Changes in 4.9.318 USB: new quirk for Dell Gen 2 devices ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP ptrace: Reimplement PTRACE_KILL by always sending SIGKILL btrfs: add "0x" prefix for unsupported optional features drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue b43legacy: Fix assigning negative value to unsigned variable b43: Fix assigning negative value to unsigned variable ipw2x00: Fix potential NULL dereference in libipw_xmit() ACPICA: Avoid cache flush inside virtual machines ALSA: jack: Access input_dev under mutex drm/amd/pm: fix double free in si_parse_power_table() ath9k: fix QCA9561 PA bias level media: cx25821: Fix the warning when removing the module scsi: megaraid: Fix error check return value of register_chrdev() drm/amd/pm: fix the compile warning ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL ASoC: dapm: Don't fold register value changes into notifications dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC ipmi:ssif: Check for NULL msg when handling events and messages openrisc: start CPU timer early in boot nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags ASoC: rt5645: Fix errorenous cleanup order media: exynos4-is: Fix compile warning rxrpc: Return an error to sendmsg if call failed eth: tg3: silence the GCC 12 array-bounds warning fs: jfs: fix possible NULL pointer dereference in dbFree() ARM: OMAP1: clock: Fix UART rate reporting algorithm fat: add ratelimit to fat*_ent_bread() ARM: versatile: Add missing of_node_put in dcscb_init ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM ARM: hisi: Add missing of_node_put after of_find_compatible_node PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() powerpc/xics: fix refcount leak in icp_opal_init() macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled drm: fix EDID struct for old ARM OABI format ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe x86/delay: Fix the wrong asm constraint in delay_loop() drm/mediatek: Fix mtk_cec_mask() spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout NFC: NULL out the dev->rfkill to prevent UAF HID: hid-led: fix maximum brightness for Dream Cheeky spi: img-spfi: Fix pm_runtime_get_sync() error checking ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix inotify: show inotify mask flags in proc fdinfo x86/pm: Fix false positive kmemleak report in msr_build_context() drm/msm/dsi: fix error checks and return values for DSI xmit functions drm/msm/hdmi: check return value after calling platform_get_resource_byname() drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() x86/mm: Cleanup the control_va_addr_alignment() __setup handler drm/msm: return an error pointer in msm_gem_prime_get_sg_table() media: uvcvideo: Fix missing check to determine if element is found in list ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt media: exynos4-is: Change clk_disable to clk_disable_unprepare media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout m68k: math-emu: Fix dependencies of math emulation support sctp: read sk->sk_bound_dev_if once in sctp_rcv() ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition() rxrpc: Fix listen() setting the bar too high for the prealloc rings rxrpc: Don't try to resend the request if we're receiving the reply soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc mfd: ipaq-micro: Fix error check return value of platform_get_irq() scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac() drivers/base/node.c: fix compaction sysfs file leak powerpc/8xx: export 'cpm_setbrg' for modules powerpc/idle: Fix return value of __setup() handler powerpc/4xx/cpm: Fix return value of __setup() handler tty: fix deadlock caused by calling printk() under tty_port->lock Input: sparcspkr - fix refcount leak in bbc_beep_probe video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup iommu/amd: Increase timeout waiting for GA log enablement wifi: mac80211: fix use-after-free in chanctx code iwlwifi: mvm: fix assert 1F04 upon reconfig fs-writeback: writeback_sb_inodes:Recalculate 'wrote' according skipped pages ext4: fix use-after-free in ext4_rename_dir_prepare ext4: fix bug_on in ext4_writepages ext4: verify dir block before splitting it dlm: fix plock invalid read dlm: fix missing lkb refcount handling ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock scsi: dc395x: Fix a missing check on list iterator scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX md: fix an incorrect NULL check in does_sb_need_changing md: fix an incorrect NULL check in md_reload_sb RDMA/hfi1: Fix potential integer multiplication overflow errors irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x irqchip: irq-xtensa-mx: fix initial IRQ affinity mac80211: upgrade passive scan to active scan on DFS channels after beacon rx um: chan_user: Fix winch_tramp() return value um: Fix out-of-bounds read in LDT setup iommu/msm: Fix an incorrect NULL check on list iterator nodemask.h: fix compilation error with GCC12 hugetlb: fix huge_pmd_unshare address update rtl818x: Prevent using not initialized queues ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control carl9170: tx: fix an incorrect use of list iterator gma500: fix an incorrect NULL check on list iterator docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0 dt-bindings: gpio: altera: correct interrupt-cells RDMA/rxe: Generate a completion for unsupported/invalid opcode MIPS: IP27: Remove incorrect `cpu_has_fpu' override netfilter: nf_tables: disallow non-stateful expression in sets earlier pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards staging: greybus: codecs: fix type confusion of list iterator variable usb: usbip: fix a refcount leak in stub_probe() usb: usbip: add missing device lock on tweak configuration cmd USB: storage: karma: fix rio_karma_init return pwm: lp3943: Fix duty calculation in case period was clamped rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value rtc: mt6397: check return value after calling platform_get_resource() serial: meson: acquire port->lock in startup() serial: digicolor-usart: Don't allow CS5-6 serial: txx9: Don't allow CS5-6 serial: sh-sci: Don't allow CS5-6 serial: st-asc: Sanitize CSIZE and correct PARENB for CS7 firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry() modpost: fix removing numeric suffixes jffs2: fix memory leak in jffs2_do_fill_super tcp: tcp_rtx_synack() can be called from process context tracing: Avoid adding tracer option before update_tracer_options i2c: cadence: Increase timeout per message if necessary m68knommu: set ZERO_PAGE() to the allocated zeroed page m68knommu: fix undefined reference to `_init_sp' video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove() net: fix nla_strcmp to handle more then one trailing null character ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer() net: xfrm: unexport __init-annotated xfrm4_protocol_init() net: altera: Fix refcount leak in altera_tse_mdio_create iio: dummy: iio_simple_dummy: check the return value of kstrdup() lkdtm/usercopy: Expand size of "out of frame" object tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() tty: Fix a possible resource leak in icom_probe drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() USB: host: isp116x: check return value after calling platform_get_resource() drivers: tty: serial: Fix deadlock in sa1100_set_termios() drivers: usb: host: Fix deadlock in oxu_bus_suspend() USB: hcd-pci: Fully suspend across freeze/thaw cycle usb: dwc2: gadget: don't reset gadget's driver->bus misc: rtsx: set NULL intfdata when probe fails clocksource/drivers/sp804: Avoid error on multiple instances staging: rtl8712: fix uninit-value in r871xu_drv_init() serial: msm_serial: disable interrupts in __msm_console_write() md: protect md_unregister_thread from reentrancy Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process" drm/radeon: fix a possible null pointer dereference modpost: fix undefined behavior of is_arm_mapping_symbol() nodemask: Fix return values to be unsigned vringh: Fix loop descriptors check in the indirect cases ALSA: hda/conexant - Fix loopback issue with CX20632 cifs: return errors during session setup during reconnects ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag powerpc/32: Fix overread/overwrite of thread_struct via ptrace mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N PCI: qcom: Fix unbalanced PHY init on probe errors tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd Linux 4.9.318 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I2028f3dcd422886bf997ec7e1d2ae86515f1bfb9
304 lines
7.0 KiB
C
304 lines
7.0 KiB
C
/*
|
|
* Copyright (C) 2000 - 2007 Jeff Dike (jdike@{linux.intel,addtoit}.com)
|
|
* Licensed under the GPL
|
|
*/
|
|
|
|
#include <stdlib.h>
|
|
#include <unistd.h>
|
|
#include <errno.h>
|
|
#include <sched.h>
|
|
#include <signal.h>
|
|
#include <termios.h>
|
|
#include <sys/ioctl.h>
|
|
#include "chan_user.h"
|
|
#include <os.h>
|
|
#include <um_malloc.h>
|
|
|
|
void generic_close(int fd, void *unused)
|
|
{
|
|
close(fd);
|
|
}
|
|
|
|
int generic_read(int fd, char *c_out, void *unused)
|
|
{
|
|
int n;
|
|
|
|
n = read(fd, c_out, sizeof(*c_out));
|
|
if (n > 0)
|
|
return n;
|
|
else if (errno == EAGAIN)
|
|
return 0;
|
|
else if (n == 0)
|
|
return -EIO;
|
|
return -errno;
|
|
}
|
|
|
|
/* XXX Trivial wrapper around write */
|
|
|
|
int generic_write(int fd, const char *buf, int n, void *unused)
|
|
{
|
|
int err;
|
|
|
|
err = write(fd, buf, n);
|
|
if (err > 0)
|
|
return err;
|
|
else if (errno == EAGAIN)
|
|
return 0;
|
|
else if (err == 0)
|
|
return -EIO;
|
|
return -errno;
|
|
}
|
|
|
|
int generic_window_size(int fd, void *unused, unsigned short *rows_out,
|
|
unsigned short *cols_out)
|
|
{
|
|
struct winsize size;
|
|
int ret;
|
|
|
|
if (ioctl(fd, TIOCGWINSZ, &size) < 0)
|
|
return -errno;
|
|
|
|
ret = ((*rows_out != size.ws_row) || (*cols_out != size.ws_col));
|
|
|
|
*rows_out = size.ws_row;
|
|
*cols_out = size.ws_col;
|
|
|
|
return ret;
|
|
}
|
|
|
|
void generic_free(void *data)
|
|
{
|
|
kfree(data);
|
|
}
|
|
|
|
int generic_console_write(int fd, const char *buf, int n)
|
|
{
|
|
sigset_t old, no_sigio;
|
|
struct termios save, new;
|
|
int err;
|
|
|
|
if (isatty(fd)) {
|
|
sigemptyset(&no_sigio);
|
|
sigaddset(&no_sigio, SIGIO);
|
|
if (sigprocmask(SIG_BLOCK, &no_sigio, &old))
|
|
goto error;
|
|
|
|
CATCH_EINTR(err = tcgetattr(fd, &save));
|
|
if (err)
|
|
goto error;
|
|
new = save;
|
|
/*
|
|
* The terminal becomes a bit less raw, to handle \n also as
|
|
* "Carriage Return", not only as "New Line". Otherwise, the new
|
|
* line won't start at the first column.
|
|
*/
|
|
new.c_oflag |= OPOST;
|
|
CATCH_EINTR(err = tcsetattr(fd, TCSAFLUSH, &new));
|
|
if (err)
|
|
goto error;
|
|
}
|
|
err = generic_write(fd, buf, n, NULL);
|
|
/*
|
|
* Restore raw mode, in any case; we *must* ignore any error apart
|
|
* EINTR, except for debug.
|
|
*/
|
|
if (isatty(fd)) {
|
|
CATCH_EINTR(tcsetattr(fd, TCSAFLUSH, &save));
|
|
sigprocmask(SIG_SETMASK, &old, NULL);
|
|
}
|
|
|
|
return err;
|
|
error:
|
|
return -errno;
|
|
}
|
|
|
|
/*
|
|
* UML SIGWINCH handling
|
|
*
|
|
* The point of this is to handle SIGWINCH on consoles which have host
|
|
* ttys and relay them inside UML to whatever might be running on the
|
|
* console and cares about the window size (since SIGWINCH notifies
|
|
* about terminal size changes).
|
|
*
|
|
* So, we have a separate thread for each host tty attached to a UML
|
|
* device (side-issue - I'm annoyed that one thread can't have
|
|
* multiple controlling ttys for the purpose of handling SIGWINCH, but
|
|
* I imagine there are other reasons that doesn't make any sense).
|
|
*
|
|
* SIGWINCH can't be received synchronously, so you have to set up to
|
|
* receive it as a signal. That being the case, if you are going to
|
|
* wait for it, it is convenient to sit in sigsuspend() and wait for
|
|
* the signal to bounce you out of it (see below for how we make sure
|
|
* to exit only on SIGWINCH).
|
|
*/
|
|
|
|
static void winch_handler(int sig)
|
|
{
|
|
}
|
|
|
|
struct winch_data {
|
|
int pty_fd;
|
|
int pipe_fd;
|
|
};
|
|
|
|
static int winch_thread(void *arg)
|
|
{
|
|
struct winch_data *data = arg;
|
|
sigset_t sigs;
|
|
int pty_fd, pipe_fd;
|
|
int count;
|
|
char c = 1;
|
|
|
|
pty_fd = data->pty_fd;
|
|
pipe_fd = data->pipe_fd;
|
|
count = write(pipe_fd, &c, sizeof(c));
|
|
if (count != sizeof(c))
|
|
printk(UM_KERN_ERR "winch_thread : failed to write "
|
|
"synchronization byte, err = %d\n", -count);
|
|
|
|
/*
|
|
* We are not using SIG_IGN on purpose, so don't fix it as I thought to
|
|
* do! If using SIG_IGN, the sigsuspend() call below would not stop on
|
|
* SIGWINCH.
|
|
*/
|
|
|
|
signal(SIGWINCH, winch_handler);
|
|
sigfillset(&sigs);
|
|
/* Block all signals possible. */
|
|
if (sigprocmask(SIG_SETMASK, &sigs, NULL) < 0) {
|
|
printk(UM_KERN_ERR "winch_thread : sigprocmask failed, "
|
|
"errno = %d\n", errno);
|
|
exit(1);
|
|
}
|
|
/* In sigsuspend(), block anything else than SIGWINCH. */
|
|
sigdelset(&sigs, SIGWINCH);
|
|
|
|
if (setsid() < 0) {
|
|
printk(UM_KERN_ERR "winch_thread : setsid failed, errno = %d\n",
|
|
errno);
|
|
exit(1);
|
|
}
|
|
|
|
if (ioctl(pty_fd, TIOCSCTTY, 0) < 0) {
|
|
printk(UM_KERN_ERR "winch_thread : TIOCSCTTY failed on "
|
|
"fd %d err = %d\n", pty_fd, errno);
|
|
exit(1);
|
|
}
|
|
|
|
if (tcsetpgrp(pty_fd, os_getpid()) < 0) {
|
|
printk(UM_KERN_ERR "winch_thread : tcsetpgrp failed on "
|
|
"fd %d err = %d\n", pty_fd, errno);
|
|
exit(1);
|
|
}
|
|
|
|
/*
|
|
* These are synchronization calls between various UML threads on the
|
|
* host - since they are not different kernel threads, we cannot use
|
|
* kernel semaphores. We don't use SysV semaphores because they are
|
|
* persistent.
|
|
*/
|
|
count = read(pipe_fd, &c, sizeof(c));
|
|
if (count != sizeof(c))
|
|
printk(UM_KERN_ERR "winch_thread : failed to read "
|
|
"synchronization byte, err = %d\n", errno);
|
|
|
|
while(1) {
|
|
/*
|
|
* This will be interrupted by SIGWINCH only, since
|
|
* other signals are blocked.
|
|
*/
|
|
sigsuspend(&sigs);
|
|
|
|
count = write(pipe_fd, &c, sizeof(c));
|
|
if (count != sizeof(c))
|
|
printk(UM_KERN_ERR "winch_thread : write failed, "
|
|
"err = %d\n", errno);
|
|
}
|
|
}
|
|
|
|
static int winch_tramp(int fd, struct tty_port *port, int *fd_out,
|
|
unsigned long *stack_out)
|
|
{
|
|
struct winch_data data;
|
|
int fds[2], n, err, pid;
|
|
char c;
|
|
|
|
err = os_pipe(fds, 1, 1);
|
|
if (err < 0) {
|
|
printk(UM_KERN_ERR "winch_tramp : os_pipe failed, err = %d\n",
|
|
-err);
|
|
goto out;
|
|
}
|
|
|
|
data = ((struct winch_data) { .pty_fd = fd,
|
|
.pipe_fd = fds[1] } );
|
|
/*
|
|
* CLONE_FILES so this thread doesn't hold open files which are open
|
|
* now, but later closed in a different thread. This is a
|
|
* problem with /dev/net/tun, which if held open by this
|
|
* thread, prevents the TUN/TAP device from being reused.
|
|
*/
|
|
pid = run_helper_thread(winch_thread, &data, CLONE_FILES, stack_out);
|
|
if (pid < 0) {
|
|
err = pid;
|
|
printk(UM_KERN_ERR "fork of winch_thread failed - errno = %d\n",
|
|
-err);
|
|
goto out_close;
|
|
}
|
|
|
|
*fd_out = fds[0];
|
|
n = read(fds[0], &c, sizeof(c));
|
|
if (n != sizeof(c)) {
|
|
printk(UM_KERN_ERR "winch_tramp : failed to read "
|
|
"synchronization byte\n");
|
|
printk(UM_KERN_ERR "read failed, err = %d\n", errno);
|
|
printk(UM_KERN_ERR "fd %d will not support SIGWINCH\n", fd);
|
|
err = -EINVAL;
|
|
goto out_close;
|
|
}
|
|
|
|
err = os_set_fd_block(*fd_out, 0);
|
|
if (err) {
|
|
printk(UM_KERN_ERR "winch_tramp: failed to set thread_fd "
|
|
"non-blocking.\n");
|
|
goto out_close;
|
|
}
|
|
|
|
return pid;
|
|
|
|
out_close:
|
|
close(fds[1]);
|
|
close(fds[0]);
|
|
out:
|
|
return err;
|
|
}
|
|
|
|
void register_winch(int fd, struct tty_port *port)
|
|
{
|
|
unsigned long stack;
|
|
int pid, thread, count, thread_fd = -1;
|
|
char c = 1;
|
|
|
|
if (!isatty(fd))
|
|
return;
|
|
|
|
pid = tcgetpgrp(fd);
|
|
if (is_skas_winch(pid, fd, port)) {
|
|
register_winch_irq(-1, fd, -1, port, 0);
|
|
return;
|
|
}
|
|
|
|
if (pid == -1) {
|
|
thread = winch_tramp(fd, port, &thread_fd, &stack);
|
|
if (thread < 0)
|
|
return;
|
|
|
|
register_winch_irq(thread_fd, fd, thread, port, stack);
|
|
|
|
count = write(thread_fd, &c, sizeof(c));
|
|
if (count != sizeof(c))
|
|
printk(UM_KERN_ERR "register_winch : failed to write "
|
|
"synchronization byte, err = %d\n", errno);
|
|
}
|
|
}
|