* [PATCH 1/5] USB: serial: garmin_gps: fix I/O after failed probe and remove
[not found] <20171011120301.25673-1-johan@kernel.org>
@ 2017-10-11 12:02 ` Johan Hovold
2017-10-11 12:51 ` Greg KH
2017-10-11 12:02 ` [PATCH 2/5] USB: serial: garmin_gps: fix memory leak on probe errors Johan Hovold
1 sibling, 1 reply; 5+ messages in thread
From: Johan Hovold @ 2017-10-11 12:02 UTC (permalink / raw)
To: linux-usb; +Cc: Johan Hovold, stable
Make sure to stop any submitted interrupt and bulk-out URBs before
returning after failed probe and when the port is being unbound to avoid
later NULL-pointer dereferences in the completion callbacks.
Also fix up the related and broken I/O cancellation on failed open and
on close. (Note that port->write_urb was never submitted.)
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org> # 51a2f077 ("USB: introduce usb_anchor")
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/usb/serial/garmin_gps.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
index 1f439b6e7e6f..8967de6623c4 100644
--- a/drivers/usb/serial/garmin_gps.c
+++ b/drivers/usb/serial/garmin_gps.c
@@ -138,6 +138,7 @@ struct garmin_data {
__u8 privpkt[4*6];
spinlock_t lock;
struct list_head pktlist;
+ struct usb_anchor write_urbs;
};
@@ -905,13 +906,19 @@ static int garmin_init_session(struct usb_serial_port *port)
sizeof(GARMIN_START_SESSION_REQ), 0);
if (status < 0)
- break;
+ goto err_kill_urbs;
}
if (status > 0)
status = 0;
}
+ return status;
+
+err_kill_urbs:
+ usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
+ usb_kill_urb(port->interrupt_in_urb);
+
return status;
}
@@ -930,7 +937,6 @@ static int garmin_open(struct tty_struct *tty, struct usb_serial_port *port)
spin_unlock_irqrestore(&garmin_data_p->lock, flags);
/* shutdown any bulk reads that might be going on */
- usb_kill_urb(port->write_urb);
usb_kill_urb(port->read_urb);
if (garmin_data_p->state == STATE_RESET)
@@ -953,7 +959,7 @@ static void garmin_close(struct usb_serial_port *port)
/* shutdown our urbs */
usb_kill_urb(port->read_urb);
- usb_kill_urb(port->write_urb);
+ usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
/* keep reset state so we know that we must start a new session */
if (garmin_data_p->state != STATE_RESET)
@@ -1037,12 +1043,14 @@ static int garmin_write_bulk(struct usb_serial_port *port,
}
/* send it down the pipe */
+ usb_anchor_urb(urb, &garmin_data_p->write_urbs);
status = usb_submit_urb(urb, GFP_ATOMIC);
if (status) {
dev_err(&port->dev,
"%s - usb_submit_urb(write bulk) failed with status = %d\n",
__func__, status);
count = status;
+ usb_unanchor_urb(urb);
kfree(buffer);
}
@@ -1399,6 +1407,7 @@ static int garmin_port_probe(struct usb_serial_port *port)
garmin_data_p->state = 0;
garmin_data_p->flags = 0;
garmin_data_p->count = 0;
+ init_usb_anchor(&garmin_data_p->write_urbs);
usb_set_serial_port_data(port, garmin_data_p);
status = garmin_init_session(port);
@@ -1411,6 +1420,7 @@ static int garmin_port_remove(struct usb_serial_port *port)
{
struct garmin_data *garmin_data_p = usb_get_serial_port_data(port);
+ usb_kill_anchored_urbs(&garmin_data_p->write_urbs);
usb_kill_urb(port->interrupt_in_urb);
del_timer_sync(&garmin_data_p->timer);
kfree(garmin_data_p);
--
2.14.2
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH 2/5] USB: serial: garmin_gps: fix memory leak on probe errors
[not found] <20171011120301.25673-1-johan@kernel.org>
2017-10-11 12:02 ` [PATCH 1/5] USB: serial: garmin_gps: fix I/O after failed probe and remove Johan Hovold
@ 2017-10-11 12:02 ` Johan Hovold
2017-10-11 12:52 ` Greg KH
1 sibling, 1 reply; 5+ messages in thread
From: Johan Hovold @ 2017-10-11 12:02 UTC (permalink / raw)
To: linux-usb; +Cc: Johan Hovold, stable
Make sure to free the port private data before returning after a failed
probe attempt.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/usb/serial/garmin_gps.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
index 8967de6623c4..677558c99a97 100644
--- a/drivers/usb/serial/garmin_gps.c
+++ b/drivers/usb/serial/garmin_gps.c
@@ -1411,6 +1411,12 @@ static int garmin_port_probe(struct usb_serial_port *port)
usb_set_serial_port_data(port, garmin_data_p);
status = garmin_init_session(port);
+ if (status)
+ goto err_free;
+
+ return 0;
+err_free:
+ kfree(garmin_data_p);
return status;
}
--
2.14.2
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH 1/5] USB: serial: garmin_gps: fix I/O after failed probe and remove
2017-10-11 12:02 ` [PATCH 1/5] USB: serial: garmin_gps: fix I/O after failed probe and remove Johan Hovold
@ 2017-10-11 12:51 ` Greg KH
2017-10-11 13:27 ` Johan Hovold
0 siblings, 1 reply; 5+ messages in thread
From: Greg KH @ 2017-10-11 12:51 UTC (permalink / raw)
To: Johan Hovold; +Cc: linux-usb, stable
On Wed, Oct 11, 2017 at 02:02:57PM +0200, Johan Hovold wrote:
> Make sure to stop any submitted interrupt and bulk-out URBs before
> returning after failed probe and when the port is being unbound to avoid
> later NULL-pointer dereferences in the completion callbacks.
>
> Also fix up the related and broken I/O cancellation on failed open and
> on close. (Note that port->write_urb was never submitted.)
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable <stable@vger.kernel.org> # 51a2f077 ("USB: introduce usb_anchor")
> Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 2/5] USB: serial: garmin_gps: fix memory leak on probe errors
2017-10-11 12:02 ` [PATCH 2/5] USB: serial: garmin_gps: fix memory leak on probe errors Johan Hovold
@ 2017-10-11 12:52 ` Greg KH
0 siblings, 0 replies; 5+ messages in thread
From: Greg KH @ 2017-10-11 12:52 UTC (permalink / raw)
To: Johan Hovold; +Cc: linux-usb, stable
On Wed, Oct 11, 2017 at 02:02:58PM +0200, Johan Hovold wrote:
> Make sure to free the port private data before returning after a failed
> probe attempt.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable <stable@vger.kernel.org>
> Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 1/5] USB: serial: garmin_gps: fix I/O after failed probe and remove
2017-10-11 12:51 ` Greg KH
@ 2017-10-11 13:27 ` Johan Hovold
0 siblings, 0 replies; 5+ messages in thread
From: Johan Hovold @ 2017-10-11 13:27 UTC (permalink / raw)
To: Greg KH; +Cc: Johan Hovold, linux-usb, stable
On Wed, Oct 11, 2017 at 02:51:53PM +0200, Greg Kroah-Hartman wrote:
> On Wed, Oct 11, 2017 at 02:02:57PM +0200, Johan Hovold wrote:
> > Make sure to stop any submitted interrupt and bulk-out URBs before
> > returning after failed probe and when the port is being unbound to avoid
> > later NULL-pointer dereferences in the completion callbacks.
> >
> > Also fix up the related and broken I/O cancellation on failed open and
> > on close. (Note that port->write_urb was never submitted.)
> >
> > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> > Cc: stable <stable@vger.kernel.org> # 51a2f077 ("USB: introduce usb_anchor")
> > Signed-off-by: Johan Hovold <johan@kernel.org>
>
> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Thanks for reviewing these. All now applied.
Johan
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2017-10-11 13:27 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20171011120301.25673-1-johan@kernel.org>
2017-10-11 12:02 ` [PATCH 1/5] USB: serial: garmin_gps: fix I/O after failed probe and remove Johan Hovold
2017-10-11 12:51 ` Greg KH
2017-10-11 13:27 ` Johan Hovold
2017-10-11 12:02 ` [PATCH 2/5] USB: serial: garmin_gps: fix memory leak on probe errors Johan Hovold
2017-10-11 12:52 ` Greg KH
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.