TechPanelGM/kernel_xiaomi_sm8250
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

USB: serial: keyspan_pda: fix write-wakeup use-after-free

Browse Source 
commit 37faf50615412947868c49aee62f68233307f4e4 upstream.

The driver's deferred write wakeup was never flushed on disconnect,
something which could lead to the driver port data being freed while the
wakeup work is still scheduled.

Fix this by using the usb-serial write wakeup which gets cancelled
properly on disconnect.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Johan Hovold
2020-10-25 18:45:50 +01:00
committed by Greg Kroah-Hartman
parent 9d5a037b43
commit 41bb69bb5f
1 changed files with 3 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
drivers/usb/serial/keyspan_pda.c
View File

@@ -43,8 +43,7 @@
struct keyspan_pda_private { struct keyspan_pda_private {
int tx_room; int tx_room;
int tx_throttled; int tx_throttled;
struct work_struct wakeup_work; struct work_struct unthrottle_work;
struct work_struct unthrottle_work;
struct usb_serial *serial; struct usb_serial *serial;
struct usb_serial_port *port; struct usb_serial_port *port;
}; };
@@ -97,15 +96,6 @@ static const struct usb_device_id id_table_fake_xircom[] = {
}; };
#endif #endif
static void keyspan_pda_wakeup_write(struct work_struct *work)
{
struct keyspan_pda_private *priv =
container_of(work, struct keyspan_pda_private, wakeup_work);
struct usb_serial_port *port = priv->port;
tty_port_tty_wakeup(&port->port);
}
static void keyspan_pda_request_unthrottle(struct work_struct *work) static void keyspan_pda_request_unthrottle(struct work_struct *work)
{ {
struct keyspan_pda_private *priv = struct keyspan_pda_private *priv =
@@ -183,7 +173,7 @@ static void keyspan_pda_rx_interrupt(struct urb *urb)
case 2: /* tx unthrottle interrupt */ case 2: /* tx unthrottle interrupt */
priv->tx_throttled = 0; priv->tx_throttled = 0;
/* queue up a wakeup at scheduler time */ /* queue up a wakeup at scheduler time */
schedule_work(&priv->wakeup_work); usb_serial_port_softint(port);
break; break;
default: default:
break; break;
@@ -563,7 +553,7 @@ static void keyspan_pda_write_bulk_callback(struct urb *urb)
priv = usb_get_serial_port_data(port); priv = usb_get_serial_port_data(port);
/* queue up a wakeup at scheduler time */ /* queue up a wakeup at scheduler time */
schedule_work(&priv->wakeup_work); usb_serial_port_softint(port);
} }
@@ -716,7 +706,6 @@ static int keyspan_pda_port_probe(struct usb_serial_port *port)
if (!priv) if (!priv)
return -ENOMEM; return -ENOMEM;
INIT_WORK(&priv->wakeup_work, keyspan_pda_wakeup_write);
INIT_WORK(&priv->unthrottle_work, keyspan_pda_request_unthrottle); INIT_WORK(&priv->unthrottle_work, keyspan_pda_request_unthrottle);
priv->serial = port->serial; priv->serial = port->serial;
priv->port = port; priv->port = port;