Unverified Commit dc674705 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!10828 fix CVE-2024-42095 

Merge Pull Request from: @ci-robot 
 
PR sync from: felix <fuzhen5@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/NK2HZT6RO2IMOB5ZGEMOGWCTJXUWU6U6/ 
From: Felix Fu <fuzhen5@huawei.com>

fix CVE-2024-42095

Udit Kumar (2):
  serial: 8250_omap: Implementation of Errata i2310
  serial: 8250_omap: Fix Errata i2310 with RX FIFO level check


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/IAGEP6 
 
Link:https://gitee.com/openeuler/kernel/pulls/10828

 

Reviewed-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents e2c222b5 bb81f831

drivers/tty/serial/8250/8250_omap.c

+19 −3
Original line number Diff line number Diff line
@@ -157,6 +157,10 @@ static u32 uart_read(struct uart_8250_port *up, u32 reg) 
	return readl(up->port.membase + (reg << up->port.regshift));

}



/* Timeout low and High */

#define UART_OMAP_TO_L                 0x26

#define UART_OMAP_TO_H                 0x27



static void omap8250_set_mctrl(struct uart_port *port, unsigned int mctrl)

{

	struct uart_8250_port *up = up_to_u8250p(port);
@@ -634,13 +638,25 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id) 


	/*

	 * On K3 SoCs, it is observed that RX TIMEOUT is signalled after

	 * FIFO has been drained, in which case a dummy read of RX FIFO

	 * is required to clear RX TIMEOUT condition.

	 * FIFO has been drained or erroneously.

	 * So apply solution of Errata i2310 as mentioned in

	 * https://www.ti.com/lit/pdf/sprz536

	 */

	if (priv->habit & UART_RX_TIMEOUT_QUIRK &&

	    (iir & UART_IIR_RX_TIMEOUT) == UART_IIR_RX_TIMEOUT &&

	    serial_port_in(port, UART_OMAP_RX_LVL) == 0) {

		serial_port_in(port, UART_RX);

		unsigned char efr2, timeout_h, timeout_l;



		efr2 = serial_in(up, UART_OMAP_EFR2);

		timeout_h = serial_in(up, UART_OMAP_TO_H);

		timeout_l = serial_in(up, UART_OMAP_TO_L);

		serial_out(up, UART_OMAP_TO_H, 0xFF);

		serial_out(up, UART_OMAP_TO_L, 0xFF);

		serial_out(up, UART_OMAP_EFR2, UART_OMAP_EFR2_TIMEOUT_BEHAVE);

		serial_in(up, UART_IIR);

		serial_out(up, UART_OMAP_EFR2, efr2);

		serial_out(up, UART_OMAP_TO_H, timeout_h);

		serial_out(up, UART_OMAP_TO_L, timeout_l);

	}



	/* Stop processing interrupts on input overrun */