USB: serial: ti_usb_3410_5052: fix port-close races (6f1d1dc8) · Commits · 戴 / test

Fix races between closing a port and opening or closing another port on the same device which could lead to a failure to start or stop the shared interrupt URB. The latter could potentially cause a use-after-free or worse in the completion handler on driver unbind. Fixes: ("Linux-2.6.12-rc2") Cc: stable <stable@vger.kernel.org> Signed-off-by:

Johan Hovold <johan@kernel.org>

drivers/usb/serial/ti_usb_3410_5052.c

+3 −7

Original line number	Diff line number	Diff line
		@@ -776,7 +776,6 @@ static void ti_close(struct usb_serial_port *port)
		struct ti_port *tport;
		int port_number;
		int status;
		int do_unlock;
		unsigned long flags;

		tdev = usb_get_serial_data(port->serial);
		@@ -800,15 +799,12 @@ static void ti_close(struct usb_serial_port *port)
		"%s - cannot send close port command, %d\n"
		, __func__, status);

		/* if mutex_lock is interrupted, continue anyway */
		do_unlock = !mutex_lock_interruptible(&tdev->td_open_close_lock);
		mutex_lock(&tdev->td_open_close_lock);
		--tport->tp_tdev->td_open_port_count;
		if (tport->tp_tdev->td_open_port_count <= 0) {
		if (tport->tp_tdev->td_open_port_count == 0) {
		/* last port is closed, shut down interrupt urb */
		usb_kill_urb(port->serial->port[0]->interrupt_in_urb);
		tport->tp_tdev->td_open_port_count = 0;
		}
		if (do_unlock)
		mutex_unlock(&tdev->td_open_close_lock);
		}

Admin message