Patch "tty: fix __tty_insert_flip_char regression" has been added to the 4.4-stable tree

Patch "tty: fix __tty_insert_flip_char regression" has been added to the 4.4-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    tty: fix __tty_insert_flip_char regression

to the 4.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tty-fix-__tty_insert_flip_char-regression.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 8a5a90a2a477b86a3dc2eaa5a706db9bfdd647ca Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Wed, 2 Aug 2017 13:11:39 +0200
Subject: tty: fix __tty_insert_flip_char regression

From: Arnd Bergmann <arnd@arndb.de>

commit 8a5a90a2a477b86a3dc2eaa5a706db9bfdd647ca upstream.

Sergey noticed a small but fatal mistake in __tty_insert_flip_char,
leading to an oops in an interrupt handler when using any serial
port.

The problem is that I accidentally took the tty_buffer pointer
before calling __tty_buffer_request_room(), which replaces the
buffer. This moves the pointer lookup to the right place after
allocating the new buffer space.

Fixes: 979990c62848 ("tty: improve tty_insert_flip_char() fast path")
Reported-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Tested-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/tty_buffer.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -372,12 +372,13 @@ EXPORT_SYMBOL(tty_insert_flip_string_fla
  */
 int __tty_insert_flip_char(struct tty_port *port, unsigned char ch, char flag)
 {
-	struct tty_buffer *tb = port->buf.tail;
+	struct tty_buffer *tb;
 	int flags = (flag == TTY_NORMAL) ? TTYB_NORMAL : 0;
 
 	if (!__tty_buffer_request_room(port, 1, flags))
 		return 0;
 
+	tb = port->buf.tail;
 	if (~tb->flags & TTYB_NORMAL)
 		*flag_buf_ptr(tb, tb->used) = flag;
 	*char_buf_ptr(tb, tb->used++) = ch;


Patches currently in stable-queue which might be from arnd@arndb.de are

queue-4.4/qlge-avoid-memcpy-buffer-overflow.patch
queue-4.4/tty-fix-__tty_insert_flip_char-regression.patch
queue-4.4/tty-improve-tty_insert_flip_char-fast-path.patch
queue-4.4/tty-improve-tty_insert_flip_char-slow-path.patch

Re: Patch "tty: fix __tty_insert_flip_char regression" has been added to the 4.4-stable tree

[Arnd Bergmann]

On Thu, Sep 21, 2017 at 1:37 PM,  <gregkh@linuxfoundation.org> wrote:
>
> This is a note to let you know that I've just added the patch titled
>
>     tty: fix __tty_insert_flip_char regression
>
> to the 4.4-stable tree which can be found at:
>     http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
>
> The filename of the patch is:
>      tty-fix-__tty_insert_flip_char-regression.patch
> and it can be found in the queue-4.4 subdirectory.
>
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable@vger.kernel.org> know about it.
>

Hmm I thought I had sent a backported version for stable that just contains
the 'fast path' plus with the bugfix, but I must have forgotten to actually
send it out.

Anyway, taking all three patches for stable should also work, no need
to revisit unless you would prefer to drop the 'slow path' patch.

       Arnd

Re: Patch "tty: fix __tty_insert_flip_char regression" has been added to the 4.4-stable tree

[gregkh]

On Thu, Sep 21, 2017 at 01:42:56PM +0200, Arnd Bergmann wrote:
> On Thu, Sep 21, 2017 at 1:37 PM,  <gregkh@linuxfoundation.org> wrote:
> >
> > This is a note to let you know that I've just added the patch titled
> >
> >     tty: fix __tty_insert_flip_char regression
> >
> > to the 4.4-stable tree which can be found at:
> >     http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
> >
> > The filename of the patch is:
> >      tty-fix-__tty_insert_flip_char-regression.patch
> > and it can be found in the queue-4.4 subdirectory.
> >
> > If you, or anyone else, feels it should not be added to the stable tree,
> > please let <stable@vger.kernel.org> know about it.
> >
> 
> Hmm I thought I had sent a backported version for stable that just contains
> the 'fast path' plus with the bugfix, but I must have forgotten to actually
> send it out.
> 
> Anyway, taking all three patches for stable should also work, no need
> to revisit unless you would prefer to drop the 'slow path' patch.

Keeping in sync is good, I'll just take all 3, thanks.

greg k-h