Commit a4720c65 authored by Alan Stern's avatar Alan Stern Committed by Greg Kroah-Hartman

USB: serial: don't call release without attach

This patch (as1295) fixes a recently-added bug in the USB serial core.
If certain kinds of errors occur during probing, the core may call a
serial driver's release method without previously calling the attach
method.  This causes some drivers (io_ti in particular) to perform an
invalid memory access.

The patch adds a new flag to keep track of whether or not attach has
been called.
Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Tested-by: default avatarJean-Denis Girard <jd.girard@sysnux.pf>
CC: stable <stable@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent ba6b702f
...@@ -156,7 +156,8 @@ static void destroy_serial(struct kref *kref) ...@@ -156,7 +156,8 @@ static void destroy_serial(struct kref *kref)
if (serial->minor != SERIAL_TTY_NO_MINOR) if (serial->minor != SERIAL_TTY_NO_MINOR)
return_serial(serial); return_serial(serial);
serial->type->release(serial); if (serial->attached)
serial->type->release(serial);
/* Now that nothing is using the ports, they can be freed */ /* Now that nothing is using the ports, they can be freed */
for (i = 0; i < serial->num_port_pointers; ++i) { for (i = 0; i < serial->num_port_pointers; ++i) {
...@@ -1059,12 +1060,15 @@ int usb_serial_probe(struct usb_interface *interface, ...@@ -1059,12 +1060,15 @@ int usb_serial_probe(struct usb_interface *interface,
module_put(type->driver.owner); module_put(type->driver.owner);
if (retval < 0) if (retval < 0)
goto probe_error; goto probe_error;
serial->attached = 1;
if (retval > 0) { if (retval > 0) {
/* quietly accept this device, but don't bind to a /* quietly accept this device, but don't bind to a
serial port as it's about to disappear */ serial port as it's about to disappear */
serial->num_ports = 0; serial->num_ports = 0;
goto exit; goto exit;
} }
} else {
serial->attached = 1;
} }
if (get_free_serial(serial, num_ports, &minor) == NULL) { if (get_free_serial(serial, num_ports, &minor) == NULL) {
......
...@@ -150,6 +150,7 @@ struct usb_serial { ...@@ -150,6 +150,7 @@ struct usb_serial {
struct usb_interface *interface; struct usb_interface *interface;
unsigned char disconnected:1; unsigned char disconnected:1;
unsigned char suspending:1; unsigned char suspending:1;
unsigned char attached:1;
unsigned char minor; unsigned char minor;
unsigned char num_ports; unsigned char num_ports;
unsigned char num_port_pointers; unsigned char num_port_pointers;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment