]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
5.10-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 18 Dec 2023 11:06:47 +0000 (12:06 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 18 Dec 2023 11:06:47 +0000 (12:06 +0100)
added patches:
powerpc-ftrace-create-a-dummy-stackframe-to-fix-stack-unwind.patch
powerpc-ftrace-fix-stack-teardown-in-ftrace_no_trace.patch
tty-n_gsm-add-sanity-check-for-gsm-receive-in-gsm_receive_buf.patch
tty-n_gsm-fix-tty-registration-before-control-channel-open.patch
tty-n_gsm-remove-duplicates-of-parameters.patch

queue-5.10/powerpc-ftrace-create-a-dummy-stackframe-to-fix-stack-unwind.patch [new file with mode: 0644]
queue-5.10/powerpc-ftrace-fix-stack-teardown-in-ftrace_no_trace.patch [new file with mode: 0644]
queue-5.10/series
queue-5.10/tty-n_gsm-add-sanity-check-for-gsm-receive-in-gsm_receive_buf.patch [new file with mode: 0644]
queue-5.10/tty-n_gsm-fix-tty-registration-before-control-channel-open.patch [new file with mode: 0644]
queue-5.10/tty-n_gsm-remove-duplicates-of-parameters.patch [new file with mode: 0644]

diff --git a/queue-5.10/powerpc-ftrace-create-a-dummy-stackframe-to-fix-stack-unwind.patch b/queue-5.10/powerpc-ftrace-create-a-dummy-stackframe-to-fix-stack-unwind.patch
new file mode 100644 (file)
index 0000000..e32897d
--- /dev/null
@@ -0,0 +1,136 @@
+From stable+bounces-6807-greg=kroah.com@vger.kernel.org Fri Dec 15 12:17:59 2023
+From: Naveen N Rao <naveen@kernel.org>
+Date: Fri, 15 Dec 2023 16:44:32 +0530
+Subject: powerpc/ftrace: Create a dummy stackframe to fix stack unwind
+To: <stable@vger.kernel.org>
+Cc: Greg KH <gregkh@linuxfoundation.org>, Michael Ellerman <mpe@ellerman.id.au>
+Message-ID: <20231215111433.2362641-1-naveen@kernel.org>
+
+From: Naveen N Rao <naveen@kernel.org>
+
+commit 41a506ef71eb38d94fe133f565c87c3e06ccc072 upstream.
+
+With ppc64 -mprofile-kernel and ppc32 -pg, profiling instructions to
+call into ftrace are emitted right at function entry. The instruction
+sequence used is minimal to reduce overhead. Crucially, a stackframe is
+not created for the function being traced. This breaks stack unwinding
+since the function being traced does not have a stackframe for itself.
+As such, it never shows up in the backtrace:
+
+/sys/kernel/debug/tracing # echo 1 > /proc/sys/kernel/stack_tracer_enabled
+/sys/kernel/debug/tracing # cat stack_trace
+        Depth    Size   Location    (17 entries)
+        -----    ----   --------
+  0)     4144      32   ftrace_call+0x4/0x44
+  1)     4112     432   get_page_from_freelist+0x26c/0x1ad0
+  2)     3680     496   __alloc_pages+0x290/0x1280
+  3)     3184     336   __folio_alloc+0x34/0x90
+  4)     2848     176   vma_alloc_folio+0xd8/0x540
+  5)     2672     272   __handle_mm_fault+0x700/0x1cc0
+  6)     2400     208   handle_mm_fault+0xf0/0x3f0
+  7)     2192      80   ___do_page_fault+0x3e4/0xbe0
+  8)     2112     160   do_page_fault+0x30/0xc0
+  9)     1952     256   data_access_common_virt+0x210/0x220
+ 10)     1696     400   0xc00000000f16b100
+ 11)     1296     384   load_elf_binary+0x804/0x1b80
+ 12)      912     208   bprm_execve+0x2d8/0x7e0
+ 13)      704      64   do_execveat_common+0x1d0/0x2f0
+ 14)      640     160   sys_execve+0x54/0x70
+ 15)      480      64   system_call_exception+0x138/0x350
+ 16)      416     416   system_call_common+0x160/0x2c4
+
+Fix this by having ftrace create a dummy stackframe for the function
+being traced. With this, backtraces now capture the function being
+traced:
+
+/sys/kernel/debug/tracing # cat stack_trace
+        Depth    Size   Location    (17 entries)
+        -----    ----   --------
+  0)     3888      32   _raw_spin_trylock+0x8/0x70
+  1)     3856     576   get_page_from_freelist+0x26c/0x1ad0
+  2)     3280      64   __alloc_pages+0x290/0x1280
+  3)     3216     336   __folio_alloc+0x34/0x90
+  4)     2880     176   vma_alloc_folio+0xd8/0x540
+  5)     2704     416   __handle_mm_fault+0x700/0x1cc0
+  6)     2288      96   handle_mm_fault+0xf0/0x3f0
+  7)     2192      48   ___do_page_fault+0x3e4/0xbe0
+  8)     2144     192   do_page_fault+0x30/0xc0
+  9)     1952     608   data_access_common_virt+0x210/0x220
+ 10)     1344      16   0xc0000000334bbb50
+ 11)     1328     416   load_elf_binary+0x804/0x1b80
+ 12)      912      64   bprm_execve+0x2d8/0x7e0
+ 13)      848     176   do_execveat_common+0x1d0/0x2f0
+ 14)      672     192   sys_execve+0x54/0x70
+ 15)      480      64   system_call_exception+0x138/0x350
+ 16)      416     416   system_call_common+0x160/0x2c4
+
+This results in two additional stores in the ftrace entry code, but
+produces reliable backtraces.
+
+Fixes: 153086644fd1 ("powerpc/ftrace: Add support for -mprofile-kernel ftrace ABI")
+Cc: stable@vger.kernel.org
+Signed-off-by: Naveen N Rao <naveen@kernel.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230621051349.759567-1-naveen@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kernel/trace/ftrace_64_mprofile.S |   13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
++++ b/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
+@@ -36,6 +36,9 @@ _GLOBAL(ftrace_regs_caller)
+       /* Save the original return address in A's stack frame */
+       std     r0,LRSAVE(r1)
++      /* Create a minimal stack frame for representing B */
++      stdu    r1, -STACK_FRAME_MIN_SIZE(r1)
++
+       /* Create our stack frame + pt_regs */
+       stdu    r1,-SWITCH_FRAME_SIZE(r1)
+@@ -65,6 +68,8 @@ _GLOBAL(ftrace_regs_caller)
+       mflr    r7
+       /* Save it as pt_regs->nip */
+       std     r7, _NIP(r1)
++      /* Also save it in B's stackframe header for proper unwind */
++      std     r7, LRSAVE+SWITCH_FRAME_SIZE(r1)
+       /* Save the read LR in pt_regs->link */
+       std     r0, _LINK(r1)
+@@ -121,7 +126,7 @@ ftrace_regs_call:
+       ld      r2, 24(r1)
+       /* Pop our stack frame */
+-      addi r1, r1, SWITCH_FRAME_SIZE
++      addi r1, r1, SWITCH_FRAME_SIZE+STACK_FRAME_MIN_SIZE
+ #ifdef CONFIG_LIVEPATCH
+         /* Based on the cmpd above, if the NIP was altered handle livepatch */
+@@ -153,6 +158,9 @@ _GLOBAL(ftrace_caller)
+       /* Save the original return address in A's stack frame */
+       std     r0, LRSAVE(r1)
++      /* Create a minimal stack frame for representing B */
++      stdu    r1, -STACK_FRAME_MIN_SIZE(r1)
++
+       /* Create our stack frame + pt_regs */
+       stdu    r1, -SWITCH_FRAME_SIZE(r1)
+@@ -166,6 +174,7 @@ _GLOBAL(ftrace_caller)
+       /* Get the _mcount() call site out of LR */
+       mflr    r7
+       std     r7, _NIP(r1)
++      std     r7, LRSAVE+SWITCH_FRAME_SIZE(r1)
+       /* Save callee's TOC in the ABI compliant location */
+       std     r2, 24(r1)
+@@ -200,7 +209,7 @@ ftrace_call:
+       ld      r2, 24(r1)
+       /* Pop our stack frame */
+-      addi    r1, r1, SWITCH_FRAME_SIZE
++      addi    r1, r1, SWITCH_FRAME_SIZE+STACK_FRAME_MIN_SIZE
+       /* Reload original LR */
+       ld      r0, LRSAVE(r1)
diff --git a/queue-5.10/powerpc-ftrace-fix-stack-teardown-in-ftrace_no_trace.patch b/queue-5.10/powerpc-ftrace-fix-stack-teardown-in-ftrace_no_trace.patch
new file mode 100644 (file)
index 0000000..0b6b8d0
--- /dev/null
@@ -0,0 +1,50 @@
+From stable+bounces-6808-greg=kroah.com@vger.kernel.org Fri Dec 15 12:18:31 2023
+From: Naveen N Rao <naveen@kernel.org>
+Date: Fri, 15 Dec 2023 16:44:33 +0530
+Subject: powerpc/ftrace: Fix stack teardown in ftrace_no_trace
+To: <stable@vger.kernel.org>
+Cc: Greg KH <gregkh@linuxfoundation.org>, Michael Ellerman <mpe@ellerman.id.au>
+Message-ID: <20231215111433.2362641-2-naveen@kernel.org>
+
+From: Naveen N Rao <naveen@kernel.org>
+
+commit 4b3338aaa74d7d4ec5b6734dc298f0db94ec83d2 upstream.
+
+Commit 41a506ef71eb ("powerpc/ftrace: Create a dummy stackframe to fix
+stack unwind") added use of a new stack frame on ftrace entry to fix
+stack unwind. However, the commit missed updating the offset used while
+tearing down the ftrace stack when ftrace is disabled. Fix the same.
+
+In addition, the commit missed saving the correct stack pointer in
+pt_regs. Update the same.
+
+Fixes: 41a506ef71eb ("powerpc/ftrace: Create a dummy stackframe to fix stack unwind")
+Cc: stable@vger.kernel.org # v6.5+
+Signed-off-by: Naveen N Rao <naveen@kernel.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231130065947.2188860-1-naveen@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kernel/trace/ftrace_64_mprofile.S |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
++++ b/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
+@@ -55,7 +55,7 @@ _GLOBAL(ftrace_regs_caller)
+       SAVE_10GPRS(22, r1)
+       /* Save previous stack pointer (r1) */
+-      addi    r8, r1, SWITCH_FRAME_SIZE
++      addi    r8, r1, SWITCH_FRAME_SIZE+STACK_FRAME_MIN_SIZE
+       std     r8, GPR1(r1)
+       /* Load special regs for save below */
+@@ -150,7 +150,7 @@ ftrace_no_trace:
+       mflr    r3
+       mtctr   r3
+       REST_GPR(3, r1)
+-      addi    r1, r1, SWITCH_FRAME_SIZE
++      addi    r1, r1, SWITCH_FRAME_SIZE+STACK_FRAME_MIN_SIZE
+       mtlr    r0
+       bctr
index 3c5524b537817d69e45e3e24cbb539c3e2fff4ae..07c81ca7e5e6419a2117e0973c0bc2bd0ea32734 100644 (file)
@@ -65,3 +65,8 @@ ring-buffer-have-saved-event-hold-the-entire-event.patch
 ring-buffer-fix-writing-to-the-buffer-with-max_data_size.patch
 ring-buffer-fix-a-race-in-rb_time_cmpxchg-for-32-bit-archs.patch
 usb-gadget-core-adjust-uevent-timing-on-gadget-unbind.patch
+tty-n_gsm-fix-tty-registration-before-control-channel-open.patch
+tty-n_gsm-remove-duplicates-of-parameters.patch
+tty-n_gsm-add-sanity-check-for-gsm-receive-in-gsm_receive_buf.patch
+powerpc-ftrace-create-a-dummy-stackframe-to-fix-stack-unwind.patch
+powerpc-ftrace-fix-stack-teardown-in-ftrace_no_trace.patch
diff --git a/queue-5.10/tty-n_gsm-add-sanity-check-for-gsm-receive-in-gsm_receive_buf.patch b/queue-5.10/tty-n_gsm-add-sanity-check-for-gsm-receive-in-gsm_receive_buf.patch
new file mode 100644 (file)
index 0000000..1de3c7b
--- /dev/null
@@ -0,0 +1,58 @@
+From Ilia.Gavrilov@infotecs.ru Tue Dec 12 12:17:23 2023
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+Date: Tue, 12 Dec 2023 11:17:21 +0000
+Subject: tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf()
+To: "stable@vger.kernel.org" <stable@vger.kernel.org>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Daniel Starke <daniel.starke@siemens.com>, Jiri Slaby <jirislaby@kernel.org>, Russ Gorby <russ.gorby@intel.com>, "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, "lvc-project@linuxtesting.org" <lvc-project@linuxtesting.org>, "syzbot+e3563f0c94e188366dbb@syzkaller.appspotmail.com" <syzbot+e3563f0c94e188366dbb@syzkaller.appspotmail.com>, Mazin Al Haddad <mazinalhaddad05@gmail.com>
+Message-ID: <20231212111431.4064760-4-Ilia.Gavrilov@infotecs.ru>
+
+From: Mazin Al Haddad <mazinalhaddad05@gmail.com>
+
+commit f16c6d2e58a4c2b972efcf9eb12390ee0ba3befb upstream
+
+A null pointer dereference can happen when attempting to access the
+"gsm->receive()" function in gsmld_receive_buf(). Currently, the code
+assumes that gsm->receive is only called after MUX activation.
+Since the gsmld_receive_buf() function can be accessed without the need to
+initialize the MUX, the gsm->receive() function will not be set and a
+NULL pointer dereference will occur.
+
+Fix this by avoiding the call to "gsm->receive()" in case the function is
+not initialized by adding a sanity check.
+
+Call Trace:
+ <TASK>
+ gsmld_receive_buf+0x1c2/0x2f0 drivers/tty/n_gsm.c:2861
+ tiocsti drivers/tty/tty_io.c:2293 [inline]
+ tty_ioctl+0xa75/0x15d0 drivers/tty/tty_io.c:2692
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:870 [inline]
+ __se_sys_ioctl fs/ioctl.c:856 [inline]
+ __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Link: https://syzkaller.appspot.com/bug?id=bdf035c61447f8c6e0e6920315d577cb5cc35ac5
+Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
+Reported-and-tested-by: syzbot+e3563f0c94e188366dbb@syzkaller.appspotmail.com
+Signed-off-by: Mazin Al Haddad <mazinalhaddad05@gmail.com>
+Link: https://lore.kernel.org/r/20220814015211.84180-1-mazinalhaddad05@gmail.com
+Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/n_gsm.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -2588,7 +2588,8 @@ static void gsmld_receive_buf(struct tty
+                       flags = *fp++;
+               switch (flags) {
+               case TTY_NORMAL:
+-                      gsm->receive(gsm, *cp);
++                      if (gsm->receive)
++                              gsm->receive(gsm, *cp);
+                       break;
+               case TTY_OVERRUN:
+               case TTY_BREAK:
diff --git a/queue-5.10/tty-n_gsm-fix-tty-registration-before-control-channel-open.patch b/queue-5.10/tty-n_gsm-fix-tty-registration-before-control-channel-open.patch
new file mode 100644 (file)
index 0000000..d707e38
--- /dev/null
@@ -0,0 +1,228 @@
+From Ilia.Gavrilov@infotecs.ru Tue Dec 12 12:17:22 2023
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+Date: Tue, 12 Dec 2023 11:17:21 +0000
+Subject: tty: n_gsm: fix tty registration before control channel open
+To: "stable@vger.kernel.org" <stable@vger.kernel.org>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Daniel Starke <daniel.starke@siemens.com>, Jiri Slaby <jirislaby@kernel.org>, Russ Gorby <russ.gorby@intel.com>, "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, "lvc-project@linuxtesting.org" <lvc-project@linuxtesting.org>
+Message-ID: <20231212111431.4064760-2-Ilia.Gavrilov@infotecs.ru>
+
+From: Daniel Starke <daniel.starke@siemens.com>
+
+commit 01aecd917114577c423f07cec0d186ad007d76fc upstream.
+
+The current implementation registers/deregisters the user ttys at mux
+attach/detach. That means that the user devices are available before any
+control channel is open. However, user channel initialization requires an
+open control channel. Furthermore, the user is not informed if the mux
+restarts due to configuration changes.
+Put the registration/deregistration procedure into separate function to
+improve readability.
+Move registration to mux activation and deregistration to mux cleanup to
+keep the user devices only open as long as a control channel exists. The
+user will be informed via the device driver if the mux was reconfigured in
+a way that required a mux re-activation.
+This makes it necessary to add T2 initialization to gsmld_open() for the
+ldisc open code path (not the reconfiguration code path) to avoid deletion
+of an uninitialized T2 at mux cleanup.
+
+Fixes: d50f6dcaf22a ("tty: n_gsm: expose gsmtty device nodes at ldisc open time")
+Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
+Link: https://lore.kernel.org/r/20220701061652.39604-2-daniel.starke@siemens.com
+Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/n_gsm.c |  117 +++++++++++++++++++++++++++++++++++-----------------
+ 1 file changed, 79 insertions(+), 38 deletions(-)
+
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -235,6 +235,7 @@ struct gsm_mux {
+       struct gsm_dlci *dlci[NUM_DLCI];
+       int old_c_iflag;                /* termios c_iflag value before attach */
+       bool constipated;               /* Asked by remote to shut up */
++      bool has_devices;               /* Devices were registered */
+       spinlock_t tx_lock;
+       unsigned int tx_bytes;          /* TX data outstanding */
+@@ -465,6 +466,68 @@ static u8 gsm_encode_modem(const struct
+ }
+ /**
++ *    gsm_register_devices    -       register all tty devices for a given mux index
++ *
++ *    @driver: the tty driver that describes the tty devices
++ *    @index:  the mux number is used to calculate the minor numbers of the
++ *             ttys for this mux and may differ from the position in the
++ *             mux array.
++ */
++static int gsm_register_devices(struct tty_driver *driver, unsigned int index)
++{
++      struct device *dev;
++      int i;
++      unsigned int base;
++
++      if (!driver || index >= MAX_MUX)
++              return -EINVAL;
++
++      base = index * NUM_DLCI; /* first minor for this index */
++      for (i = 1; i < NUM_DLCI; i++) {
++              /* Don't register device 0 - this is the control channel
++               * and not a usable tty interface
++               */
++              dev = tty_register_device(gsm_tty_driver, base + i, NULL);
++              if (IS_ERR(dev)) {
++                      if (debug & 8)
++                              pr_info("%s failed to register device minor %u",
++                                      __func__, base + i);
++                      for (i--; i >= 1; i--)
++                              tty_unregister_device(gsm_tty_driver, base + i);
++                      return PTR_ERR(dev);
++              }
++      }
++
++      return 0;
++}
++
++/**
++ *    gsm_unregister_devices  -       unregister all tty devices for a given mux index
++ *
++ *    @driver: the tty driver that describes the tty devices
++ *    @index:  the mux number is used to calculate the minor numbers of the
++ *             ttys for this mux and may differ from the position in the
++ *             mux array.
++ */
++static void gsm_unregister_devices(struct tty_driver *driver,
++                                 unsigned int index)
++{
++      int i;
++      unsigned int base;
++
++      if (!driver || index >= MAX_MUX)
++              return;
++
++      base = index * NUM_DLCI; /* first minor for this index */
++      for (i = 1; i < NUM_DLCI; i++) {
++              /* Don't unregister device 0 - this is the control
++               * channel and not a usable tty interface
++               */
++              tty_unregister_device(gsm_tty_driver, base + i);
++      }
++}
++
++/**
+  *    gsm_print_packet        -       display a frame for debug
+  *    @hdr: header to print before decode
+  *    @addr: address EA from the frame
+@@ -2178,6 +2241,10 @@ static void gsm_cleanup_mux(struct gsm_m
+       del_timer_sync(&gsm->t2_timer);
+       /* Free up any link layer users and finally the control channel */
++      if (gsm->has_devices) {
++              gsm_unregister_devices(gsm_tty_driver, gsm->num);
++              gsm->has_devices = false;
++      }
+       for (i = NUM_DLCI - 1; i >= 0; i--)
+               if (gsm->dlci[i])
+                       gsm_dlci_release(gsm->dlci[i]);
+@@ -2201,15 +2268,21 @@ static void gsm_cleanup_mux(struct gsm_m
+ static int gsm_activate_mux(struct gsm_mux *gsm)
+ {
+       struct gsm_dlci *dlci;
++      int ret;
+       if (gsm->encoding == 0)
+               gsm->receive = gsm0_receive;
+       else
+               gsm->receive = gsm1_receive;
++      ret = gsm_register_devices(gsm_tty_driver, gsm->num);
++      if (ret)
++              return ret;
++
+       dlci = gsm_dlci_alloc(gsm, 0);
+       if (dlci == NULL)
+               return -ENOMEM;
++      gsm->has_devices = true;
+       gsm->dead = false;              /* Tty opens are now permissible */
+       return 0;
+ }
+@@ -2475,39 +2548,14 @@ static int gsmld_output(struct gsm_mux *
+  *    will need moving to an ioctl path.
+  */
+-static int gsmld_attach_gsm(struct tty_struct *tty, struct gsm_mux *gsm)
++static void gsmld_attach_gsm(struct tty_struct *tty, struct gsm_mux *gsm)
+ {
+-      unsigned int base;
+-      int ret, i;
+-
+       gsm->tty = tty_kref_get(tty);
+       /* Turn off tty XON/XOFF handling to handle it explicitly. */
+       gsm->old_c_iflag = tty->termios.c_iflag;
+       tty->termios.c_iflag &= (IXON | IXOFF);
+-      ret =  gsm_activate_mux(gsm);
+-      if (ret != 0)
+-              tty_kref_put(gsm->tty);
+-      else {
+-              /* Don't register device 0 - this is the control channel and not
+-                 a usable tty interface */
+-              base = mux_num_to_base(gsm); /* Base for this MUX */
+-              for (i = 1; i < NUM_DLCI; i++) {
+-                      struct device *dev;
+-
+-                      dev = tty_register_device(gsm_tty_driver,
+-                                                      base + i, NULL);
+-                      if (IS_ERR(dev)) {
+-                              for (i--; i >= 1; i--)
+-                                      tty_unregister_device(gsm_tty_driver,
+-                                                              base + i);
+-                              return PTR_ERR(dev);
+-                      }
+-              }
+-      }
+-      return ret;
+ }
+-
+ /**
+  *    gsmld_detach_gsm        -       stop doing 0710 mux
+  *    @tty: tty attached to the mux
+@@ -2518,12 +2566,7 @@ static int gsmld_attach_gsm(struct tty_s
+ static void gsmld_detach_gsm(struct tty_struct *tty, struct gsm_mux *gsm)
+ {
+-      unsigned int base = mux_num_to_base(gsm); /* Base for this MUX */
+-      int i;
+-
+       WARN_ON(tty != gsm->tty);
+-      for (i = 1; i < NUM_DLCI; i++)
+-              tty_unregister_device(gsm_tty_driver, base + i);
+       /* Restore tty XON/XOFF handling. */
+       gsm->tty->termios.c_iflag = gsm->old_c_iflag;
+       tty_kref_put(gsm->tty);
+@@ -2619,7 +2662,6 @@ static void gsmld_close(struct tty_struc
+ static int gsmld_open(struct tty_struct *tty)
+ {
+       struct gsm_mux *gsm;
+-      int ret;
+       if (tty->ops->write == NULL)
+               return -EINVAL;
+@@ -2635,12 +2677,11 @@ static int gsmld_open(struct tty_struct
+       /* Attach the initial passive connection */
+       gsm->encoding = 1;
+-      ret = gsmld_attach_gsm(tty, gsm);
+-      if (ret != 0) {
+-              gsm_cleanup_mux(gsm, false);
+-              mux_put(gsm);
+-      }
+-      return ret;
++      gsmld_attach_gsm(tty, gsm);
++
++      timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
++
++      return 0;
+ }
+ /**
diff --git a/queue-5.10/tty-n_gsm-remove-duplicates-of-parameters.patch b/queue-5.10/tty-n_gsm-remove-duplicates-of-parameters.patch
new file mode 100644 (file)
index 0000000..4c291ad
--- /dev/null
@@ -0,0 +1,59 @@
+From Ilia.Gavrilov@infotecs.ru Tue Dec 12 12:17:23 2023
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+Date: Tue, 12 Dec 2023 11:17:21 +0000
+Subject: tty: n_gsm, remove duplicates of parameters
+To: "stable@vger.kernel.org" <stable@vger.kernel.org>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Daniel Starke <daniel.starke@siemens.com>, Jiri Slaby <jirislaby@kernel.org>, Russ Gorby <russ.gorby@intel.com>, "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, "lvc-project@linuxtesting.org" <lvc-project@linuxtesting.org>, Jiri Slaby <jslaby@suse.cz>
+Message-ID: <20231212111431.4064760-3-Ilia.Gavrilov@infotecs.ru>
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+commit b93db97e1ca08e500305bc46b08c72e2232c4be1 upstream.
+
+dp, f, and i are only duplicates of gsmld_receive_buf's parameters. Use
+the parameters directly (cp, fp, and count) and delete these local
+variables.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Link: https://lore.kernel.org/r/20210302062214.29627-41-jslaby@suse.cz
+Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/n_gsm.c |   13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -2577,27 +2577,24 @@ static void gsmld_receive_buf(struct tty
+                             char *fp, int count)
+ {
+       struct gsm_mux *gsm = tty->disc_data;
+-      const unsigned char *dp;
+-      char *f;
+-      int i;
+       char flags = TTY_NORMAL;
+       if (debug & 4)
+               print_hex_dump_bytes("gsmld_receive: ", DUMP_PREFIX_OFFSET,
+                                    cp, count);
+-      for (i = count, dp = cp, f = fp; i; i--, dp++) {
+-              if (f)
+-                      flags = *f++;
++      for (; count; count--, cp++) {
++              if (fp)
++                      flags = *fp++;
+               switch (flags) {
+               case TTY_NORMAL:
+-                      gsm->receive(gsm, *dp);
++                      gsm->receive(gsm, *cp);
+                       break;
+               case TTY_OVERRUN:
+               case TTY_BREAK:
+               case TTY_PARITY:
+               case TTY_FRAME:
+-                      gsm_error(gsm, *dp, flags);
++                      gsm_error(gsm, *cp, flags);
+                       break;
+               default:
+                       WARN_ONCE(1, "%s: unknown flag %d\n",