Merge tag 'tty-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull tty/serial fixes from Greg KH:
 "Here are some small tty/serial driver fixes for 7.3-rc6. Nothing major
  here, just lots of small fixes for reported issues, some of them very
  long-standing:

   - tty hangup fixes that have been there since the BKL days and kept
     tripping people up over time.

   - vt selection bugfix

   - other vt bugfixes (memory leaks and screen update fixes)

   - n_gsm bugfix

   - qcom-geni serial driver bugfix

   - 8250 serial driver bugfixes

   - other tiny serial driver fixes

  All of these have been in linux-next, the last few only a few days but
  testing here seems solid (this pull request was generated on that
  tree)"

* tag 'tty-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (37 commits)
  tty: add missing driver flag kernel-doc colon
  vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()
  vt: skip screen update for DEC alignment test on backgroup consoles
  vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
  serial: sc16is7xx: reduce TX refill rate with half-FIFO trigger
  serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL
  serial: tegra: don't clear the Tx FIFO on an Rx-only reset
  serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around
  tty: fix saved termios reset race
  tty: serial: mpc52xx_uart: move static declarations up.
  tty: serial: max3100: shut down timer before freeing port
  tty: add break_wait kernel-doc
  serial: qcom-geni: keep registered console runtime active
  serial: qcom-geni: Fix unbalanced runtime PM resume for no_console_suspend
  serial: qcom-geni: avoid unused-function warning
  tty: serial: qcom_geni_serial: Keep console RX functional after deep idle
  soc: qcom: geni-se: Correct QUP Core ICC vote constants
  serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
  serial: vt8500: Fix clock reference leak in vt8500_serial_probe()
  kgdboc: Fix tty driver reference leak in configure_kgdboc()
  ...

1 files changed, 37 insertions, 17 deletions

diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 48569035d..1a6c8a1bc 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -620,6 +620,8 @@ static void __tty_hangup(struct tty_struct *tty, int exit_session)
 
 	tty_ldisc_hangup(tty, cons_filp != NULL);
 
+	wake_up_interruptible(&tty->break_wait);
+
 	spin_lock_irq(&tty->ctrl.lock);
 	clear_bit(TTY_THROTTLED, &tty->flags);
 	clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
@@ -2431,6 +2433,7 @@ static int tiocgetd(struct tty_struct *tty, int __user *p)
  * send_break - performed time break
  * @tty: device to break on
  * @duration: timeout in mS
+ * @file: file object
  *
  * Perform a timed break on hardware that lacks its own driver level timed
  * break functionality.
@@ -2438,8 +2441,9 @@ static int tiocgetd(struct tty_struct *tty, int __user *p)
  * Locking:
  *	@tty->atomic_write_lock serializes
  */
-static int send_break(struct tty_struct *tty, unsigned int duration)
+static int send_break(struct file *file, struct tty_struct *tty, unsigned int duration)
 {
+	long timeout;
 	int retval;
 
 	if (tty->ops->break_ctl == NULL)
@@ -2453,13 +2457,26 @@ static int send_break(struct tty_struct *tty, unsigned int duration)
 		return -EINTR;
 
 	retval = tty->ops->break_ctl(tty, -1);
-	if (!retval) {
-		msleep_interruptible(duration);
-		retval = tty->ops->break_ctl(tty, 0);
-	} else if (retval == -EOPNOTSUPP) {
-		/* some drivers can tell only dynamically */
-		retval = 0;
+	if (retval) {
+		if (retval == -EOPNOTSUPP) {
+			/* some drivers can tell only dynamically */
+			retval = 0;
+		}
+		goto out_unlock;
+	}
+
+	timeout = msecs_to_jiffies(duration);
+	timeout = wait_event_interruptible_timeout(tty->break_wait,
+						   tty_hung_up_p(file),
+						   timeout);
+	/* return early on hangup only */
+	if (timeout > 0) {
+		retval = -EIO;
+		goto out_unlock;
 	}
+
+	retval = tty->ops->break_ctl(tty, 0);
+out_unlock:
 	tty_write_unlock(tty);
 
 	if (signal_pending(current))
@@ -2727,10 +2744,10 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 		 * This is used by the tcdrain() termios function.
 		 */
 		if (!arg)
-			return send_break(tty, 250);
+			return send_break(file, tty, 250);
 		return 0;
 	case TCSBRKP:	/* support for POSIX tcsendbreak() */
-		return send_break(tty, arg ? arg*100 : 250);
+		return send_break(file, tty, arg ? arg * 100 : 250);
 
 	case TIOCMGET:
 		return tty_tiocmget(tty, p);
@@ -3090,6 +3107,7 @@ struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
 	init_ldsem(&tty->ldisc_sem);
 	init_waitqueue_head(&tty->write_wait);
 	init_waitqueue_head(&tty->read_wait);
+	init_waitqueue_head(&tty->break_wait);
 	INIT_WORK(&tty->hangup_work, do_tty_hangup);
 	mutex_init(&tty->atomic_write_lock);
 	spin_lock_init(&tty->ctrl.lock);
@@ -3238,14 +3256,16 @@ struct device *tty_register_device_attr(struct tty_driver *driver,
 		goto err_put;
 
 	if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
-		/*
-		 * Free any saved termios data so that the termios state is
-		 * reset when reusing a minor number.
-		 */
-		tp = driver->termios[index];
-		if (tp) {
-			driver->termios[index] = NULL;
-			kfree(tp);
+		if (driver->flags & TTY_DRIVER_RESET_SAVED_TERMIOS) {
+			/*
+			 * Free any saved termios data so that the termios
+			 * state is reset when reusing a minor number.
+			 */
+			tp = driver->termios[index];
+			if (tp) {
+				driver->termios[index] = NULL;
+				kfree(tp);
+			}
 		}
 
 		retval = tty_cdev_add(driver, devt, index, 1);