: fix firmware is not ready to run net: cxgb3_main: fix potential Spectre v1 net/mlx5: Fix command interface race in polling mode net_sched: blackhole: tell upper qdisc about dropped packets vhost_net: validate sock before trying to put its fd tcp: prevent bogus FRTO undos with non-SACK flows tcp: fix Fast Open key endianness r8152: napi hangup fix after disconnect qed: Limit msix vectors in kdump kernel to the minimum required count. net: sungem: fix rx checksum support net/mlx5: Fix incorrect raw command length parsing net: dccp: switch rx_tstamp_last_feedback to monotonic clock net: dccp: avoid crash in ccid3_hc_rx_send_feedback() ... Fix wrong merge of include/linux/compiler-gcc.h Change-Id: I1daae1251069d2791d2e29b65942d086fb8ad0ac
2018-07-16serial: 8250_dw: lost one byte sometime when receiveHuibin Hong
To avoid "too much work for irq" issue, cherry pick the the patch. It reads the RBR to clear the time out interrupt, but sometime the rx fifo may be not empty while cpu reads the RBR. Which would cause the data lost. patch for "too much work":06451e93ab59e5b1843c29cbb468a274f4919563 By the way, current patch can't get rid of the risk entirely, so I try a lot to solve it. Unfortunately, I only got the phenomenon that lower pclk can reduce the probability. And I check the dw data sheet, it has pclk and sclk, so there is synchronization problem. But it only requires (slck < 4*pclk). Change-Id: I01a36c689b43310294c45294abcf4982f5ddf2af Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>
2018-07-13Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-androidMark Brown
2018-07-11n_tty: Access echo_* variables carefully.Tetsuo Handa
commit ebec3f8f5271139df618ebdf8427e24ba102ba94 upstream. syzbot is reporting stalls at __process_echoes() [1]. This is because since ldata->echo_commit < ldata->echo_tail becomes true for some reason, the discard loop is serving as almost infinite loop. This patch tries to avoid falling into ldata->echo_commit < ldata->echo_tail situation by making access to echo_* variables more carefully. Since reset_buffer_flags() is called without output_lock held, it should not touch echo_* variables. And omit a call to reset_buffer_flags() from n_tty_open() by using vzalloc(). Since add_echo_byte() is called without output_lock held, it needs memory barrier between storing into echo_buf[] and incrementing echo_head counter. echo_buf() needs corresponding memory barrier before reading echo_buf[]. Lack of handling the possibility of not-yet-stored multi-byte operation might be the reason of falling into ldata->echo_commit < ldata->echo_tail situation, for if I do WARN_ON(ldata->echo_commit == tail + 1) prior to echo_buf(ldata, tail + 1), the WARN_ON() fires. Also, explicitly masking with buffer for the former "while" loop, and use ldata->echo_commit > tail for the latter "while" loop. [1] https://syzkaller.appspot.com/bug?id=17f23b094cd80df750e5b0f8982c521ee6bcbf40 Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Reported-by: syzbot <syzbot+108696293d7a21ab688f@syzkaller.appspotmail.com> Cc: Peter Hurley <peter@hurleysoftware.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-11n_tty: Fix stall at n_tty_receive_char_special().Tetsuo Handa
commit 3d63b7e4ae0dc5e02d28ddd2fa1f945defc68d81 upstream. syzbot is reporting stalls at n_tty_receive_char_special() [1]. This is because comparison is not working as expected since ldata->read_head can change at any moment. Mitigate this by explicitly masking with buffer size when checking condition for "while" loops. [1] https://syzkaller.appspot.com/bug?id=3d7481a346958d9469bebbeb0537d5f056bdd6e8 Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Reported-by: syzbot <syzbot+18df353d7540aa6b5467@syzkaller.appspotmail.com> Fixes: bc5a5e3f45d04784 ("n_tty: Don't wrap input buffer indices at buffer size") Cc: stable <stable@vger.kernel.org> Cc: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-10UPSTREAM: tty: fix data race between tty_init_dev and flush of bufGaurav Kohli
There can be a race, if receive_buf call comes before tty initialization completes in n_tty_open and tty->disc_data may be NULL. CPU0 CPU1 ---- ---- 000|n_tty_receive_buf_common() n_tty_open() -001|n_tty_receive_buf2() tty_ldisc_open.isra.3() -002|tty_ldisc_receive_buf(inline) tty_ldisc_setup() Using ldisc semaphore lock in tty_init_dev till disc_data initializes completely. Reviewed-by: Alan Cox <alan@linux.intel.com> Cc: stable <stable@vger.kernel.org> Change-Id: I3ba3cbd7dcb867a110878c8d0c47e6b920edd0b9 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Gaurav Kohli <gkohli@codeaurora.org> (cherry-picked from commit b027e2298bd588d6fa36ed2eda97447fb3eac078)
2018-07-06Merge tag 'lsk-v4.4-18.06-android' of ↵Tao Huang
git://git.linaro.org/kernel/linux-linaro-stable.git LSK 18.06 v4.4-android * tag 'lsk-v4.4-18.06-android': (464 commits) Linux 4.4.138 crypto: vmx - Remove overly verbose printk from AES init routines Input: elan_i2c - add ELAN0612 (Lenovo v330 14IKB) ACPI ID Input: goodix - add new ACPI id for GPD Win 2 touch screen kvm: x86: use correct privilege level for sgdt/sidt/fxsave/fxrstor access vmw_balloon: fixing double free when batching mode is off serial: samsung: fix maxburst parameter for DMA transactions KVM: x86: pass kvm_vcpu to kvm_read_guest_virt and kvm_write_guest_virt_system KVM: x86: introduce linear_{read,write}_system Clarify (and fix) MAX_LFS_FILESIZE macros gpio: No NULL owner x86/crypto, x86/fpu: Remove X86_FEATURE_EAGER_FPU #ifdef from the crc32c code af_key: Always verify length of provided sadb_key x86/fpu: Fix math emulation in eager fpu mode x86/fpu: Fix FNSAVE usage in eagerfpu mode x86/fpu: Hard-disable lazy FPU mode x86/fpu: Fix eager-FPU handling on legacy FPU machines x86/fpu: Revert ("x86/fpu: Disable AVX when eagerfpu is off") x86/fpu: Fix 'no387' regression x86/fpu: Default eagerfpu=on on all CPUs ... Conflicts: drivers/clk/clk.c drivers/clk/rockchip/clk-mmc-phase.c sound/core/timer.c Change-Id: I52af7906676f3e4426292481ec36a9a63ee7ecc9
2018-07-05Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-androidMark Brown
2018-07-03serial: sh-sci: Use spin_{try}lock_irqsave instead of open coding versionDaniel Wagner
commit 8afb1d2c12163f77777f84616a8e9444d0050ebe upstream. Commit 40f70c03e33a ("serial: sh-sci: add locking to console write function to avoid SMP lockup") copied the strategy to avoid locking problems in conjuncture with the console from the UART8250 driver. Instead using directly spin_{try}lock_irqsave(), local_irq_save() followed by spin_{try}lock() was used. While this is correct on mainline, for -rt it is a problem. spin_{try}lock() will check if it is running in a valid context. Since the local_irq_save() has already been executed, the context has changed and spin_{try}lock() will complain. The reason why spin_{try}lock() complains is that on -rt the spin locks are turned into mutexes and therefore can sleep. Sleeping with interrupts disabled is not valid. BUG: sleeping function called from invalid context at /home/wagi/work/rt/v4.4-cip-rt/kernel/locking/rtmutex.c:995 in_atomic(): 0, irqs_disabled(): 128, pid: 778, name: irq/76-eth0 CPU: 0 PID: 778 Comm: irq/76-eth0 Not tainted 4.4.126-test-cip22-rt14-00403-gcd03665c8318 #12 Hardware name: Generic RZ/G1 (Flattened Device Tree) Backtrace: [<c00140a0>] (dump_backtrace) from [<c001424c>] (show_stack+0x18/0x1c) r7:c06b01f0 r6:60010193 r5:00000000 r4:c06b01f0 [<c0014234>] (show_stack) from [<c01d3c94>] (dump_stack+0x78/0x94) [<c01d3c1c>] (dump_stack) from [<c004c134>] (___might_sleep+0x134/0x194) r7:60010113 r6:c06d3559 r5:00000000 r4:ffffe000 [<c004c000>] (___might_sleep) from [<c04ded60>] (rt_spin_lock+0x20/0x74) r5:c06f4d60 r4:c06f4d60 [<c04ded40>] (rt_spin_lock) from [<c02577e4>] (serial_console_write+0x100/0x118) r5:c06f4d60 r4:c06f4d60 [<c02576e4>] (serial_console_write) from [<c0061060>] (call_console_drivers.constprop.15+0x10c/0x124) r10:c06d2894 r9:c04e18b0 r8:00000028 r7:00000000 r6:c06d3559 r5:c06d2798 r4:c06b9914 r3:c02576e4 [<c0060f54>] (call_console_drivers.constprop.15) from [<c0062984>] (console_unlock+0x32c/0x430) r10:c06d30d8 r9:00000028 r8:c06dd518 r7:00000005 r6:00000000 r5:c06d2798 r4:c06d2798 r3:00000028 [<c0062658>] (console_unlock) from [<c0062e1c>] (vprintk_emit+0x394/0x4f0) r10:c06d2798 r9:c06d30ee r8:00000006 r7:00000005 r6:c06a78fc r5:00000027 r4:00000003 [<c0062a88>] (vprintk_emit) from [<c0062fa0>] (vprintk+0x28/0x30) r10:c060bd46 r9:00001000 r8:c06b9a90 r7:c06b9a90 r6:c06b994c r5:c06b9a3c r4:c0062fa8 [<c0062f78>] (vprintk) from [<c0062fb8>] (vprintk_default+0x10/0x14) [<c0062fa8>] (vprintk_default) from [<c009cd30>] (printk+0x78/0x84) [<c009ccbc>] (printk) from [<c025afdc>] (credit_entropy_bits+0x17c/0x2cc) r3:00000001 r2:decade60 r1:c061a5ee r0:c061a523 r4:00000006 [<c025ae60>] (credit_entropy_bits) from [<c025bf74>] (add_interrupt_randomness+0x160/0x178) r10:466e7196 r9:1f536000 r8:fffeef74 r7:00000000 r6:c06b9a60 r5:c06b9a3c r4:dfbcf680 [<c025be14>] (add_interrupt_randomness) from [<c006536c>] (irq_thread+0x1e8/0x248) r10:c006537c r9:c06cdf21 r8:c0064fcc r7:df791c24 r6:df791c00 r5:ffffe000 r4:df525180 [<c0065184>] (irq_thread) from [<c003fba4>] (kthread+0x108/0x11c) r10:00000000 r9:00000000 r8:c0065184 r7:df791c00 r6:00000000 r5:df791d00 r4:decac000 [<c003fa9c>] (kthread) from [<c00101b8>] (ret_from_fork+0x14/0x3c) r8:00000000 r7:00000000 r6:00000000 r5:c003fa9c r4:df791d00 Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Daniel Wagner <daniel.wagner@siemens.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> [dw: Backported to 4.4.] Signed-off-by: Daniel Wagner <daniel.wagner@siemens.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-27serial: 8250: reset uart when set baud rateHuibin Hong
If external device sends data continuously, then uart is always busy, and baud rate can't be set. It is useful to reset uart and set loop back mode to make sure it is idle. Change-Id: I87286711870ff685ea29e36e61c97d45be5a6d08 Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>
2018-06-19Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-androidMark Brown
2018-06-16serial: samsung: fix maxburst parameter for DMA transactionsMarek Szyprowski
commit aa2f80e752c75e593b3820f42c416ed9458fa73e upstream. The best granularity of residue that DMA engine can report is in the BURST units, so the serial driver must use MAXBURST = 1 and DMA_SLAVE_BUSWIDTH_1_BYTE if it relies on exact number of bytes transferred by DMA engine. Fixes: 62c37eedb74c ("serial: samsung: add dma reqest/release functions") Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Acked-by: Krzysztof Kozlowski <krzk@kernel.org> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-06-11Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-androidAmit Pundir
* linux-linaro-lsk-v4.4: (361 commits) Linux 4.4.135 Revert "vti4: Don't override MTU passed on link creation via IFLA_MTU" Linux 4.4.134 s390/ftrace: use expoline for indirect branches kdb: make "mdr" command repeat Bluetooth: btusb: Add device ID for RTL8822BE ASoC: samsung: i2s: Ensure the RCLK rate is properly determined regulator: of: Add a missing 'of_node_put()' in an error handling path of 'of_regulator_match()' scsi: lpfc: Fix frequency of Release WQE CQEs scsi: lpfc: Fix soft lockup in lpfc worker thread during LIP testing scsi: lpfc: Fix issue_lip if link is disabled netlabel: If PF_INET6, check sk_buff ip header version selftests/net: fixes psock_fanout eBPF test case perf report: Fix memory corruption in --branch-history mode --branch-history perf tests: Use arch__compare_symbol_names to compare symbols x86/apic: Set up through-local-APIC mode on the boot CPU if 'noapic' specified drm/rockchip: Respect page offset for PRIME mmap calls MIPS: Octeon: Fix logging messages with spurious periods after newlines audit: return on memory error to avoid null pointer dereference crypto: sunxi-ss - Add MODULE_ALIAS to sun4i-ss ... Conflicts: arch/arm64/include/asm/assembler.h Rebase LTS commit 348f043ab6c6 ("arm64: Add work around for Arm Cortex-A55 Erratum 1024718"). fs/f2fs/namei.c Rebase LTS commit 03bb7588942a ("do d_instantiate/unlock_new_inode combinations safely") fs/proc/base.c Trivial typo. kernel/auditsc.c Rebase LTS commit 9bb698bedebf ("audit: move calcs after alloc and check when logging set loginuid"). kernel/time/timekeeping.c Rebase changes from AOSP commit 28850c79d071 ("BACKPORT: time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting"), and 1d35c0438678 ("BACKPORT: time: Clean up CLOCK_MONOTONIC_RAW time handling"). Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
2018-06-04Merge tag 'lsk-v4.4-18.05-android' of ↵Tao Huang
git://git.linaro.org/kernel/linux-linaro-stable.git LSK 18.05 v4.4-android * tag 'lsk-v4.4-18.05-android': (605 commits) ANDROID: sdcardfs: Don't d_drop in d_revalidate goldfish: pipe: ANDROID: mark local functions static UPSTREAM: ANDROID: binder: prevent transactions into own process. goldfish: pipe: ANDROID: Add DMA support UPSTREAM: f2fs: clear PageError on writepage - part 2 UPSTREAM: f2fs: avoid fsync() failure caused by EAGAIN in writepage() ANDROID: x86_64_cuttlefish_defconfig: Disable KPTI UPSTREAM: mac80211: ibss: Fix channel type enum in ieee80211_sta_join_ibss() UPSTREAM: mac80211: Fix clang warning about constant operand in logical operation UPSTREAM: nl80211: Fix enum type of variable in nl80211_put_sta_rate() UPSTREAM: sysfs: remove signedness from sysfs_get_dirent UPSTREAM: tracing: Use cpumask_available() to check if cpumask variable may be used BACKPORT: clocksource: Use GENMASK_ULL in definition of CLOCKSOURCE_MASK UPSTREAM: netpoll: Fix device name check in netpoll_setup() FROMLIST: staging: Fix sparse warnings in vsoc driver. FROMLIST: staging: vsoc: Fix a i386-randconfig warning. FROMLIST: staging: vsoc: Create wc kernel mapping for region shm. goldfish: pipe: ANDROID: Replace writel with gf_write_ptr goldfish: pipe: ANDROID: Use dev_ logging instead of pr_ goldfish: pipe: ANDROID: fix checkpatch warnings ... Conflicts: fs/f2fs/node.c scripts/Makefile.lib Change-Id: Ib92d11938a383464249fe6f2dad3ab2a05bc4770
2018-05-30serial: arc_uart: Fix out-of-bounds access through DT aliasGeert Uytterhoeven
[ Upstream commit f9f5786987e81d166c60833edcb7d1836aa16944 ] The arc_uart_ports[] array is indexed using a value derived from the "serialN" alias in DT, which may lead to an out-of-bounds access. Fix this by adding a range check. Note that the array size is defined by a Kconfig symbol (CONFIG_SERIAL_ARC_NR_PORTS), so this can even be triggered using a legitimate DTB. Fixes: ea28fd56fcde69af ("serial/arc-uart: switch to devicetree based probing") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-30serial: fsl_lpuart: Fix out-of-bounds access through DT aliasGeert Uytterhoeven
[ Upstream commit ffab87fdecc655cc676f8be8dd1a2c5e22bd6d47 ] The lpuart_ports[] array is indexed using a value derived from the "serialN" alias in DT, which may lead to an out-of-bounds access. Fix this by adding a range check. Fixes: c9e2e946fb0ba5d2 ("tty: serial: add Freescale lpuart driver support") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-30serial: imx: Fix out-of-bounds access through serial port indexGeert Uytterhoeven
[ Upstream commit 5673444821406dda5fc25e4b52aca419f8065a19 ] The imx_ports[] array is indexed using a value derived from the "serialN" alias in DT, or from platform data, which may lead to an out-of-bounds access. Fix this by adding a range check. Fixes: ff05967a07225ab6 ("serial/imx: add of_alias_get_id() reference back") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-30serial: mxs-auart: Fix out-of-bounds access through serial port indexGeert Uytterhoeven
[ Upstream commit dd345a31bfdec350d2593e6de5964e55c7f19c76 ] The auart_port[] array is indexed using a value derived from the "serialN" alias in DT, or from platform data, which may lead to an out-of-bounds access. Fix this by adding a range check. Fixes: 1ea6607d4cdc9179 ("serial: mxs-auart: Allow device tree probing") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-22 15:51:11 +0000