• Olivier Sobrie's avatar
    hso: update serial_table in usb disconnect method · 301d3b7e
    Olivier Sobrie authored
    The serial_table is used to map the minor number of the usb serial device
    to its associated context. The table is updated in the probe method and
    in hso_serial_ref_free() which is called either from the tty cleanup
    method or from the usb disconnect method.
    This patch ensures that the serial_table is updated in the disconnect
    method and no more from the cleanup method to avoid the following
    potential race condition.
    
     - hso_disconnect() is called for usb interface "x". Because the serial
       port was open and because the cleanup method of the tty_port hasn't
       been called yet, hso_serial_ref_free() is not run.
     - hso_probe() is called and fails for a new hso serial usb interface
       "y". The function hso_free_interface() is called and iterates
       over the element of serial_table to find the device associated to
       the usb interface context.
       If the usb interface context of usb interface "y" has been created
       at the same place as for usb interface "x", then the cleanup
       functions are called for usb interfaces "x" and "y" and
       hso_serial_ref_free() is called for both interfaces.
     - release_tty() is called for serial port linked to usb interface "x"
       and possibly crash because the tty_port structure contained in the
       hso_device structure has been freed.
    Signed-off-by: default avatarOlivier Sobrie <olivier@sobrie.be>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    301d3b7e
hso.c 83 KB