Merge tag 'tty-4.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

I wrote:
  "TTY/Serial driver fixes for 4.19-rc6

   Here are a number of small tty and serial driver fixes for reported
   issues for 4.19-rc6.

   One should hopefully resolve a much-reported issue that syzbot has found
   in the tty layer.  Although there are still more issues there, getting
   this fixed is nice to see finally happen.

   All of these have been in linux-next for a while with no reported
   issues."

* tag 'tty-4.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  serial: imx: restore handshaking irq for imx1
  tty: vt_ioctl: fix potential Spectre v1
  tty: Drop tty->count on tty_reopen() failure
  serial: cpm_uart: return immediately from console poll
  tty: serial: lpuart: avoid leaking struct tty_struct
  serial: mvebu-uart: Fix reporting of effective CSIZE to userspace

6 files changed, 30 insertions, 7 deletions

diff --git a/drivers/tty/serial/cpm_uart/cpm_uart_core.c b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
index 24a5f05e769b..e5389591bb4f 100644
--- a/drivers/tty/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
@@ -1054,8 +1054,8 @@ static int poll_wait_key(char *obuf, struct uart_cpm_port *pinfo)
         /* Get the address of the host memory buffer.
          */
         bdp = pinfo->rx_cur;
-        while (bdp->cbd_sc & BD_SC_EMPTY)
-                ;
+        if (bdp->cbd_sc & BD_SC_EMPTY)
+                return NO_POLL_CHAR;
 
         /* If the buffer address is in the CPM DPRAM, don't
          * convert it.
@@ -1090,7 +1090,11 @@ static int cpm_get_poll_char(struct uart_port *port)
                 poll_chars = 0;
         }
         if (poll_chars <= 0) {
-                poll_chars = poll_wait_key(poll_buf, pinfo);
+                int ret = poll_wait_key(poll_buf, pinfo);
+
+                if (ret == NO_POLL_CHAR)
+                        return ret;
+                poll_chars = ret;
                 pollp = poll_buf;
         }
         poll_chars--;
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 51e47a63d61a..3f8d1274fc85 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -979,7 +979,8 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport)
         struct circ_buf *ring = &sport->rx_ring;
         int ret, nent;
         int bits, baud;
-        struct tty_struct *tty = tty_port_tty_get(&sport->port.state->port);
+        struct tty_port *port = &sport->port.state->port;
+        struct tty_struct *tty = port->tty;
         struct ktermios *termios = &tty->termios;
 
         baud = tty_get_baud_rate(tty);
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 239c0fa2e981..0f67197a3783 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -2351,6 +2351,14 @@ static int imx_uart_probe(struct platform_device *pdev)
                                 ret);
                         return ret;
                 }
+
+                ret = devm_request_irq(&pdev->dev, rtsirq, imx_uart_rtsint, 0,
+                                       dev_name(&pdev->dev), sport);
+                if (ret) {
+                        dev_err(&pdev->dev, "failed to request rts irq: %d\n",
+                                ret);
+                        return ret;
+                }
         } else {
                 ret = devm_request_irq(&pdev->dev, rxirq, imx_uart_int, 0,
                                        dev_name(&pdev->dev), sport);
diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
index d04b5eeea3c6..170e446a2f62 100644
--- a/drivers/tty/serial/mvebu-uart.c
+++ b/drivers/tty/serial/mvebu-uart.c
@@ -511,6 +511,7 @@ static void mvebu_uart_set_termios(struct uart_port *port,
                 termios->c_iflag |= old->c_iflag & ~(INPCK | IGNPAR);
                 termios->c_cflag &= CREAD | CBAUD;
                 termios->c_cflag |= old->c_cflag & ~(CREAD | CBAUD);
+                termios->c_cflag |= CS8;
         }
 
         spin_unlock_irqrestore(&port->lock, flags);
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 32bc3e3fe4d3..5e5da9acaf0a 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1255,6 +1255,7 @@ static void tty_driver_remove_tty(struct tty_driver *driver, struct tty_struct *
 static int tty_reopen(struct tty_struct *tty)
 {
         struct tty_driver *driver = tty->driver;
+        int retval;
 
         if (driver->type == TTY_DRIVER_TYPE_PTY &&
             driver->subtype == PTY_TYPE_MASTER)
@@ -1268,10 +1269,14 @@ static int tty_reopen(struct tty_struct *tty)
 
         tty->count++;
 
-        if (!tty->ldisc)
-                return tty_ldisc_reinit(tty, tty->termios.c_line);
+        if (tty->ldisc)
+                return 0;
 
-        return 0;
+        retval = tty_ldisc_reinit(tty, tty->termios.c_line);
+        if (retval)
+                tty->count--;
+
+        return retval;
 }
 
 /**
diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
index a78ad10a119b..73cdc0d633dd 100644
--- a/drivers/tty/vt/vt_ioctl.c
+++ b/drivers/tty/vt/vt_ioctl.c
@@ -32,6 +32,8 @@
 #include <asm/io.h>
 #include <linux/uaccess.h>
 
+#include <linux/nospec.h>
+
 #include <linux/kbd_kern.h>
 #include <linux/vt_kern.h>
 #include <linux/kbd_diacr.h>
@@ -700,6 +702,8 @@ int vt_ioctl(struct tty_struct *tty,
                 if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES)
                         ret = -ENXIO;
                 else {
+                        vsa.console = array_index_nospec(vsa.console,
+                                                         MAX_NR_CONSOLES + 1);
                         vsa.console--;
                         console_lock();
                         ret = vc_allocate(vsa.console);