linux-toradex.git/drivers/tty/n_tty.c, branch v3.14.16

tty: Correct INPCK handling

2014-07-09T18:18:28+00:00

commit 66528f90669691c85c73bea4f0c9f4a5857c4cab upstream.

If INPCK is not set, input parity detection should be disabled. This means
parity errors should not be received from the tty driver, and the data
received should be treated normally.

SUS v3, 11.2.2, General Terminal Interface - Input Modes, states:
  "If INPCK is set, input parity checking shall be enabled. If INPCK is
   not set, input parity checking shall be disabled, allowing output parity
   generation without input parity errors. Note that whether input parity
   checking is enabled or disabled is independent of whether parity detection
   is enabled or disabled (see Control Modes). If parity detection is enabled
   but input parity checking is disabled, the hardware to which the terminal
   is connected shall recognize the parity bit, but the terminal special file
   shall not check whether or not this bit is correctly set."

Ignore parity errors reported by the tty driver when INPCK is not set, and
handle the received data normally.

Fixes: Bugzilla #71681, 'Improvement of n_tty_receive_parity_error from n_tty.c'
Reported-by: Ivan 
Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

n_tty: Fix n_tty_write crash when echoing in raw mode

2014-05-13T11:32:47+00:00

commit 4291086b1f081b869c6d79e5b7441633dc3ace00 upstream.

The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST.  And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.

If we look into tty_insert_flip_string_fixed_flag, there is:
  int space = __tty_buffer_request_room(port, goal, flags);
  struct tty_buffer *tb = port->buf.tail;
  ...
  memcpy(char_buf_ptr(tb, tb->used), chars, space);
  ...
  tb->used += space;

so the race of the two can result in something like this:
              A                                B
__tty_buffer_request_room
                                  __tty_buffer_request_room
memcpy(buf(tb->used), ...)
tb->used += space;
                                  memcpy(buf(tb->used), ...) ->BOOM

B's memcpy is past the tty_buffer due to the previous A's tb->used
increment.

Since the N_TTY line discipline input processing can output
concurrently with a tty write, obtain the N_TTY ldisc output_lock to
serialize echo output with normal tty writes.  This ensures the tty
buffer helper tty_insert_flip_string is not called concurrently and
everything is fine.

Note that this is nicely reproducible by an ordinary user using
forkpty and some setup around that (raw termios + ECHO). And it is
present in kernels at least after commit
d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
use the normal buffering logic) in 2.6.31-rc3.

js: add more info to the commit log
js: switch to bool
js: lock unconditionally
js: lock only the tty->ops->write call

References: CVE-2014-0196
Reported-and-tested-by: Jiri Slaby 
Signed-off-by: Peter Hurley 
Signed-off-by: Jiri Slaby 
Cc: Linus Torvalds 
Cc: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

n_tty: Fix stale echo output

2014-02-13T18:02:19+00:00

When echoes cannot be flushed to output (usually because the tty
has no more write room) and L_ECHO is subsequently turned off, then
when L_ECHO is turned back on, stale echoes are output.

Output completed echoes regardless of the L_ECHO setting:
  1. before normal writes to that tty
  2. if the tty was stopped by soft flow control and is being
     restarted

Reported-by: Mikulas Patocka 
Cc:  # 3.13.x
Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

n_tty: Fix poll() when TIME_CHAR and MIN_CHAR == 0

2014-02-13T17:57:33+00:00

Commit eafbe67f84761d787802e5113d895a316b6292fe,
  n_tty: Refactor input_available_p() by call site
broke poll() when TIME_CHAR(tty) and MIN_CHAR(tty) are both 0.

When TIME_CHAR and MIN_CHAR are both 0, input is available if the
read_cnt is 1 (not 0).

Reported-by: Eric Dumazet 
Tested-by: Eric Dumazet 
Reported-by: Stephane Eranian 
Tested-by: David Ahern 
Tested-by: Arnaldo Carvalho de Melo 
Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

Merge 3.13-rc5 into tty-next

2013-12-24T18:10:47+00:00

We need the tty fixes in here as well.

Signed-off-by: Greg Kroah-Hartman

n_tty: Fix apparent order of echoed output

2013-12-17T17:56:42+00:00

With block processing of echoed output, observed output order is still
required. Push completed echoes and echo commands prior to output.

Introduce echo_mark echo buffer index, which tracks completed echo
commands; ie., those submitted via commit_echoes but which may not
have been committed. Ensure that completed echoes are output prior
to subsequent terminal writes in process_echoes().

Fixes newline/prompt output order in cooked mode shell.

Cc:  # 3.12.x : 39434ab n_tty: Fix missing newline echo
Reported-by: Karl Dahlke 
Reported-by: Mikulas Patocka 
Signed-off-by: Peter Hurley 
Tested-by: Karl Dahlke 
Signed-off-by: Greg Kroah-Hartman

n_tty: Fix buffer overruns with larger-than-4k pastes

2013-12-17T17:29:01+00:00

readline() inadvertently triggers an error recovery path when
pastes larger than 4k overrun the line discipline buffer. The
error recovery path discards input when the line discipline buffer
is full and operating in canonical mode and no newline has been
received. Because readline() changes the termios to non-canonical
mode to read the line char-by-char, the line discipline buffer
can become full, and then when readline() restores termios back
to canonical mode for the caller, the now-full line discipline
buffer triggers the error recovery.

When changing termios from non-canon to canon mode and the read
buffer contains data, simulate an EOF push _without_ the
DISABLED_CHAR in the read buffer.

Importantly for the readline() problem, the termios can be
changed back to non-canonical mode without changes to the read
buffer occurring; ie., as if the previous termios change had not
happened (as long as no intervening read took place).

Preserve existing userspace behavior which allows '\0's already
received in non-canon mode to be read as '\0's in canon mode
(rather than trigger add'l EOF pushes or an actual EOF).

Patch based on original proposal and discussion here
https://bugzilla.kernel.org/show_bug.cgi?id=55991
by Stas Sergeev 

Reported-by: Margarita Manterola 
Cc: Maximiliano Curia 
Cc: Pavel Machek 
Cc: Arkadiusz Miskiewicz 
Acked-by: Stas Sergeev 
Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

Merge 3.13-rc4 into tty-next

2013-12-17T00:36:37+00:00

We want the fixes in here as well.

n_tty: Only perform wakeups for waiters

2013-12-09T00:53:13+00:00

Only wakeup the _waiting_ reader, polls and/or writer(s).

Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

n_tty: Refactor input_available_p() by call site

2013-12-09T00:52:40+00:00

Distinguish if caller is n_tty_poll() or n_tty_read(), and
set the read/wakeup threshold accordingly.

Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman