5.15-stable patches

added patches:
	tty-n_gsm-fix-malformed-counter-for-out-of-frame-data.patch
	tty-n_gsm-fix-mux-cleanup-after-unregister-tty-device.patch
	tty-n_gsm-fix-wrong-signal-octet-encoding-in-convergence-layer-type-2.patch

diff --git a/queue-5.15/series b/queue-5.15/series
index dfb4b6ca95b296cf943710cd42d9697fad1df1c8..b197c929a82da36bbc383dc62804480f98deba61 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -156,3 +156,6 @@ perf-symbol-pass-is_kallsyms-to-symbols__fixup_end.patch
 perf-symbol-update-symbols__fixup_end.patch
 tty-n_gsm-fix-restart-handling-via-cld-command.patch
 tty-n_gsm-fix-decoupled-mux-resource.patch
+tty-n_gsm-fix-mux-cleanup-after-unregister-tty-device.patch
+tty-n_gsm-fix-wrong-signal-octet-encoding-in-convergence-layer-type-2.patch
+tty-n_gsm-fix-malformed-counter-for-out-of-frame-data.patch

diff --git a/queue-5.15/tty-n_gsm-fix-malformed-counter-for-out-of-frame-data.patch b/queue-5.15/tty-n_gsm-fix-malformed-counter-for-out-of-frame-data.patch
new file mode 100644 (file)
index 0000000..76b1dd5
--- /dev/null
+++ b/queue-5.15/tty-n_gsm-fix-malformed-counter-for-out-of-frame-data.patch
@@ -0,0 +1,35 @@
+From a24b4b2f660b7ddf3f484b37600bba382cb28a9d Mon Sep 17 00:00:00 2001
+From: Daniel Starke <daniel.starke@siemens.com>
+Date: Thu, 14 Apr 2022 02:42:12 -0700
+Subject: tty: n_gsm: fix malformed counter for out of frame data
+
+From: Daniel Starke <daniel.starke@siemens.com>
+
+commit a24b4b2f660b7ddf3f484b37600bba382cb28a9d upstream.
+
+The gsm_mux field 'malformed' represents the number of malformed frames
+received. However, gsm1_receive() also increases this counter for any out
+of frame byte.
+Fix this by ignoring out of frame data for the malformed counter.
+
+Fixes: e1eaea46bb40 ("tty: n_gsm line discipline")
+Cc: stable@vger.kernel.org
+Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
+Link: https://lore.kernel.org/r/20220414094225.4527-7-daniel.starke@siemens.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/n_gsm.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -1976,7 +1976,8 @@ static void gsm1_receive(struct gsm_mux
+               }
+               /* Any partial frame was a runt so go back to start */
+               if (gsm->state != GSM_START) {
+-                      gsm->malformed++;
++                      if (gsm->state != GSM_SEARCH)
++                              gsm->malformed++;
+                       gsm->state = GSM_START;
+               }
+               /* A SOF in GSM_START means we are still reading idling or

diff --git a/queue-5.15/tty-n_gsm-fix-mux-cleanup-after-unregister-tty-device.patch b/queue-5.15/tty-n_gsm-fix-mux-cleanup-after-unregister-tty-device.patch
new file mode 100644 (file)
index 0000000..ffd149f
--- /dev/null
+++ b/queue-5.15/tty-n_gsm-fix-mux-cleanup-after-unregister-tty-device.patch
@@ -0,0 +1,49 @@
+From 284260f278b706364fb4c88a7b56ba5298d5973c Mon Sep 17 00:00:00 2001
+From: Daniel Starke <daniel.starke@siemens.com>
+Date: Thu, 14 Apr 2022 02:42:09 -0700
+Subject: tty: n_gsm: fix mux cleanup after unregister tty device
+
+From: Daniel Starke <daniel.starke@siemens.com>
+
+commit 284260f278b706364fb4c88a7b56ba5298d5973c upstream.
+
+Internally, we manage the alive state of the mux channels and mux itself
+with the field member 'dead'. This makes it possible to notify the user
+if the accessed underlying link is already gone. On the other hand,
+however, removing the virtual ttys before terminating the channels may
+result in peer messages being received without any internal target. Move
+the mux cleanup procedure from gsmld_detach_gsm() to gsmld_close() to fix
+this by keeping the virtual ttys open until the mux has been cleaned up.
+
+Fixes: e1eaea46bb40 ("tty: n_gsm line discipline")
+Cc: stable@vger.kernel.org
+Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
+Link: https://lore.kernel.org/r/20220414094225.4527-4-daniel.starke@siemens.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/n_gsm.c |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -2418,7 +2418,6 @@ static void gsmld_detach_gsm(struct tty_
+       WARN_ON(tty != gsm->tty);
+       for (i = 1; i < NUM_DLCI; i++)
+               tty_unregister_device(gsm_tty_driver, base + i);
+-      gsm_cleanup_mux(gsm, false);
+       tty_kref_put(gsm->tty);
+       gsm->tty = NULL;
+ }
+@@ -2483,6 +2482,12 @@ static void gsmld_close(struct tty_struc
+ {
+       struct gsm_mux *gsm = tty->disc_data;
+ 
++      /* The ldisc locks and closes the port before calling our close. This
++       * means we have no way to do a proper disconnect. We will not bother
++       * to do one.
++       */
++      gsm_cleanup_mux(gsm, false);
++
+       gsmld_detach_gsm(tty, gsm);
+ 
+       gsmld_flush_buffer(tty);

diff --git a/queue-5.15/tty-n_gsm-fix-wrong-signal-octet-encoding-in-convergence-layer-type-2.patch b/queue-5.15/tty-n_gsm-fix-wrong-signal-octet-encoding-in-convergence-layer-type-2.patch
new file mode 100644 (file)
index 0000000..f35391a
--- /dev/null
+++ b/queue-5.15/tty-n_gsm-fix-wrong-signal-octet-encoding-in-convergence-layer-type-2.patch
@@ -0,0 +1,40 @@
+From 06d5afd4d640eea67f5623e76cd5fc03359b7f3c Mon Sep 17 00:00:00 2001
+From: Daniel Starke <daniel.starke@siemens.com>
+Date: Thu, 14 Apr 2022 02:42:10 -0700
+Subject: tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2
+
+From: Daniel Starke <daniel.starke@siemens.com>
+
+commit 06d5afd4d640eea67f5623e76cd5fc03359b7f3c upstream.
+
+n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010.
+See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=1516
+The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to
+the newer 27.010 here. Chapter 5.5.2 describes that the signal octet in
+convergence layer type 2 can be either one or two bytes. The length is
+encoded in the EA bit. This is set 1 for the last byte in the sequence.
+gsmtty_modem_update() handles this correctly but gsm_dlci_data_output()
+fails to set EA to 1. There is no case in which we encode two signal octets
+as there is no case in which we send out a break signal.
+Therefore, always set the EA bit to 1 for the signal octet to fix this.
+
+Fixes: e1eaea46bb40 ("tty: n_gsm line discipline")
+Cc: stable@vger.kernel.org
+Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
+Link: https://lore.kernel.org/r/20220414094225.4527-5-daniel.starke@siemens.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/n_gsm.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -820,7 +820,7 @@ static int gsm_dlci_data_output(struct g
+                       break;
+               case 2: /* Unstructed with modem bits.
+               Always one byte as we never send inline break data */
+-                      *dp++ = gsm_encode_modem(dlci);
++                      *dp++ = (gsm_encode_modem(dlci) << 1) | EA;
+                       break;
+               }
+               WARN_ON(kfifo_out_locked(&dlci->fifo, dp , len, &dlci->lock) != len);