linux-kernel - [PATCH tty-next v1 3/4] serial: 8250: Never adjust UART_LSR_DR in @read_status

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20241216171244.12783-4-john.ogness@linutronix.de>
Date: Mon, 16 Dec 2024 18:18:43 +0106
From: John Ogness <john.ogness@...utronix.de>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: Jiri Slaby <jirislaby@...nel.org>,
	Esben Haabendal <esben@...nix.com>,
	linux-serial@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Petr Mladek <pmladek@...e.com>,
	Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
	Arnd Bergmann <arnd@...db.de>,
	Tony Lindgren <tony@...mide.com>,
	Kevin Hilman <khilman@...libre.com>,
	Markus Schneider-Pargmann <msp@...libre.com>,
	Udit Kumar <u-kumar1@...com>,
	Griffin Kroah-Hartman <griffin@...ah.com>,
	Rengarajan S <rengarajan.s@...rochip.com>,
	Guenter Roeck <linux@...ck-us.net>,
	Jeff Johnson <quic_jjohnson@...cinc.com>,
	Niklas Schnelle <schnelle@...ux.ibm.com>,
	Serge Semin <fancer.lancer@...il.com>,
	Lino Sanfilippo <l.sanfilippo@...bus.com>,
	Peter Collingbourne <pcc@...gle.com>
Subject: [PATCH tty-next v1 3/4] serial: 8250: Never adjust UART_LSR_DR in @read_status_mask

The CREAD feature of termios is implemented by setting/clearing
UART_LSR_DR within @ignore_status_mask. For this feature to
function correctly, it requires that UART_LSR_DR is never
masked (unset) in @read_status_mask so that uart_insert_char()
can properly drop the character if CREAD is disabled.

Currently there are code paths that clear/set UART_LSR_DR from
@read_status_mask at times. This appears to be a relic from
Linux 1.1.60, where @read_status_mask could be used to mask
all UART_LSR reading. However, since Linux 2.1.8 that is no
longer the case. Now if UART_LSR_DR is cleared from
@read_status_mask, received characters may not be dropped
even though CREAD is disabled.

This can be seen when:

- CREAD is disabled (UART_LSR_DR is set in @ignore_status_mask)
- LSR has an error bit set from UART_LSR_BRK_ERROR_BITS
  (and that error is not ignored via @ignore_status_mask)
- UART_LSR_DR is cleared in @read_status_mask

In this case characters will be inserted into the tty buffer
even though they should be ignored.

Remove all setting/clearing of UART_LSR_DR for
@read_status_mask except for its initialization.

Signed-off-by: John Ogness <john.ogness@...utronix.de>
---
 drivers/tty/serial/8250/8250_core.c | 1 -
 drivers/tty/serial/8250/8250_omap.c | 1 -
 drivers/tty/serial/8250/8250_port.c | 1 -
 3 files changed, 3 deletions(-)

diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index 5f9f06911795..2b70e82dffeb 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -675,7 +675,6 @@ static void serial_8250_overrun_backoff_work(struct work_struct *work)
 
 	uart_port_lock_irqsave(port, &flags);
 	up->ier |= UART_IER_RLSI | UART_IER_RDI;
-	up->port.read_status_mask |= UART_LSR_DR;
 	serial_out(up, UART_IER, up->ier);
 	uart_port_unlock_irqrestore(port, flags);
 }
diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index 5290aed76a5e..10144fcc0363 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -838,7 +838,6 @@ static void omap_8250_unthrottle(struct uart_port *port)
 	if (up->dma)
 		up->dma->rx_dma(up);
 	up->ier |= UART_IER_RLSI | UART_IER_RDI;
-	port->read_status_mask |= UART_LSR_DR;
 	serial_out(up, UART_IER, up->ier);
 	uart_port_unlock_irqrestore(port, flags);
 
diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index a5c1b069c67b..3b9dc2bb06eb 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -1390,7 +1390,6 @@ static void serial8250_stop_rx(struct uart_port *port)
 	serial8250_rpm_get(up);
 
 	up->ier &= ~(UART_IER_RLSI | UART_IER_RDI);
-	up->port.read_status_mask &= ~UART_LSR_DR;
 	serial_port_out(port, UART_IER, up->ier);
 
 	serial8250_rpm_put(up);
-- 
2.39.5