I think there is a race between usb_serial_put() and
usb_serial_get_by_index() (and get_free_serial()) with regards
to handling the serial port refcount.
usb_serial_get_by_index() gets a reference on the serial port under
table_lock while return_serial releases all the returned ports
from the table under the same lock. However, the table_lock is not
taken around the call to kref_put, theoretically allowing to sneak
in and grab a reference after kref_put has already determined that
the reference count is zero (and before calling destroy_serial)
causing use after free.
Signed-off-by: Benny Halevy <bhalevy@ns1.bhalevy.com>
Cc: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Might fix bug 8561
On Mon, 4 Jun 2007, Paulo Pereira wrote:
> The patch that you send is not resolving the problem... :(
> I stil have Kernel panic after 45/60 min of work with Ktorrent/Amule...
>
> The Drump is:
>
> Call Trace:
> [<c055fb36>] usb_hcd_submit+0xb1/0x763
> [<f9276488>] ipt_do_table+0x2c7/0x2ef [ip_tables]
> [<f929a6d7>] nf_ct_deliver_cached_events+0x41/0x96 [nf_conntrak]
> [<f9288254>] ipv4_confirm+0x36/0c3b [nf_conntrack_ipv4]
> [<c05ce7c2>] tcp_v4_rcv+0x827/0x899
> [<c05afcc0>] nf_hook_slow+0x4d/0xb5
> [<c042826f>] irq_enter+0x19/0x23
> [<c042826f>] irq_enter+0x19/0x23
> [<c040794c>] do_IRQ+0xbd/0xd1
> [<f90893c9>] option_write+0xa7/0xef [option]
Okay, from this it looks like there's a problem in the option.c serial
driver. Glancing at the code, it's obvious why: The thing totally
abuses the USB API.
Try applying this patch; it should help.
From: Alan Stern <stern@rowland.harvard.edu>
Cc: Paulo Pereira <pfmp.404@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Some further cleanup after Oliver's patch to update the tty
buffering. The input buffer is not used at all anymore, so
I removed it.
Signed-off-by: Al Borchers <alborchers@steinerpoint.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
this is an update of the whiteheat driver. It fixes:
- switch from spinlocks to mutexes to prevent sleeping with a spinlock held
- locking to stop races with disconnect
- error handling for commands that time out
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
in order to be able to switch back to 'flow-control none'
after having activated 'flow-control rts/cts', I made
a small change to 'pl2303.c'.
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
this fixes the flushing trouble due to its own buffering for this driver.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Cc: Al Borchers <alborchers@steinerpoint.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
the new tty buffering code allows usb drivers to stop private buffering.
In fact we must do so to allow flushing to work correctly. This does so
for the visor driver.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The new FT232RL allows setting and getting the value of the latency
timer, like on the FT232BM. However, the driver will not create the
sysfs entries for the RL without this one-line patch.
I have tested it on two systems with successful results.
From: Stepan Moskovchenko <stevenm86@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Improvements and fixes to the MCT U232 USB/serial interface driver.
Implement RTS/CTS hardware flow control. Implement HUPCL. Bring
handling of DTR and RTS into conformance with other Linux serial
port drivers - assert both signals when opening device, even if
"crtscts" is not currently selected.
Signed-off-by: Dave Platt <dplatt@radagast.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch adds support for the most recent Digi EdgePort USB serial
devices.
Signed-off-by: Martin K. Petersen <mkp@mkp.net>
Signed-off-by: Mike Swift <mikes@digi.com>
Signed-off-by: Jeremy McBane <jmcbane@digi.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Last week I've been searching for a driver for the CA-42 cable (see usb
below) that fitted my kernel 2.6.20. I only found an abandoned version for a
driver on your website that indeed worked on 2.6.18 but wouldn't even
compile with a more recent 2.6.20 kernel.
I fiddled 2 evenings with the kernel code and have patched it up now to work
with the modifications in the 2.6.20 kernel. The patch is attached hereafter
and it works fine (at least for me :-) ).
Bus 2 Device 13: ID 0ea0:6858 Ours Technology, Inc.
I had to fiddle a little with the settings in .gnokiirc but that also
occurred with the older 2.6.18 kernel. Nevertheless, on one system with this
cable and my Nokia 6070 I had best results with :
model = 6510
connection = dku5
while on an other system with the same kernel, cable and phone it only worked
with :
model = AT
connection = serial
serial_write_usleep = 1
From: Kees Lemmens <C.W.J.Lemmens@ewi.tudelft.nl>
Cc: <pawel.kot@gmail.com>
Cc: <bozo@andrews.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Add support for Keyspan adapters: USA-49WG and USA-28XG
Signed-off-by: Lucy P. McCoy <lucy@keyspan.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
this implements generic support for suspend/resume for usb serial.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Reported by Grzegorz Chimosz <gchimi@gmail.com>
Signed-off-by: Luiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
usb_unlink_urb() is asynchronous, therefore an URB's buffer may not
be freed without waiting for the completion handler. This patch switches
to usb_kill_urb(), which is synchronous.
Thanks to Alan for making me look at the remaining users of usb_unlink_urb()
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Al Borchers <alborchers@steinerpoint.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
you are submitting an URB with GFP_KERNEL holding a spinlock.
In this case the spinlock can be dropped earlier.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Cc: Al Borchers <alborchers@steinerpoint.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch adds support for the serial port on Olimex arm-usb-ocd
JTAG interface.
The device appears as two serial ports, but the first one is reserved
for the JTAG interface. The JTAG interface can be used with OpenOCD
from userspace. For more information, please see:
http://openocd.berlios.de/web/http://www.olimex.com/dev/arm-usb-ocd.html
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch adds support for the newly released Aircard 595U EVDO
modem to the Sierra Wireless driver (sierra.c) in kernel 2.6.21.
I suspect that my mailer may be mangling patches so let me know and
I'll try to resend it.
From: Danny Budik <dbudik@ist-traffic.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
USB product id registration for the OpenDCC (www.opendcc.de)
model railway central unit. Applies to 2.6.21.1.
Signed-off-by: Guido Scholz <guido.scholz@bayernline.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Fix debug output. Previously, it would output "0xFFFFFFB0" on 32-bit
archs (and probably "0xFFFFFFFFFFFFFFB0" on 64-bits), because buf is
taken as signed char, which is promoted to signed int, while %x always
expects an unsigned int.
Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Hello,
I need to use MaxStream's PKG-U modules which includes a ftdi sio chipset for
usb2serial communication, here are the patches for handling Maxstream's modules.
The VID & PID to use with the open-source driver are provided on the CD-ROM
bundled with the modules.
From: Neil Superna ARMSTRONG <superna@na-prod.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
the transfer of allocating the descriptor in attach and no longer in open
was incomplete resulting in a memory leak coverity spotted. This fix
is against the patch set you posted.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Fix the misspellings of "propogate", "writting" and (oh, the shame
:-) "kenrel" in the source tree.
Signed-off-by: Robert P. J. Day <rpjday@mindspring.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Remove includes of <linux/smp_lock.h> where it is not used/needed.
Suggested by Al Viro.
Builds cleanly on x86_64, i386, alpha, ia64, powerpc, sparc,
sparc64, and arm (all 59 defconfigs).
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Add the detection for the BandRich BandLuxe C100/C100S/C120 HSDPA Data
Card. With the vendor and product IDs are set properly, the data card can
be detected and works fine.
Signed-off-by: Leon Leong <upleong@bandrich.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
omninet kills all URBs in close. However write() returns as soon as
the URB has been submitted. Killing the last URB means a race that
can lose that date written in the last call to write().
As a fix this is moved to shutdown().
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
we report errors to the caller. THis patch adds error handling to the driver.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
- report errors
- cleanup in error case
- use of endianness macros
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch adds the USB ID of the ADS Tech USBX-707 USB IR blaster (that
comes with the ADS Tech PTV-305 grabber card), which has a ftdi232bm
inside hooked up to a pic.
With this it should be fairly straightforward to make at least lirc
receiving work with this device. I will submit a patch to lirc for that
as soon as I have one ready, I'm getting data with minicom with this
patch, but need to figure out some more details such as best/correct
baudrate.
Signed-off-by: Jelle Foks <jelle@foks.8m.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
this has the same race as the visor driver. The counter must be incremented
under the lock it is checked under.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
- proper endianness macros
- scheduling in interrupt in error case
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Naranjo Manuel Francisco <naranjo.manuel@gmail.com>
the sierra driver does not directly use usb_kill_urb(). It uses a wrapper.
This wrapper means that callbacks which are running are not killed during
close, resubmitting and illicitly pushing data into the tty layer.
The whole purpose of usb_kill_urb() is subverted. The wrapper must be removed.
The same problem as the option driver.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
the option driver does not directly use usb_kill_urb(). It uses a wrapper.
This wrapper means that callbacks which are running are not killed during
close, resubmitting and illicitly pushing data into the tty layer.
The whole purpose of usb_kill_urb() is subverted. The wrapper must be removed.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Matthias Urlichs <smurf@smurf.noris.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This fixes:
- breaking DMA rules about buffers
- usage of _global_ variables to save a single device's attributes
- racy access to urb->status
- smp monotonity issue with statistics
- use of one buffer for many simultaneous URBs
- error handling introduced
- several instances of following NULL pointers
- use after free
- unnecessary GFP_ATOMIC
- GFP_KERNEL in interrupt
- various cleanups
- write room granularity issue that bit cdc-acm
- race in shutdown
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
io_edgeport is using a global variable without locking.
This is _the_ classical race condition. This patch switches to atomic_t.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
![](/avatar/362e80bc9fa0d4c6d6e2a8a86ae5d0d0?size=56 "Neil \\"Superna\\" ARMSTRONG"){kind=small}
