Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a6b68a69 authored by Paul Fulghum's avatar Paul Fulghum Committed by Greg Kroah-Hartman
Browse files

synclink fix ldisc buffer argument 



Fix call to line discipline receive_buf by synclink drivers.
Dummy flag buffer argument is ignored by N_HDLC line discipline but might
be of insufficient size if accessed by a different line discipline
selected by mistake. flag buffer allocation now matches max size of data
buffer. Unused char_buf buffers are removed.

Signed-off-by: default avatarPaul Fulghum <paulkf@microgate.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 55c7c0fd

drivers/char/pcmcia/synclink_cs.c

+11 −1
Original line number Diff line number Diff line
@@ -210,7 +210,7 @@ typedef struct _mgslpc_info { 
	char testing_irq;

	unsigned int init_error;	/* startup error (DIAGS)	*/



	char flag_buf[MAX_ASYNC_BUFFER_SIZE];

	char *flag_buf;

	bool drop_rts_on_tx_done;



	struct	_input_signal_events	input_signal_events;
@@ -2674,6 +2674,14 @@ static int rx_alloc_buffers(MGSLPC_INFO *info) 
	if (info->rx_buf == NULL)

		return -ENOMEM;



	/* unused flag buffer to satisfy receive_buf calling interface */

	info->flag_buf = kzalloc(info->max_frame_size, GFP_KERNEL);

	if (!info->flag_buf) {

		kfree(info->rx_buf);

		info->rx_buf = NULL;

		return -ENOMEM;

	}

	

	rx_reset_buffers(info);

	return 0;

}
@@ -2682,6 +2690,8 @@ static void rx_free_buffers(MGSLPC_INFO *info) 
{

	kfree(info->rx_buf);

	info->rx_buf = NULL;

	kfree(info->flag_buf);

	info->flag_buf = NULL;

}



static int claim_resources(MGSLPC_INFO *info)

drivers/tty/synclink.c

+10 −3
Original line number Diff line number Diff line
@@ -291,8 +291,7 @@ struct mgsl_struct { 
	bool lcr_mem_requested;



	u32 misc_ctrl_value;

	char flag_buf[MAX_ASYNC_BUFFER_SIZE];

	char char_buf[MAX_ASYNC_BUFFER_SIZE];	

	char *flag_buf;

	bool drop_rts_on_tx_done;



	bool loopmode_insert_requested;
@@ -3898,7 +3897,13 @@ static int mgsl_alloc_intermediate_rxbuffer_memory(struct mgsl_struct *info) 
	info->intermediate_rxbuffer = kmalloc(info->max_frame_size, GFP_KERNEL | GFP_DMA);

	if ( info->intermediate_rxbuffer == NULL )

		return -ENOMEM;



	/* unused flag buffer to satisfy receive_buf calling interface */

	info->flag_buf = kzalloc(info->max_frame_size, GFP_KERNEL);

	if (!info->flag_buf) {

		kfree(info->intermediate_rxbuffer);

		info->intermediate_rxbuffer = NULL;

		return -ENOMEM;

	}

	return 0;



}	/* end of mgsl_alloc_intermediate_rxbuffer_memory() */
@@ -3917,6 +3922,8 @@ static void mgsl_free_intermediate_rxbuffer_memory(struct mgsl_struct *info) 
{

	kfree(info->intermediate_rxbuffer);

	info->intermediate_rxbuffer = NULL;

	kfree(info->flag_buf);

	info->flag_buf = NULL;



}	/* end of mgsl_free_intermediate_rxbuffer_memory() */

drivers/tty/synclink_gt.c

+16 −2
Original line number Diff line number Diff line
@@ -317,8 +317,7 @@ struct slgt_info { 
	unsigned char *tx_buf;

	int tx_count;



	char flag_buf[MAX_ASYNC_BUFFER_SIZE];

	char char_buf[MAX_ASYNC_BUFFER_SIZE];

	char *flag_buf;

	bool drop_rts_on_tx_done;

	struct	_input_signal_events	input_signal_events;
@@ -3355,11 +3354,24 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp, 
	return retval;

}



/*

 * allocate buffers used for calling line discipline receive_buf

 * directly in synchronous mode

 * note: add 5 bytes to max frame size to allow appending

 * 32-bit CRC and status byte when configured to do so

 */

static int alloc_tmp_rbuf(struct slgt_info *info)

{

	info->tmp_rbuf = kmalloc(info->max_frame_size + 5, GFP_KERNEL);

	if (info->tmp_rbuf == NULL)

		return -ENOMEM;

	/* unused flag buffer to satisfy receive_buf calling interface */

	info->flag_buf = kzalloc(info->max_frame_size + 5, GFP_KERNEL);

	if (!info->flag_buf) {

		kfree(info->tmp_rbuf);

		info->tmp_rbuf = NULL;

		return -ENOMEM;

	}

	return 0;

}
@@ -3367,6 +3379,8 @@ static void free_tmp_rbuf(struct slgt_info *info) 
{

	kfree(info->tmp_rbuf);

	info->tmp_rbuf = NULL;

	kfree(info->flag_buf);

	info->flag_buf = NULL;

}



/*

drivers/tty/synclinkmp.c

+10 −2
Original line number Diff line number Diff line
@@ -262,8 +262,7 @@ typedef struct _synclinkmp_info { 
	bool sca_statctrl_requested;



	u32 misc_ctrl_value;

	char flag_buf[MAX_ASYNC_BUFFER_SIZE];

	char char_buf[MAX_ASYNC_BUFFER_SIZE];

	char *flag_buf;

	bool drop_rts_on_tx_done;



	struct	_input_signal_events	input_signal_events;
@@ -3553,6 +3552,13 @@ static int alloc_tmp_rx_buf(SLMP_INFO *info) 
	info->tmp_rx_buf = kmalloc(info->max_frame_size, GFP_KERNEL);

	if (info->tmp_rx_buf == NULL)

		return -ENOMEM;

	/* unused flag buffer to satisfy receive_buf calling interface */

	info->flag_buf = kzalloc(info->max_frame_size, GFP_KERNEL);

	if (!info->flag_buf) {

		kfree(info->tmp_rx_buf);

		info->tmp_rx_buf = NULL;

		return -ENOMEM;

	}

	return 0;

}
@@ -3560,6 +3566,8 @@ static void free_tmp_rx_buf(SLMP_INFO *info) 
{

	kfree(info->tmp_rx_buf);

	info->tmp_rx_buf = NULL;

	kfree(info->flag_buf);

	info->flag_buf = NULL;

}



static int claim_resources(SLMP_INFO *info)