Unverified Commit c63e9a65 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!10801 fix CVE-2024-42095 

Merge Pull Request from: @ci-robot 
 
PR sync from: felix <fuzhen5@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/IAHBBGDC2NCLMAOLT7U72EUDOGWHURZI/ 
From: Felix Fu <fuzhen5@huawei.com>

fix CVE-2024-42095

Udit Kumar (2):
  serial: 8250_omap: Implementation of Errata i2310
  serial: 8250_omap: Fix Errata i2310 with RX FIFO level check


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/IAGEP6 
 
Link:https://gitee.com/openeuler/kernel/pulls/10801

 

Reviewed-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents f767f3dc ca73d3bf

drivers/tty/serial/8250/8250_omap.c

+19 −3
Original line number Diff line number Diff line
@@ -164,6 +164,10 @@ static void uart_write(struct omap8250_priv *priv, u32 reg, u32 val) 
	writel(val, priv->membase + (reg << OMAP_UART_REGSHIFT));

}



/* Timeout low and High */

#define UART_OMAP_TO_L                 0x26

#define UART_OMAP_TO_H                 0x27



/*

 * Called on runtime PM resume path from omap8250_restore_regs(), and

 * omap8250_set_mctrl().
@@ -647,13 +651,25 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id) 


	/*

	 * On K3 SoCs, it is observed that RX TIMEOUT is signalled after

	 * FIFO has been drained, in which case a dummy read of RX FIFO

	 * is required to clear RX TIMEOUT condition.

	 * FIFO has been drained or erroneously.

	 * So apply solution of Errata i2310 as mentioned in

	 * https://www.ti.com/lit/pdf/sprz536

	 */

	if (priv->habit & UART_RX_TIMEOUT_QUIRK &&

	    (iir & UART_IIR_RX_TIMEOUT) == UART_IIR_RX_TIMEOUT &&

	    serial_port_in(port, UART_OMAP_RX_LVL) == 0) {

		serial_port_in(port, UART_RX);

		unsigned char efr2, timeout_h, timeout_l;



		efr2 = serial_in(up, UART_OMAP_EFR2);

		timeout_h = serial_in(up, UART_OMAP_TO_H);

		timeout_l = serial_in(up, UART_OMAP_TO_L);

		serial_out(up, UART_OMAP_TO_H, 0xFF);

		serial_out(up, UART_OMAP_TO_L, 0xFF);

		serial_out(up, UART_OMAP_EFR2, UART_OMAP_EFR2_TIMEOUT_BEHAVE);

		serial_in(up, UART_IIR);

		serial_out(up, UART_OMAP_EFR2, efr2);

		serial_out(up, UART_OMAP_TO_H, timeout_h);

		serial_out(up, UART_OMAP_TO_L, timeout_l);

	}



	/* Stop processing interrupts on input overrun */