24 Aug, 2020

1 commit

  • Replace the existing /* fall through */ comments and its variants with
    the new pseudo-keyword macro fallthrough[1]. Also, remove unnecessary
    fall-through markings when it is the case.

    [1] https://www.kernel.org/doc/html/v5.7/process/deprecated.html?highlight=fallthrough#implicit-switch-case-fall-through

    Signed-off-by: Gustavo A. R. Silva

    Gustavo A. R. Silva
     

14 Sep, 2018

1 commit

  • ioctls that are
    * callable only via tty_ioctl()
    * not driver-specific
    * not demand data structure conversions
    * either always need passing arg as is or always demand compat_ptr()
    get intercepted in tty_compat_ioctl() from the very beginning and
    redirecter to tty_ioctl(). As the result, their entries in fs/compat_ioctl.c
    (some of those had been missing, BTW) got removed, as well as
    n_tty_compat_ioctl_helper() (now it's never called with any cmd it would accept).

    Signed-off-by: Al Viro

    Al Viro
     

22 May, 2018

1 commit

  • Add missing const qualifiers to the parameters of the termios hw-change
    helper, which is used by a few USB serial drivers. This specifically
    allows the pl2303 driver to use const arguments in one of its helper as
    well.

    Cc: Jiri Slaby
    Acked-by: Greg Kroah-Hartman
    Signed-off-by: Johan Hovold

    Johan Hovold
     

08 Nov, 2017

1 commit

  • It's good to have SPDX identifiers in all files to make it easier to
    audit the kernel tree for correct licenses.

    Update the drivers/tty files files with the correct SPDX license
    identifier based on the license text in the file itself. The SPDX
    identifier is a legally binding shorthand, which can be used instead of
    the full boiler plate text.

    This work is based on a script and data from Thomas Gleixner, Philippe
    Ombredanne, and Kate Stewart.

    Cc: Jiri Slaby
    Cc: Benjamin Herrenschmidt
    Cc: Paul Mackerras
    Cc: Michael Ellerman
    Cc: Chris Metcalf
    Cc: Jiri Kosina
    Cc: David Sterba
    Cc: James Hogan
    Cc: Rob Herring
    Cc: Eric Anholt
    Cc: Stefan Wahren
    Cc: Florian Fainelli
    Cc: Ray Jui
    Cc: Scott Branden
    Cc: bcm-kernel-feedback-list@broadcom.com
    Cc: "James E.J. Bottomley"
    Cc: Helge Deller
    Cc: Joachim Eastwood
    Cc: Matthias Brugger
    Cc: Masahiro Yamada
    Cc: Tobias Klauser
    Cc: Russell King
    Cc: Vineet Gupta
    Cc: Richard Genoud
    Cc: Alexander Shiyan
    Cc: Baruch Siach
    Cc: "Maciej W. Rozycki"
    Cc: "Uwe Kleine-König"
    Cc: Pat Gefre
    Cc: "Guilherme G. Piccoli"
    Cc: Jason Wessel
    Cc: Vladimir Zapolskiy
    Cc: Sylvain Lemieux
    Cc: Carlo Caione
    Cc: Kevin Hilman
    Cc: Liviu Dudau
    Cc: Sudeep Holla
    Cc: Lorenzo Pieralisi
    Cc: Andy Gross
    Cc: David Brown
    Cc: "Andreas Färber"
    Cc: Kevin Cernekee
    Cc: Laxman Dewangan
    Cc: Thierry Reding
    Cc: Jonathan Hunter
    Cc: Barry Song
    Cc: Patrice Chotard
    Cc: Maxime Coquelin
    Cc: Alexandre Torgue
    Cc: "David S. Miller"
    Cc: Peter Korsgaard
    Cc: Timur Tabi
    Cc: Tony Prisk
    Cc: Michal Simek
    Cc: "Sören Brinkmann"
    Cc: Thomas Gleixner
    Cc: Kate Stewart
    Cc: Philippe Ombredanne
    Cc: Jiri Slaby
    Signed-off-by: Greg Kroah-Hartman

    Greg Kroah-Hartman
     

19 Apr, 2017

1 commit


02 Mar, 2017

1 commit


25 Dec, 2016

1 commit


01 May, 2016

1 commit


29 Jan, 2016

1 commit

  • Expressions of the form "tty->termios.c_*flag & FLAG"
    are more clearly expressed with the termios flags macros,
    I_FLAG(), C_FLAG(), O_FLAG(), and L_FLAG().

    Convert treewide.

    Signed-off-by: Peter Hurley
    Acked-by: Johan Hovold
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

14 Dec, 2015

4 commits


21 Nov, 2015

1 commit

  • The correct lock order is atomic_write_lock => termios_rwsem, as
    established by tty_write() => n_tty_write().

    Fixes: c274f6ef1c666 ("tty: Hold termios_rwsem for tcflow(TCIxxx)")
    Reported-and-Tested-by: Dmitry Vyukov
    Cc: # v3.18+
    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

24 Jul, 2015

1 commit


07 May, 2015

1 commit

  • tty_name no longer uses the buf parameter, so remove it along with all
    the 64 byte stack buffers that used to be passed in.

    Mostly generated by the coccinelle script

    @depends on patch@
    identifier buf;
    constant C;
    expression tty;
    @@
    - char buf[C];

    allmodconfig compiles, so I'm fairly confident the stack buffers
    weren't used for other purposes as well.

    Signed-off-by: Rasmus Villemoes
    Reviewed-by: Peter Hurley
    Acked-by: Jesper Nilsson
    Acked-by: Dmitry Torokhov
    Signed-off-by: Greg Kroah-Hartman

    Rasmus Villemoes
     

28 Apr, 2015

1 commit


07 Mar, 2015

2 commits

  • Currently tty_wait_until_sent may take up to twice as long as the
    requested timeout while waiting for driver and hardware buffers to
    drain.

    Fix this by taking the remaining number of jiffies after waiting for
    driver buffers to drain into account so that the timeout actually
    becomes a maximum timeout as it is documented to be.

    Note that this specifically implies tighter timings when closing a port
    as a consequence of actually honouring the port closing-wait setting
    for drivers relying on tty_wait_until_sent_from_close (e.g. via
    tty_port_close_start).

    Signed-off-by: Johan Hovold
    Reviewed-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Johan Hovold
     
  • Fix overflow bug in tty_wait_until_sent on 64-bit machines, where an
    infinite timeout (0) would be passed to the underlying tty-driver's
    wait_until_sent-operation as a negative timeout (-1), causing it to
    return immediately.

    This manifests itself for example as tcdrain() returning immediately,
    drivers not honouring the drain flags when setting terminal attributes,
    or even dropped data on close as a requested infinite closing-wait
    timeout would be ignored.

    The first symptom was reported by Asier LLANO who noted that tcdrain()
    returned prematurely when using the ftdi_sio usb-serial driver.

    Fix this by passing 0 rather than MAX_SCHEDULE_TIMEOUT (LONG_MAX) to the
    underlying tty driver.

    Note that the serial-core wait_until_sent-implementation is not affected
    by this bug due to a lucky chance (comparison to an unsigned maximum
    timeout), and neither is the cyclades one that had an explicit check for
    negative timeouts, but all other tty drivers appear to be affected.

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Cc: stable # v2.6.12
    Reported-by: ZIV-Asier Llano Palacios
    Signed-off-by: Johan Hovold
    Reviewed-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Johan Hovold
     

03 Feb, 2015

1 commit

  • tty_set_termios() is an internal helper intended for file scope use.

    UART drivers which are capable of driving the RTS pin must
    properly handle the tiocmset() method, regardless of termios settings.
    A failure to do so is a UART driver bug and should be fixed there.
    Do not use this interface to workaround UART driver bugs.

    Cc: Johan Hedberg
    Cc:
    Signed-off-by: Peter Hurley
    Acked-by: Marcel Holtmann
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

06 Nov, 2014

3 commits


24 Sep, 2014

3 commits

  • While transmitting a START/STOP char for tcflow(TCION/TCIOFF), prevent
    a termios change. Otherwise, a garbage in-band flow control char
    may be sent, if the termios change overlaps the transmission setup.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Relocate the file-scope function, send_prio_char(), as a global
    helper tty_send_xchar(). Remove the global declarations for
    tty_write_lock()/tty_write_unlock(), as these are file-scope only now.

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • Use newly-introduced tty->flow_lock to serialize updates to
    tty->flow_stopped (via tcflow()) and with concurrent tty flow
    control changes from other sources.

    Merge the storage for ->stopped and ->flow_stopped, now that both
    flags are serialized by ->flow_lock.

    The padding bits are necessary to force the compiler to allocate the
    type specified; otherwise, gcc will ignore the type specifier and
    allocate the minimum number of bytes necessary to store the bitfield.
    In turn, this would allow Alpha EV4 and EV5 cpus to corrupt adjacent
    byte storage because those cpus use RMW to store byte and short data.

    gcc versions < 4.7.2 will also corrupt storage adjacent to bitfields
    smaller than unsigned long on ia64, ppc64, hppa64 and sparc64, thus
    requiring more than unsigned int storage (which would otherwise be
    sufficient to workaround the Alpha non-atomic byte/short storage problem).

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

09 Sep, 2014

1 commit


26 Sep, 2013

1 commit

  • Commit 'e7f3880cd9b98c5bf9391ae7acdec82b75403776'
    tty: Fix recursive deadlock in tty_perform_flush()
    introduced a regression where tcflush() does not generate
    SIGTTOU for background process groups.

    Make sure ioctl(TCFLSH) calls tty_check_change() when
    invoked from the line discipline.

    Cc: stable@vger.kernel.org # v3.10+
    Reported-by: Oleg Nesterov
    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

24 Jul, 2013

2 commits


16 Apr, 2013

1 commit


19 Mar, 2013

3 commits

  • tty_perform_flush() can deadlock when called while holding
    a line discipline reference. By definition, all ldisc drivers
    hold a ldisc reference, so calls originating from ldisc drivers
    must not block for a ldisc reference.

    The deadlock can occur when:
    CPU 0 | CPU 1
    |
    tty_ldisc_ref(tty) |
    .... |
    tty_ldisc_ref_wait(tty) |
    |

    CPU 0 cannot progess because it cannot obtain an ldisc reference
    with the line discipline has been halted (thus no new references
    are granted).
    CPU 1 cannot progress because an outstanding ldisc reference
    has not been released.

    An in-tree call-tree audit of tty_perform_flush() [1] shows 5
    ldisc drivers calling tty_perform_flush() indirectly via
    n_tty_ioctl_helper() and 2 ldisc drivers calling directly.
    A single tty driver safely uses the function.

    [1]
    Recursive usage:

    /* These functions are line discipline ioctls and thus
    * recursive wrt line discipline references */

    tty_perform_flush() - ./drivers/tty/tty_ioctl.c
    n_tty_ioctl_helper()
    hci_uart_tty_ioctl(default) - drivers/bluetooth/hci_ldisc.c (N_HCI)
    n_hdlc_tty_ioctl(default) - drivers/tty/n_hdlc.c (N_HDLC)
    gsmld_ioctl(default) - drivers/tty/n_gsm.c (N_GSM0710)
    n_tty_ioctl(default) - drivers/tty/n_tty.c (N_TTY)
    gigaset_tty_ioctl(default) - drivers/isdn/gigaset/ser-gigaset.c (N_GIGASET_M101)
    ppp_synctty_ioctl(TCFLSH) - drivers/net/ppp/pps_synctty.c
    ppp_asynctty_ioctl(TCFLSH) - drivers/net/ppp/ppp_async.c

    Non-recursive use:

    tty_perform_flush() - drivers/tty/tty_ioctl.c
    ipw_ioctl(TCFLSH) - drivers/tty/ipwireless/tty.c
    /* This function is a tty i/o ioctl method, which
    * is invoked by tty_ioctl() */

    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     
  • The warning is there since 2.1.69 and we have not seen anybody
    reporting it in the past decade. Remove the warning now.

    tty_get_baud_rate can now be inline. This gives us one less
    EXPORT_SYMBOL.

    Signed-off-by: Jiri Slaby
    Signed-off-by: Greg Kroah-Hartman

    Jiri Slaby
     
  • The tty driver can become stuck throttled due to race conditions
    between throttle and unthrottle, when the decision to throttle
    or unthrottle is conditional. The following example helps to
    illustrate the race:

    CPU 0 | CPU 1
    |
    if (condition A) |
    |
    | if (!condition A)
    | unthrottle()
    throttle() |
    |

    Note the converse is also possible; ie.,

    CPU 0 | CPU 1
    |
    | if (!condition A)
    |
    if (condition A) |
    throttle() |
    | unthrottle()
    |

    Add new throttle/unthrottle functions based on the familiar model
    of task state and schedule/wake. For example,

    while (1) {
    tty_set_flow_change(tty, TTY_THROTTLE_SAFE);
    if (!condition)
    break;
    if (!tty_throttle_safe(tty))
    break;
    }
    __tty_set_flow_change(tty, 0);

    In this example, if an unthrottle occurs after the condition is
    evaluated but before tty_throttle_safe(), then tty_throttle_safe()
    will return non-zero, looping and forcing the re-evaluation of
    condition.

    Reported-by: Vincent Pillet
    Signed-off-by: Peter Hurley
    Signed-off-by: Greg Kroah-Hartman

    Peter Hurley
     

05 Feb, 2013

1 commit

  • See https://bugzilla.redhat.com/show_bug.cgi?id=904907
    read command causes bash to abort with double free or corruption (out).

    A simple test-case from Roman:

    // Compile the reproducer and send sigchld ti that process.
    // EINTR occurs even if SA_RESTART flag is set.

    void handler(int sig)
    {
    }

    main()
    {
    struct sigaction act;
    act.sa_handler = handler;
    act.sa_flags = SA_RESTART;
    sigaction (SIGCHLD, &act, 0);
    struct termio ttp;
    ioctl(0, TCGETA, &ttp);
    while(1)
    {
    if (ioctl(0, TCSETAW, ttp) < 0)
    {
    if (errno == EINTR)
    {
    fprintf(stderr, "BUG!"); return(1);
    }
    }
    }
    }

    Change set_termios/set_termiox to return -ERESTARTSYS to fix this
    particular problem.

    I didn't dare to change other EINTR's in drivers/tty/, but they look
    equally wrong.

    Reported-by: Roman Rakus
    Reported-by: Lingzhu Xiang
    Signed-off-by: Oleg Nesterov
    Cc: Jiri Slaby
    Cc: stable
    Signed-off-by: Greg Kroah-Hartman

    Oleg Nesterov
     

19 Jan, 2013

1 commit

  • Regression 'tty: fix "IRQ45: nobody cared"'
    Regression commit 7b292b4bf9a9d6098440d85616d6ca4c608b8304

    Function reset_buffer_flags() also invoked during the ioctl(...,TCFLSH,..).
    At the time of request we can have full buffers and throttled driver too.
    If we don't unthrottle driver, we can get forever throttled driver, because,
    after request, we will have empty buffers and throttled driver and
    there is no place to unthrottle driver.
    It simple reproduce with "pty" pair then one side sleep on tty->write_wait,
    and other side do ioctl(...,TCFLSH,..). Then there is no place to do writers wake up.

    Signed-off-by: Ilya Zykov
    Cc: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Ilya Zykov
     

26 Oct, 2012

1 commit

  • Since this ioctl is for pty devices only move it to pty.c.

    v2:
    - drop PTY_TYPE_MASTER test since it's master peer
    ioctl anyway (by jslaby@)

    Suggested-by: Alan Cox
    Signed-off-by: Cyrill Gorcunov
    CC: "H. Peter Anvin"
    CC: Pavel Emelyanov
    CC: Jiri Slaby
    Signed-off-by: Greg Kroah-Hartman

    Cyrill Gorcunov
     

18 Jul, 2012

1 commit


17 Jul, 2012

1 commit

  • This will let us sort out a whole pile of tty related races. The
    alternative would be to keep points and refcount the termios objects.
    However
    1. They are tiny anyway
    2. Many devices don't use the stored copies
    3. We can remove a pty special case

    Signed-off-by: Alan Cox
    Signed-off-by: Greg Kroah-Hartman

    Alan Cox
     

29 Mar, 2012

1 commit