Commit cae2bc76 authored by Jaejoong Kim's avatar Jaejoong Kim Committed by Greg Kroah-Hartman
Browse files

usb: cdc-acm: Decrement tty port's refcount if probe() fail 



The cdc-acm driver does not have a refcount of itself, but uses a
tty_port's refcount. That is, if the refcount of tty_port is '0', we
can clean up the cdc-acm driver by calling the .destruct()
callback function of struct tty_port_operations.

The problem is the destruct() callback function is not called if
the probe() fails, because tty_port's refcount is not zero. So,
add tty_port_put() when probe() fails.

Signed-off-by: default avatarJaejoong Kim <climbbb.kim@gmail.com>
Acked-by: default avatarOliver Neukum <oneukum@suse.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 61ef4b90

drivers/usb/class/cdc-acm.c

+17 −18
Original line number Diff line number Diff line
@@ -1378,6 +1378,9 @@ made_compressed_probe: 
	if (acm == NULL)

		goto alloc_fail;



	tty_port_init(&acm->port);

	acm->port.ops = &acm_port_ops;



	minor = acm_alloc_minor(acm);

	if (minor < 0)

		goto alloc_fail1;
@@ -1413,22 +1416,20 @@ made_compressed_probe: 
		acm->out = usb_sndintpipe(usb_dev, epwrite->bEndpointAddress);

	else

		acm->out = usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress);

	tty_port_init(&acm->port);

	acm->port.ops = &acm_port_ops;

	init_usb_anchor(&acm->delayed);

	acm->quirks = quirks;



	buf = usb_alloc_coherent(usb_dev, ctrlsize, GFP_KERNEL, &acm->ctrl_dma);

	if (!buf)

		goto alloc_fail2;

		goto alloc_fail1;

	acm->ctrl_buffer = buf;



	if (acm_write_buffers_alloc(acm) < 0)

		goto alloc_fail4;

		goto alloc_fail2;



	acm->ctrlurb = usb_alloc_urb(0, GFP_KERNEL);

	if (!acm->ctrlurb)

		goto alloc_fail5;

		goto alloc_fail3;



	for (i = 0; i < num_rx_buf; i++) {

		struct acm_rb *rb = &(acm->read_buffers[i]);
@@ -1437,13 +1438,13 @@ made_compressed_probe: 
		rb->base = usb_alloc_coherent(acm->dev, readsize, GFP_KERNEL,

								&rb->dma);

		if (!rb->base)

			goto alloc_fail6;

			goto alloc_fail4;

		rb->index = i;

		rb->instance = acm;



		urb = usb_alloc_urb(0, GFP_KERNEL);

		if (!urb)

			goto alloc_fail6;

			goto alloc_fail4;



		urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;

		urb->transfer_dma = rb->dma;
@@ -1465,7 +1466,7 @@ made_compressed_probe: 


		snd->urb = usb_alloc_urb(0, GFP_KERNEL);

		if (snd->urb == NULL)

			goto alloc_fail7;

			goto alloc_fail5;



		if (usb_endpoint_xfer_int(epwrite))

			usb_fill_int_urb(snd->urb, usb_dev, acm->out,
@@ -1483,7 +1484,7 @@ made_compressed_probe: 


	i = device_create_file(&intf->dev, &dev_attr_bmCapabilities);

	if (i < 0)

		goto alloc_fail7;

		goto alloc_fail5;



	if (h.usb_cdc_country_functional_desc) { /* export the country data */

		struct usb_cdc_country_functional_desc * cfd =
@@ -1542,7 +1543,7 @@ skip_countries: 
			&control_interface->dev);

	if (IS_ERR(tty_dev)) {

		rv = PTR_ERR(tty_dev);

		goto alloc_fail8;

		goto alloc_fail6;

	}



	if (quirks & CLEAR_HALT_CONDITIONS) {
@@ -1551,7 +1552,7 @@ skip_countries: 
	}



	return 0;

alloc_fail8:

alloc_fail6:

	if (acm->country_codes) {

		device_remove_file(&acm->control->dev,

				&dev_attr_wCountryCodes);
@@ -1560,23 +1561,21 @@ alloc_fail8: 
		kfree(acm->country_codes);

	}

	device_remove_file(&acm->control->dev, &dev_attr_bmCapabilities);

alloc_fail7:

alloc_fail5:

	usb_set_intfdata(intf, NULL);

	for (i = 0; i < ACM_NW; i++)

		usb_free_urb(acm->wb[i].urb);

alloc_fail6:

alloc_fail4:

	for (i = 0; i < num_rx_buf; i++)

		usb_free_urb(acm->read_urbs[i]);

	acm_read_buffers_free(acm);

	usb_free_urb(acm->ctrlurb);

alloc_fail5:

alloc_fail3:

	acm_write_buffers_free(acm);

alloc_fail4:

	usb_free_coherent(usb_dev, ctrlsize, acm->ctrl_buffer, acm->ctrl_dma);

alloc_fail2:

	acm_release_minor(acm);

	usb_free_coherent(usb_dev, ctrlsize, acm->ctrl_buffer, acm->ctrl_dma);

alloc_fail1:

	kfree(acm);

	tty_port_put(&acm->port);

alloc_fail:

	return rv;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE