19 Jul, 2017

1 commit

  • Pull structure randomization updates from Kees Cook:
    "Now that IPC and other changes have landed, enable manual markings for
    randstruct plugin, including the task_struct.

    This is the rest of what was staged in -next for the gcc-plugins, and
    comes in three patches, largest first:

    - mark "easy" structs with __randomize_layout

    - mark task_struct with an optional anonymous struct to isolate the
    __randomize_layout section

    - mark structs to opt _out_ of automated marking (which will come
    later)

    And, FWIW, this continues to pass allmodconfig (normal and patched to
    enable gcc-plugins) builds of x86_64, i386, arm64, arm, powerpc, and
    s390 for me"

    * tag 'gcc-plugins-v4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
    randstruct: opt-out externally exposed function pointer structs
    task_struct: Allow randomized layout
    randstruct: Mark various structs for randomization

    Linus Torvalds
     

04 Jul, 2017

1 commit

  • Pull tty/serial updates from Greg KH:
    "Here is the large tty/serial patchset for 4.13-rc1.

    A lot of tty and serial driver updates are in here, along with some
    fixups for some __get/put_user usages that were reported. Nothing
    huge, just lots of development by a number of different developers,
    full details in the shortlog.

    All of these have been in linux-next for a while"

    * tag 'tty-4.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (71 commits)
    tty: serial: lpuart: add a more accurate baud rate calculation method
    tty: serial: lpuart: add earlycon support for imx7ulp
    tty: serial: lpuart: add imx7ulp support
    dt-bindings: serial: fsl-lpuart: add i.MX7ULP support
    tty: serial: lpuart: add little endian 32 bit register support
    tty: serial: lpuart: refactor lpuart32_{read|write} prototype
    tty: serial: lpuart: introduce lpuart_soc_data to represent SoC property
    serial: imx-serial - move DMA buffer configuration to DT
    serial: imx: Enable RTSD only when needed
    serial: imx: Remove unused members from imx_port struct
    serial: 8250: 8250_omap: Fix race b/w dma completion and RX timeout
    serial: 8250: Fix THRE flag usage for CAP_MINI
    tty/serial: meson_uart: update to stable bindings
    dt-bindings: serial: Add bindings for the Amlogic Meson UARTs
    serial: Delete dead code for CIR serial ports
    serial: sirf: make of_device_ids const
    serial/mpsc: switch to dma_alloc_attrs
    tty: serial: Add Actions Semi Owl UART earlycon
    dt-bindings: serial: Document Actions Semi Owl UARTs
    tty/serial: atmel: make the driver DT only
    ...

    Linus Torvalds
     

01 Jul, 2017

1 commit

  • This marks many critical kernel structures for randomization. These are
    structures that have been targeted in the past in security exploits, or
    contain functions pointers, pointers to function pointer tables, lists,
    workqueues, ref-counters, credentials, permissions, or are otherwise
    sensitive. This initial list was extracted from Brad Spengler/PaX Team's
    code in the last public patch of grsecurity/PaX based on my understanding
    of the code. Changes or omissions from the original code are mine and
    don't reflect the original grsecurity/PaX code.

    Left out of this list is task_struct, which requires special handling
    and will be covered in a subsequent patch.

    Signed-off-by: Kees Cook

    Kees Cook
     

27 Jun, 2017

1 commit

  • The function converts strings like ttyS0 and ttyUSB0 to dev_t like
    (4, 64) and (188, 0). It does this by scanning tty_drivers list for
    corresponding device name and index. If the driver is not registered,
    this function returns -ENODEV. It also acquires tty_mutex.

    Signed-off-by: Okash Khawaja
    Signed-off-by: Greg Kroah-Hartman

    Okash Khawaja
     

25 Jun, 2017

1 commit

  • This patch adds definition of tty_open_by_driver when CONFIG_TTY is not
    defined. This was supposed to have been included in commit
    12e84c71b7d4ee38d51377fd494ac748ee4e6912 ("tty: export
    tty_open_by_driver"). The patch follows convention for other such
    functions and returns NULL.

    Signed-off-by: Okash Khawaja
    Reviewed-by: Samuel Thibault
    Signed-off-by: Greg Kroah-Hartman

    Okash Khawaja
     

13 Jun, 2017

1 commit

  • Drop the now unused alt_speed field from struct tty_struct.

    Setting an alt_speed using the ASYNC_SPD flags has been deprecated since
    v2.1.69, and has been broken for all tty drivers but serial-core since
    v3.10 and commit 6865ff222cca ("TTY: do not warn about setting speed via
    SPD_*") without anyone noticing.

    Note that serial-core still supports changing speed using TIOCSSERIAL
    and SPD flags (including "alt-speeds"), but also warns about it being
    deprecated since pre-git.

    Signed-off-by: Johan Hovold
    Reviewed-by: Andy Shevchenko
    Reviewed-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Johan Hovold
     

12 Jun, 2017

1 commit


18 May, 2017

1 commit

  • Add a new interface for registering a serdev controller and clients, and
    a helper function to deregister serdev devices (or a tty device) that
    were previously registered using the new interface.

    Once every driver currently using the tty_port_register_device() helpers
    have been vetted and converted to use the new serdev registration
    interface (at least for deregistration), we can move serdev registration
    to the current helpers and get rid of the serdev-specific functions.

    Reviewed-by: Rob Herring
    Signed-off-by: Johan Hovold
    Signed-off-by: Greg Kroah-Hartman

    Johan Hovold
     

16 May, 2017

1 commit

  • This exports tty_open_by_driver so that it can be called from other
    places inside the kernel. The checks for null file pointer are based on
    Alan Cox's patch here:
    http://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1215095.html.
    Description below is quoted from it:

    "[RFC] tty_port: allow a port to be opened with a tty that has no file handle

    Let us create tty objects entirely in kernel space. Untested proposal to
    show why all the ideas around rewriting half the uart stack are not needed.

    With this a kernel created non file backed tty object could be used to handle
    data, and set terminal modes. Not all ldiscs can cope with this as N_TTY in
    particular has to work back to the fs/tty layer.

    The tty_port code is however otherwise clean of file handles as far as I can
    tell as is the low level tty port write path used by the ldisc, the
    configuration low level interfaces and most of the ldiscs.

    Currently you don't have any exposure to see tty hangups because those are
    built around the file layer. However a) it's a fixed port so you probably
    don't care about that b) if you do we can add a callback and c) you almost
    certainly don't want the userspace tear down/rebuild behaviour anyway.

    This should however be sufficient if we wanted for example to enumerate all
    the bluetooth bound fixed ports via ACPI and make them directly available.

    It doesn't deal with the case of a user opening a port that's also kernel
    opened and that would need some locking out (so it returned EBUSY if bound
    to a kernel device of some kind). That needs resolving along with how you
    "up" or "down" your new bluetooth device, or enumerate it while providing
    the existing tty API to avoid regressions (and to debug)."

    The exported funtion is used later in this patch set to gain access to tty_struct.

    [changed export symbol level - gkh]

    Signed-off-by: Okash Khawaja
    Reviewed-by: Samuel Thibault
    Signed-off-by: Greg Kroah-Hartman

    Okash Khawaja
     

19 Apr, 2017

2 commits


03 Feb, 2017

1 commit

  • Introduce a client (upward direction) operations struct for tty_port
    clients. Initially supported operations are for receiving data and write
    wake-up. This will allow for having clients other than an ldisc.

    Convert the calls to the ldisc to use the client ops as the default
    operations.

    Signed-off-by: Rob Herring
    Reviewed-By: Sebastian Reichel
    Tested-By: Sebastian Reichel
    Signed-off-by: Greg Kroah-Hartman

    Rob Herring
     

20 Jan, 2017

1 commit


19 Jan, 2017

1 commit

  • For in-kernel tty users, we need to be able to create and destroy
    'struct tty' that are not associated with a file. The creation side is
    fine, but tty_release() needs to be split into the file handle portion
    and the struct tty portion. Introduce a new function, tty_release_struct,
    to handle just the destroying of a struct tty.

    Signed-off-by: Rob Herring
    Reviewed-by: Andy Shevchenko
    Reviewed-By: Sebastian Reichel
    Signed-off-by: Greg Kroah-Hartman

    Rob Herring
     

21 May, 2016

1 commit

  • Pull tty and serial driver updates from Greg KH:
    "Here's the large TTY and Serial driver update for 4.7-rc1.

    A few new serial drivers are added here, and Peter has fixed a bunch
    of long-standing bugs in the tty layer and serial drivers as normal.
    Full details in the shortlog.

    All of these have been in linux-next for a while with no reported
    issues"

    * tag 'tty-4.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (88 commits)
    MAINTAINERS: 8250: remove website reference
    serial: core: Fix port mutex assert if lockdep disabled
    serial: 8250_dw: fix wrong logic in dw8250_check_lcr()
    tty: vt, finish looping on duplicate
    tty: vt, return error when con_startup fails
    QE-UART: add "fsl,t1040-ucc-uart" to of_device_id
    serial: mctrl_gpio: Drop support for out1-gpios and out2-gpios
    serial: 8250dw: Add device HID for future AMD UART controller
    Fix OpenSSH pty regression on close
    serial: mctrl_gpio: add IRQ locking
    serial: 8250: Integrate Fintek into 8250_base
    serial: mps2-uart: add support for early console
    serial: mps2-uart: add MPS2 UART driver
    dt-bindings: document the MPS2 UART bindings
    serial: sirf: Use generic uart-has-rtscts DT property
    serial: sirf: Introduce helper variable struct device_node *np
    serial: mxs-auart: Use generic uart-has-rtscts DT property
    serial: imx: Use generic uart-has-rtscts DT property
    doc: DT: Add Generic Serial Device Tree Bindings
    serial: 8250: of: Make tegra_serial_handle_break() static
    ...

    Linus Torvalds
     

19 May, 2016

1 commit

  • Pull audit updates from Paul Moore:
    "Four small audit patches for 4.7.

    Two are simple cleanups around the audit thread management code, one
    adds a tty field to AUDIT_LOGIN events, and the final patch makes
    tty_name() usable regardless of CONFIG_TTY.

    Nothing controversial, and it all passes our regression test"

    * 'stable-4.7' of git://git.infradead.org/users/pcmoore/audit:
    tty: provide tty_name() even without CONFIG_TTY
    audit: add tty field to LOGIN event
    audit: we don't need to __set_current_state(TASK_RUNNING)
    audit: cleanup prune_tree_thread

    Linus Torvalds
     

02 May, 2016

1 commit

  • OpenSSH expects the (non-blocking) read() of pty master to return
    EAGAIN only if it has received all of the slave-side output after
    it has received SIGCHLD. This used to work on pre-3.12 kernels.

    This fix effectively forces non-blocking read() and poll() to
    block for parallel i/o to complete for all ttys. It also unwinds
    these changes:

    1) f8747d4a466ab2cafe56112c51b3379f9fdb7a12
    tty: Fix pty master read() after slave closes

    2) 52bce7f8d4fc633c9a9d0646eef58ba6ae9a3b73
    pty, n_tty: Simplify input processing on final close

    3) 1a48632ffed61352a7810ce089dc5a8bcd505a60
    pty: Fix input race when closing

    Inspired by analysis and patch from Marc Aurele La France

    Reported-by: Volth
    Reported-by: Marc Aurele La France
    BugLink: https://bugzilla.mindrot.org/show_bug.cgi?id=52
    BugLink: https://bugzilla.mindrot.org/show_bug.cgi?id=2492
    Signed-off-by: Brian Bloniarz
    Reviewed-by: Peter Hurley
    Cc: stable
    Signed-off-by: Greg Kroah-Hartman

    Brian Bloniarz
     

01 May, 2016

8 commits

  • Replace ASYNC_INITIALIZED bit in the tty_port::flags field with
    TTY_PORT_INITIALIZED bit in the tty_port::iflags field. Introduce helpers
    tty_port_set_initialized() and tty_port_initialized() to abstract
    atomic bit ops.

    Note: the transforms for test_and_set_bit() and test_and_clear_bit()
    are unnecessary as the state transitions are already mutually exclusive;
    the tty lock prevents concurrent open/close/hangup.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Replace ASYNC_SUSPENDED bit in the tty_port::flags field with
    TTY_PORT_SUSPENDED bit in the tty_port::iflags field. Introduce helpers
    tty_port_set_suspended() and tty_port_suspended() to abstract
    atomic bit ops.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Replace ASYNC_CHECK_CD bit in the tty_port::flags field with
    TTY_PORT_CHECK_CD bit in the tty_port::iflags field. Introduce helpers
    tty_port_set_check_carrier() and tty_port_check_carrier() to abstract
    the atomic bit ops.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Replace ASYNC_NORMAL_ACTIVE bit in the tty_port::flags field with
    TTY_PORT_ACTIVE bit in the tty_port::iflags field. Introduce helpers
    tty_port_set_active() and tty_port_active() to abstract atomic bit ops.

    Extract state changes from port lock sections, as this usage is
    broken and confused; the state transitions are protected by the
    tty lock (which mutually excludes parallel open/close/hangup),
    and no user tests the active state while holding the port lock.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Replace ASYNC_CTS_FLOW bit in the tty_port::flags field with
    TTY_PORT_CTS_FLOW bit in the tty_port::iflags field. Add
    tty_port_set_cts_flow() helper to abstract the atomic bit ops.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Prepare for relocating kernel private state bits out of tty_port::flags
    field; tty_port::flags field is not atomic and can become corrupted
    by concurrent updates. It also suffers from the complication of sharing
    in a userspace-visible field which must be masked.

    Define new tty_port::iflags field and new, substitute bit definitions
    for the former ASYNC_* flags.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Abstract TTY_THROTTLED bit tests with tty_throttled().

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Abstract TTY_IO_ERROR status test treewide with tty_io_error().
    NB: tty->flags uses atomic bit ops; replace non-atomic bit test
    with test_bit().

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

28 Apr, 2016

1 commit

  • The audit subsystem just started printing the name of the tty,
    but that causes a build failure when CONFIG_TTY is disabled:

    kernel/built-in.o: In function `audit_log_task_info':
    memremap.c:(.text+0x5e34c): undefined reference to `tty_name'
    kernel/built-in.o: In function `audit_set_loginuid':
    memremap.c:(.text+0x63b34): undefined reference to `tty_name'

    This adds tty_name() to the list of functions that are provided
    as trivial stubs in that configuration.

    Signed-off-by: Arnd Bergmann
    Fixes: db0a6fb5d97a ("audit: add tty field to LOGIN event")
    Signed-off-by: Paul Moore

    Arnd Bergmann
     

29 Jan, 2016

2 commits

  • Instead of two distinct code branches for receive_buf() handling,
    use tty_ldisc_receive_buf() as the single code path.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • commit 9ce119f318ba ("tty: Fix GPF in flush_to_ldisc()") fixed a
    GPF caused by a line discipline which does not define a receive_buf()
    method.

    However, the vt driver (and speakup driver also) pushes selection
    data directly to the line discipline receive_buf() method via
    tty_ldisc_receive_buf(). Fix the same problem in tty_ldisc_receive_buf().

    Cc:
    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

28 Jan, 2016

12 commits

  • tty_audit_push() and tty_audit_push_current() perform identical
    tasks; eliminate the tty_audit_push() implementation and the
    tty_audit_push_current() name.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • In canonical read mode, each line read and logged is pushed separately
    with tty_audit_push(). For all single-threaded processes and multi-threaded
    processes reading from only one tty, this patch has no effect; the last line
    read will still be the entry pushed to the audit log because the tty
    association cannot have changed between tty_audit_add_data() and
    tty_audit_push().

    For multi-threaded processes reading from different ttys concurrently,
    the audit log will have mixed log entries anyway. Consider two ttys
    audited concurrently:

    CPU0 CPU1
    ---------- ------------
    tty_audit_add_data(ttyA)
    tty_audit_add_data(ttyB)
    tty_audit_push()
    tty_audit_add_data(ttyB)
    tty_audit_push()

    This patch will now cause the ttyB output to be split into separate
    audit log entries.

    However, this possibility is equally likely without this patch:

    CPU0 CPU1
    ---------- ------------
    tty_audit_add_data(ttyB)
    tty_audit_add_data(ttyA)
    tty_audit_push()
    tty_audit_add_data(ttyB)
    tty_audit_push()

    Mixed canonical and non-canonical reads have similar races.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • The tty termios bits cannot change while n_tty_read() is in the
    i/o loop; the termios_rwsem ensures mutual exclusion with termios
    changes in n_tty_set_termios(). Check L_ICANON() directly and
    eliminate icanon parameter.

    NB: tty_audit_add_data() => tty_audit_buf_get() => tty_audit_buf_alloc()
    is a single path; ie., tty_audit_buf_get() and tty_audit_buf_alloc()
    have no other callers.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Access to tty->tty_files list is always per-tty, never for all ttys
    simultaneously. Replace global tty_files_lock spinlock with per-tty
    ->files_lock. Initialize when the ->tty_files list is inited, in
    alloc_tty_struct().

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • The TTY_DEBUG macro is not used; remove.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Move is_ignored() to drivers/tty/tty_io.c and re-declare in file
    scope.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • tty_read_raw_data() and tty_signal() no longer exist; remove
    declarations.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Reduce global tty symbols; move and rename tty_ldisc_begin() as
    n_tty_init() and redefine the N_TTY ldisc ops as file scope.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Currently, when the tty is hungup, the ldisc is re-instanced; ie., the
    current instance is destroyed and a new instance is created. The purpose
    of this design was to guarantee a valid, open ldisc for the lifetime of
    the tty.

    However, now that tty buffers are owned by and have lifetime equivalent
    to the tty_port (since v3.10), any data received immediately after the
    ldisc is re-instanced may cause continued driver i/o operations
    concurrently with the driver's hangup() operation. For drivers that
    shutdown h/w on hangup, this is unexpected and usually bad. For example,
    the serial core may free the xmit buffer page concurrently with an
    in-progress write() operation (triggered by echo).

    With the existing stable and robust ldisc reference handling, the
    cleaned-up tty_reopen(), the straggling unsafe ldisc use cleaned up, and
    the preparation to properly handle a NULL tty->ldisc, the ldisc instance
    can be destroyed and only re-instanced when the tty is re-opened.

    If the tty was opened as /dev/console or /dev/tty0, the original behavior
    of re-instancing the ldisc is retained (the 'reinit' parameter to
    tty_ldisc_hangup() is true). This is required since those file descriptors
    are never hungup.

    This patch has neglible impact on userspace; the tty file_operations ptr
    is changed to point to the hungup file operations _before_ the ldisc
    instance is destroyed, so only racing file operations might now retrieve
    a NULL ldisc reference (which is simply handled as if the hungup file
    operation had been called instead -- see "tty: Prepare for destroying
    line discipline on hangup").

    This resolves a long-standing FIXME and several crash reports.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • tty->ldisc is a ptr to struct tty_ldisc, but unfortunately 'ldisc' is
    also used as a parameter or local name to refer to the line discipline
    index value (ie, N_TTY, N_GSM, etc.); instead prefer the name used
    by the line discipline registration/ref counting functions.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • The tty lock/unlock code does not belong in the special lockfunc section
    which is treated specially by stack backtraces.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • tty_driver_remove_tty() is only local-scope; declare as static.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley