A -next commit "TTY: HVC, use tty from tty_port" switched the driver
to use tty_port helper for tty refcounting. But it omitted to remove
manual tty refcounting from open, close and hangup. So now we are
getting random crashes caused by use-after-free:
Unable to handle kernel paging request for data at address 0xc0000003f9d550
Faulting instruction address: 0xc0000000001b7f40
Oops: Kernel access of bad area, sig: 11 [#1]
...
NIP: c0000000001b7f40 LR: c0000000001b7f14 CTR: c0000000000e04f0
...
NIP [c0000000001b7f40] .__kmalloc+0x70/0x230
LR [c0000000001b7f14] .__kmalloc+0x44/0x230
Call Trace:
[c0000003f68bf930] [c0000003f68bf9b0] 0xc0000003f68bf9b0 (unreliable)
[c0000003f68bf9e0] [c0000000001e5424] .alloc_fdmem+0x24/0x70
[c0000003f68bfa60] [c0000000001e54f8] .alloc_fdtable+0x88/0x130
[c0000003f68bfaf0] [c0000000001e5924] .dup_fd+0x384/0x450
[c0000003f68bfbd0] [c00000000009a310] .copy_process+0x880/0x11d0
[c0000003f68bfcd0] [c00000000009aee0] .do_fork+0x70/0x400
[c0000003f68bfdc0] [c0000000000141c4] .sys_clone+0x54/0x70
[c0000003f68bfe30] [c000000000009aa0] .ppc_clone+0x8/0xc

Fix that by complete removal of tty_kref_get/put in open/close/hangup
paths.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Reported-and-tested-by: NMichael Neuling <mikey@neuling.org>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: ppc-dev <linuxppc-dev@lists.ozlabs.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Commit "ISDN: i4l, remove cvs crap" removed definition of
isdn_tty_revision, but there is still a user. So this causes linking
errors. This was hidden from my radar because the variable was not
declared in any header. Instead isdn_common.c declares it locally.

So remove this variable also from isdn_common.c, because there is
really no way to find out the version. Git commit or tag is...
Reported-by: NStephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Karsten Keil <isdn@linux-pingi.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

tty_buffer_request_room is well protected, but while after it returns,
 it releases the port->lock. tty->buf.tail might be modified
by either irq handler or other threads. The patch adds more protection
by holding the lock across tty buffer finding and buffer filling.
Signed-off-by: NAlek Du <alek.du@intel.com>
Signed-off-by: NXiaobing Tu <xiaobing.tu@intel.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

set_get_cmap() ignored the result of {get,put}_user(), causing ioctl(vt,
{G,P}IO_CMAP, 0xdeadbeef) to silently fail.

Another side effect of this: calling the PIO_CMAP ioctl with an invalid
buffer would zero the default colormap and the palette for all vts (all
colors set to black).

Leave the default colormap intact and return -EFAULT when
reading/writing to the userspace buffer fails.
Signed-off-by: NMichael Gehring <mg@ebfe.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Add initialize variable to prevent duplicate free memory.
Signed-off-by: NTomoya MORINAGA <tomoya.rohm@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Currently, occurring line status interrupt,
returned value is not set in interrupt handler function.
As a result, 0 can be returned.

This patch adds setting returned value.
Signed-off-by: NTomoya MORINAGA <tomoya.rohm@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NTomoya MORINAGA <tomoya.rohm@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NTomoya MORINAGA <tomoya.rohm@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

%02x format is easier to understand better than %d.
Signed-off-by: NTomoya MORINAGA <tomoya.rohm@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Target uart register access size is 8bit.
However, 32bit is used at 2 points.

This patch modifies type "unsigned int" to "unsigned char".
Signed-off-by: NTomoya MORINAGA <tomoya.rohm@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NTomoya MORINAGA <tomoya.rohm@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This means converting an atomic counter to a counter protected by
lock. This is the first step needed to convert the rest of the code to
the tty_port helpers.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

tty_wakeup is safe to be called from all contexts. No need to schedule
a work for that. Let us call it directly like in other drivers.

This allows us to kill another member of rfcomm_dev structure.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Switch the refcounting from manual atomic plays with refcounter to the
one offered by tty_port.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

And use tty from there.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

And use count from there.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Since the code is identical, use the tty_port_block_til_ready helper
instead of re-implemented variant.

The code does not perform rtsdts handling, hence we do not need to
provide tty port hooks for them. The default ones will be used
instead. The only necessary thing is to provide tty_port_operations.
It is empty, but has to be there...
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

And refcount that properly.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

We need tty at some places, but info->tty might be NULL at those. Let
us propagate tty from callers where we know we have a valid tty. This
will make a switch to tty refcounting simpler.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

And use count and blocked_count from that.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

All the needed stuff is moved to 68328serial.c now.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

flags passed to local_irq_save/restore should be ulong. Switch tehem
to that. Otherwise we get compilation warnings:
.../68328serial.c:248:9: warning: comparison of distinct pointer types lacks a cast [enabled by default]
.../68328serial.c:257:9: warning: comparison of distinct pointer types lacks a cast [enabled by default]
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

- empty functions
- unused global variables
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Not everything from struct m68k_serial is really used. So remove
unused or only-set members of that structure. Next step is to move it
to 68328serial.c and remove 68328serial.h completely.

This change also takes status_handle and batten_down_hatches away
since they use break_abort but do nothing.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

serial_state in 68328serial.h is a duplicated structure. One is
defined in linux/serial.h. So let us use that instead. And since the
serial flags are identical, use ones from there too.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: NGreg Ungerer <gerg@uclinux.org>
Cc: linux-m68k@lists.linux-m68k.org
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

It does not make the driver less racy though. Close and hangup should
be rewritten and tty refcounting used properly.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Jiri Kosina <jkosina@suse.cz>
Acked-by: NDavid Sterba <dsterba@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

And use count from that.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Jiri Kosina <jkosina@suse.cz>
Acked-by: NDavid Sterba <dsterba@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

There are two functions which only print a status. Let us do that
directly at places where they are called.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Jiri Kosina <jkosina@suse.cz>
Acked-by: NDavid Sterba <dsterba@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Do not touch internal workqueue. Call tty_vhangup instead.

Note that finished hangup does not necessarily mean that all processes
are dead. Especially when the tty is a console. The code assumes that
right now.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Jiri Kosina <jkosina@suse.cz>
Acked-by: NDavid Sterba <dsterba@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Now, we switch to the refcounted model and do not need hp->lock to
protect hp->tty anymore.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

- use tty, not hp->tty wherever possible
- pass tty down to some functions and go to step one
- do not defer tty_hangup calls -- it is as simple as schedule_work,
  so might be called with hp->lock held
- do not defer tty buffer flips -- since the driver does not use
  low_latency (it cannot actually), the flip is a simple tail move
  plus schedule_work. It will make our life easier in the next patch.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

And use count from there.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

It is in termios cflags. So change the test in hvsi_recv_control to do
the right thing. Previously it was actually testing TTY_LDISC_OPEN
bit, i.e. whether an ldisc is active. And yes, it is most of the time.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

No refcounting, just a switch. The locking in the driver prevents
races, so in fact the refcounting is not needed. But while we have a
tty in tty_port, don't duplicate that and remove the one from
hvcs_struct.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

A simple switch. Except we convert destroy_hvcs_struct to be
tty_port_operations->destruct...
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>