Eric Lee / smarc-fsl-linux-kernel

01 Aug, 2019

1 commit

  • b36a1552d   Bluetooth: hci_uart: check for missing tty operations ... Browse Code »

    Certain ttys operations (pty_unix98_ops) lack tiocmget() and tiocmset()
    functions which are called by the certain HCI UART protocols (hci_ath,
    hci_bcm, hci_intel, hci_mrvl, hci_qca) via hci_uart_set_flow_control()
    or directly. This leads to an execution at NULL and can be triggered by
    an unprivileged user. Fix this by adding a helper function and a check
    for the missing tty operations in the protocols code.

    This fixes CVE-2019-10207. The Fixes: lines list commits where calls to
    tiocm[gs]et() or hci_uart_set_flow_control() were added to the HCI UART
    protocols.

    Link: https://syzkaller.appspot.com/bug?id=1b42faa2848963564a5b1b7f8c837ea7b55ffa50
    Reported-by: syzbot+79337b501d6aa974d0f6@syzkaller.appspotmail.com
    Cc: stable@vger.kernel.org # v2.6.36+
    Fixes: b3190df62861 ("Bluetooth: Support for Atheros AR300x serial chip")
    Fixes: 118612fb9165 ("Bluetooth: hci_bcm: Add suspend/resume PM functions")
    Fixes: ff2895592f0f ("Bluetooth: hci_intel: Add Intel baudrate configuration support")
    Fixes: 162f812f23ba ("Bluetooth: hci_uart: Add Marvell support")
    Fixes: fa9ad876b8e0 ("Bluetooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn3990")
    Signed-off-by: Vladis Dronov
    Signed-off-by: Marcel Holtmann
    Reviewed-by: Yu-Chen, Cho
    Tested-by: Yu-Chen, Cho
    Signed-off-by: Linus Torvalds

    Vladis Dronov
     

31 May, 2019

1 commit

  • 1a59d1b8e   treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 ... Browse Code »

    Based on 1 normalized pattern(s):

    this program is free software you can redistribute it and or modify
    it under the terms of the gnu general public license as published by
    the free software foundation either version 2 of the license or at
    your option any later version this program is distributed in the
    hope that it will be useful but without any warranty without even
    the implied warranty of merchantability or fitness for a particular
    purpose see the gnu general public license for more details you
    should have received a copy of the gnu general public license along
    with this program if not write to the free software foundation inc
    59 temple place suite 330 boston ma 02111 1307 usa

    extracted by the scancode license scanner the SPDX license identifier

    GPL-2.0-or-later

    has been chosen to replace the boilerplate/reference in 1334 file(s).

    Signed-off-by: Thomas Gleixner
    Reviewed-by: Allison Randal
    Reviewed-by: Richard Fontana
    Cc: linux-spdx@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190527070033.113240726@linutronix.de
    Signed-off-by: Greg Kroah-Hartman

    Thomas Gleixner
     

07 Feb, 2018

1 commit

  • 688d6240e   Bluetooth: hci_ath: Replace mdelay with msleep in ath_wakeup_ar3k ... Browse Code »

    ath_wakeup_ar3k() is never called from atomic context.

    It is only called by ath_hci_uart_work() that is only called in
    ath_open() via INIT_WORK().
    All of the above functions do not enter atomic context along the way.

    Despite never getting called from atomic context, ath_wakeup_ar3k() calls
    mdelay() for busy wait.
    That is not necessary and can be replaced with msleep to avoid busy wait.

    This is found by a static analysis tool named DCNS written by myself.

    Signed-off-by: Jia-Ju Bai
    Signed-off-by: Marcel Holtmann

    Jia-Ju Bai
     

30 Oct, 2017

1 commit

29 Oct, 2017

1 commit

  • 13df5000d   Bluetooth: hci_ath: Add ath_vendor_cmd helper ... Browse Code »

    Introduce ath_vendor_cmd function which can be used to
    configure 'tags' and patch the firmware.

    ATH vendor command has the following format:
    | OPCODE (u8) | INDEX (LE16) | DLEN (U8) | DATA (U8 * DLEN) |

    BD address configuration tag is at index 0x0001.

    Signed-off-by: Loic Poulain
    Signed-off-by: Marcel Holtmann

    Loic Poulain
     

20 Nov, 2015

1 commit

21 Oct, 2015

1 commit

17 Jun, 2015

1 commit

30 Apr, 2015

2 commits

08 Apr, 2015

6 commits

03 Feb, 2015

1 commit

  • 632f32e21   tty: Remove external interface for tty_set_termios() ... Browse Code »

    tty_set_termios() is an internal helper intended for file scope use.

    UART drivers which are capable of driving the RTS pin must
    properly handle the tiocmset() method, regardless of termios settings.
    A failure to do so is a UART driver bug and should be fixed there.
    Do not use this interface to workaround UART driver bugs.

    Cc: Johan Hedberg
    Cc:
    Signed-off-by: Peter Hurley
    Acked-by: Marcel Holtmann
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

11 Nov, 2014

1 commit

17 Jul, 2012

1 commit

  • adc8d746c   tty: move the termios object into the tty ... Browse Code »

    This will let us sort out a whole pile of tty related races. The
    alternative would be to keep points and refcount the termios objects.
    However
    1. They are tiny anyway
    2. Many devices don't use the stored copies
    3. We can remove a pty special case

    Signed-off-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Alan Cox
     

13 Feb, 2012

1 commit

13 Apr, 2011

1 commit

18 Feb, 2011

1 commit

28 Jul, 2010

3 commits

22 Jul, 2010

1 commit