Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-02 17:11:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

usb: cdc-acm: Decrement tty port's refcount if probe() fail

Browse Source 
The cdc-acm driver does not have a refcount of itself, but uses a
tty_port's refcount. That is, if the refcount of tty_port is '0', we
can clean up the cdc-acm driver by calling the .destruct()
callback function of struct tty_port_operations.

The problem is the destruct() callback function is not called if
the probe() fails, because tty_port's refcount is not zero. So,
add tty_port_put() when probe() fails.

Signed-off-by: Jaejoong Kim <climbbb.kim@gmail.com>
Acked-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Jaejoong Kim 2018-06-21 17:45:05 +09:00 committed by Greg Kroah-Hartman
parent 61ef4b9079
commit cae2bc768d
1 changed files with 17 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
drivers/usb/class/cdc-acm.c
View File

@ -1378,6 +1378,9 @@ made_compressed_probe:
if (acm == NULL) if (acm == NULL)
goto alloc_fail; goto alloc_fail;
tty_port_init(&acm->port);
acm->port.ops = &acm_port_ops;
minor = acm_alloc_minor(acm); minor = acm_alloc_minor(acm);
if (minor < 0) if (minor < 0)
goto alloc_fail1; goto alloc_fail1;
@ -1413,22 +1416,20 @@ made_compressed_probe:
acm->out = usb_sndintpipe(usb_dev, epwrite->bEndpointAddress); acm->out = usb_sndintpipe(usb_dev, epwrite->bEndpointAddress);
else else
acm->out = usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress); acm->out = usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress);
tty_port_init(&acm->port);
acm->port.ops = &acm_port_ops;
init_usb_anchor(&acm->delayed); init_usb_anchor(&acm->delayed);
acm->quirks = quirks; acm->quirks = quirks;
buf = usb_alloc_coherent(usb_dev, ctrlsize, GFP_KERNEL, &acm->ctrl_dma); buf = usb_alloc_coherent(usb_dev, ctrlsize, GFP_KERNEL, &acm->ctrl_dma);
if (!buf) if (!buf)
goto alloc_fail2; goto alloc_fail1;
acm->ctrl_buffer = buf; acm->ctrl_buffer = buf;
if (acm_write_buffers_alloc(acm) < 0) if (acm_write_buffers_alloc(acm) < 0)
goto alloc_fail4; goto alloc_fail2;
acm->ctrlurb = usb_alloc_urb(0, GFP_KERNEL); acm->ctrlurb = usb_alloc_urb(0, GFP_KERNEL);
if (!acm->ctrlurb) if (!acm->ctrlurb)
goto alloc_fail5; goto alloc_fail3;
for (i = 0; i < num_rx_buf; i++) { for (i = 0; i < num_rx_buf; i++) {
struct acm_rb *rb = &(acm->read_buffers[i]); struct acm_rb *rb = &(acm->read_buffers[i]);
@ -1437,13 +1438,13 @@ made_compressed_probe:
rb->base = usb_alloc_coherent(acm->dev, readsize, GFP_KERNEL, rb->base = usb_alloc_coherent(acm->dev, readsize, GFP_KERNEL,
&rb->dma); &rb->dma);
if (!rb->base) if (!rb->base)
goto alloc_fail6; goto alloc_fail4;
rb->index = i; rb->index = i;
rb->instance = acm; rb->instance = acm;
urb = usb_alloc_urb(0, GFP_KERNEL); urb = usb_alloc_urb(0, GFP_KERNEL);
if (!urb) if (!urb)
goto alloc_fail6; goto alloc_fail4;
urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
urb->transfer_dma = rb->dma; urb->transfer_dma = rb->dma;
@ -1465,7 +1466,7 @@ made_compressed_probe:
snd->urb = usb_alloc_urb(0, GFP_KERNEL); snd->urb = usb_alloc_urb(0, GFP_KERNEL);
if (snd->urb == NULL) if (snd->urb == NULL)
goto alloc_fail7; goto alloc_fail5;
if (usb_endpoint_xfer_int(epwrite)) if (usb_endpoint_xfer_int(epwrite))
usb_fill_int_urb(snd->urb, usb_dev, acm->out, usb_fill_int_urb(snd->urb, usb_dev, acm->out,
@ -1483,7 +1484,7 @@ made_compressed_probe:
i = device_create_file(&intf->dev, &dev_attr_bmCapabilities); i = device_create_file(&intf->dev, &dev_attr_bmCapabilities);
if (i < 0) if (i < 0)
goto alloc_fail7; goto alloc_fail5;
if (h.usb_cdc_country_functional_desc) { /* export the country data */ if (h.usb_cdc_country_functional_desc) { /* export the country data */
struct usb_cdc_country_functional_desc * cfd = struct usb_cdc_country_functional_desc * cfd =
@ -1542,7 +1543,7 @@ skip_countries:
&control_interface->dev); &control_interface->dev);
if (IS_ERR(tty_dev)) { if (IS_ERR(tty_dev)) {
rv = PTR_ERR(tty_dev); rv = PTR_ERR(tty_dev);
goto alloc_fail8; goto alloc_fail6;
} }
if (quirks & CLEAR_HALT_CONDITIONS) { if (quirks & CLEAR_HALT_CONDITIONS) {
@ -1551,7 +1552,7 @@ skip_countries:
} }
return 0; return 0;
alloc_fail8: alloc_fail6:
if (acm->country_codes) { if (acm->country_codes) {
device_remove_file(&acm->control->dev, device_remove_file(&acm->control->dev,
&dev_attr_wCountryCodes); &dev_attr_wCountryCodes);
@ -1560,23 +1561,21 @@ alloc_fail8:
kfree(acm->country_codes); kfree(acm->country_codes);
} }
device_remove_file(&acm->control->dev, &dev_attr_bmCapabilities); device_remove_file(&acm->control->dev, &dev_attr_bmCapabilities);
alloc_fail7: alloc_fail5:
usb_set_intfdata(intf, NULL); usb_set_intfdata(intf, NULL);
for (i = 0; i < ACM_NW; i++) for (i = 0; i < ACM_NW; i++)
usb_free_urb(acm->wb[i].urb); usb_free_urb(acm->wb[i].urb);
alloc_fail6: alloc_fail4:
for (i = 0; i < num_rx_buf; i++) for (i = 0; i < num_rx_buf; i++)
usb_free_urb(acm->read_urbs[i]); usb_free_urb(acm->read_urbs[i]);
acm_read_buffers_free(acm); acm_read_buffers_free(acm);
usb_free_urb(acm->ctrlurb); usb_free_urb(acm->ctrlurb);
alloc_fail5: alloc_fail3:
acm_write_buffers_free(acm); acm_write_buffers_free(acm);
alloc_fail4:
usb_free_coherent(usb_dev, ctrlsize, acm->ctrl_buffer, acm->ctrl_dma);
alloc_fail2: alloc_fail2:
acm_release_minor(acm); usb_free_coherent(usb_dev, ctrlsize, acm->ctrl_buffer, acm->ctrl_dma);
alloc_fail1: alloc_fail1:
kfree(acm); tty_port_put(&acm->port);
alloc_fail: alloc_fail:
return rv; return rv;
} }