[GIT PULL] TTY/Serial driver fixes for 6.2-rc7

[GIT PULL] TTY/Serial driver fixes for 6.2-rc7

[Greg KH]

The following changes since commit 2241ab53cbb5cdb08a6b2d4688feb13971058f65:

  Linux 6.2-rc5 (2023-01-21 16:27:01 -0800)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git tags/tty-6.2-rc7

for you to fetch changes up to 226fae124b2dac217ea5436060d623ff3385bc34:

  vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF (2023-01-31 15:51:52 +0100)

----------------------------------------------------------------
TTY/Serial driver fixes for 6.2-rc7

Here are some small serial and vt fixes for 6.2-rc7.  These include:
  - 8250 driver fixes relating to dma issues
  - stm32 serial driver fix for threaded irqs
  - vc_screen bugfix for reported problems.

All have been in linux-next for a while with no reported problems.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

----------------------------------------------------------------
George Kennedy (1):
      vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF

Ilpo Järvinen (2):
      serial: 8250_dma: Fix DMA Rx completion race
      serial: 8250_dma: Fix DMA Rx rearm race

Marek Vasut (1):
      serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler

 drivers/tty/serial/8250/8250_dma.c | 21 +++++++++++++++++----
 drivers/tty/serial/stm32-usart.c   | 33 +++++----------------------------
 drivers/tty/vt/vc_screen.c         |  9 +++++----
 3 files changed, 27 insertions(+), 36 deletions(-)

Re: [GIT PULL] TTY/Serial driver fixes for 6.2-rc7

[Linus Torvalds]

On Sun, Feb 5, 2023 at 3:53 AM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> George Kennedy (1):
>       vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF

Hmm.

I think the "goto unlock_out" should be a "break". A partial read
should return the partial success, not an error.

That situation didn't exist when the check was outside the loop, but does now.

Now, I don't think this matters for any sane situation, but since I
looked at this patch I thought I'd mention it.

                   Linus

Re: [GIT PULL] TTY/Serial driver fixes for 6.2-rc7

[Greg KH]

On Sun, Feb 05, 2023 at 12:17:05PM -0800, Linus Torvalds wrote:
> On Sun, Feb 5, 2023 at 3:53 AM Greg KH <gregkh@linuxfoundation.org> wrote:
> >
> > George Kennedy (1):
> >       vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
> 
> Hmm.
> 
> I think the "goto unlock_out" should be a "break". A partial read
> should return the partial success, not an error.
> 
> That situation didn't exist when the check was outside the loop, but does now.
> 
> Now, I don't think this matters for any sane situation, but since I
> looked at this patch I thought I'd mention it.

Fair enough, George, can you send a follow-on patch to fix this up?

thanks,

greg k-h

Re: [GIT PULL] TTY/Serial driver fixes for 6.2-rc7

[George Kennedy]

On 2/6/2023 2:38 AM, Greg KH wrote:
> On Sun, Feb 05, 2023 at 12:17:05PM -0800, Linus Torvalds wrote:
>> On Sun, Feb 5, 2023 at 3:53 AM Greg KH <gregkh@linuxfoundation.org> wrote:
>>> George Kennedy (1):
>>>        vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
>> Hmm.
>>
>> I think the "goto unlock_out" should be a "break". A partial read
>> should return the partial success, not an error.
>>
>> That situation didn't exist when the check was outside the loop, but does now.
>>
>> Now, I don't think this matters for any sane situation, but since I
>> looked at this patch I thought I'd mention it.
> Fair enough, George, can you send a follow-on patch to fix this up?
Hi Greg,

Will send a follow-on patch.

Thanks,
George
>
> thanks,
>
> greg k-h

Re: [GIT PULL] TTY/Serial driver fixes for 6.2-rc7

[pr-tracker-bot]

The pull request you sent on Sun, 5 Feb 2023 12:53:35 +0100:

> git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git tags/tty-6.2-rc7

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/dc0ce181af6d1989192b973eae5f916cb6ce47f0

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html