hso: fix crash when device disappears while serial port is open (29bd3bc1) · Commits · 戴 / test

When the device disappear, the function hso_disconnect() is called to perform cleanup. In the cleanup function, hso_free_interface() calls tty_port_tty_hangup() in view of scheduling a work to hang up the tty if needed. If the port was not open then hso_serial_ref_free() is called directly to cleanup everything. Otherwise, hso_serial_ref_free() is called when the last fd associated to the port is closed. For each open port, tty_release() will call the close method, hso_serial_close(), which drops the last kref and call hso_serial_ref_free() which unregisters, destroys the tty port and finally frees the structure in which the tty_port structure is included. Later, in tty_release(), more precisely when release_tty() is called, the tty_port previously freed is accessed to cancel the tty buf workqueue and it leads to a crash. In view of avoiding this crash, we add a cleanup method that is called at the end of the hangup process and we drop the last kref in this function when all the ports have been closed, when tty_port is no more needed and when it is safe to free the structure containing the tty_port structure. Signed-off-by:

Olivier Sobrie <olivier@sobrie.be> Signed-off-by:

David S. Miller <davem@davemloft.net>

drivers/net/usb/hso.c

+13 −4

Original line number	Diff line number	Diff line
		@@ -1270,7 +1270,6 @@ static int hso_serial_open(struct tty_struct tty, struct file filp)
		goto err_out;

		D1("Opening %d", serial->minor);
		kref_get(&serial->parent->ref);

		/* setup */
		tty->driver_data = serial;
		@@ -1289,7 +1288,8 @@ static int hso_serial_open(struct tty_struct tty, struct file filp)
		if (result) {
		hso_stop_serial_device(serial->parent);
		serial->port.count--;
		kref_put(&serial->parent->ref, hso_serial_ref_free);
		} else {
		kref_get(&serial->parent->ref);
		}
		} else {
		D1("Port was already open");
		@@ -1339,8 +1339,6 @@ static void hso_serial_close(struct tty_struct tty, struct file filp)
		usb_autopm_put_interface(serial->parent->interface);

		mutex_unlock(&serial->parent->mutex);

		kref_put(&serial->parent->ref, hso_serial_ref_free);
		}

		/* close the requested serial port */
		@@ -1391,6 +1389,16 @@ static int hso_serial_write_room(struct tty_struct *tty)
		return room;
		}

		static void hso_serial_cleanup(struct tty_struct *tty)
		{
		struct hso_serial *serial = tty->driver_data;

		if (!serial)
		return;

		kref_put(&serial->parent->ref, hso_serial_ref_free);
		}

		/* setup the term */
		static void hso_serial_set_termios(struct tty_struct tty, struct ktermios old)
		{
		@@ -3214,6 +3222,7 @@ static const struct tty_operations hso_serial_ops = {
		.close = hso_serial_close,
		.write = hso_serial_write,
		.write_room = hso_serial_write_room,
		.cleanup = hso_serial_cleanup,
		.ioctl = hso_serial_ioctl,
		.set_termios = hso_serial_set_termios,
		.chars_in_buffer = hso_serial_chars_in_buffer,

Admin message