forked from Minki/linux
9a6b1efa6f
When a usb serial adapter is used as console, the usb serial console
driver bumps the open_count on the port struct used but doesn't attach
a real tty to it (only a fake one temporaly). If this port is opened later
using the regular character device interface, the open method won't
initialize the port, which is the expected, and will receive a brand new
tty struct created by tty layer, which will be stored in port->tty.
When the last close is issued, open_count won't be 0 because of the
console usage and the port->tty will still contain the old tty value. This
is the last ttyUSB<n> close so the allocated tty will be freed by the
tty layer. The usb_serial and usb_serial_port are still in use by the
console, so port_free() won't be called (serial_close() ->
usb_serial_put() -> destroy_serial() -> port_free()), so the scheduled
work (port->work, usb_serial_port_work()) will still run. And
usb_serial_port_work() does:
(...)
tty = port->tty;
if (!tty)
return;
tty_wakeup(tty);
which causes (manually copied):
Faulting instruction address: 0x6b6b6b68
Oops: Kernel access of bad area, sig: 11 [#1]
PREEMPT PowerMac
Modules linked in: binfmt_misc ipv6 nfs lockd nfs_acl sunrpc dm_snapshot dm_mirror dm_mod hfsplus uinput ams input_polldev genrtc cpufreq_powersave i2c_powermac therm_adt746x snd_aoa_codec_tas snd_aoa_fabric_layout snd_aoa joydev snd_aoa_i2sbus snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc pmac_zilog serial_core evdev ide_cd cdrom snd appletouch soundcore snd_aoa_soundbus bcm43xx firmware_class usbhid ieee80211softmac ff_memless firewire_ohci firewire_core ieee80211 ieee80211_crypt crc_itu_t sungem sungem_phy uninorth_agp agpart ssb
NIP: 6b6b6b68 LR: c01b2108 CTR: 6b6b6b6b
REGS: c106de80 TRAP: 0400 Not tainted (2.6.24-rc2)
MSR: 40009032 <EE,ME,IR,DR> CR: 82004024 XER: 00000000
TASK = c106b4c0[5] 'events/0' THREAD: c106c000
GPR00: 6b6b6b6b c106df30 c106b4c0 c2d613a0 00009032 00000001 00001a00 00000001
GPR08: 00000008 00000000 00000000 c106c000 42004028 00000000 016ffbe0 0171a724
GPR16: 016ffcf4 00240e24 00240e70 016fee68 016ff9a4 c03046c4 c0327f50 c03046fc
GPR24: c106b6b9 c106b4c0 c101d610 c106c000 c02160fc c1eac1dc c2d613ac c2d613a0
NIP [6b6b6b68] 0x6b6b6b68
LR [c01b2108] tty_wakeup+0x6c/0x9c
Call Trace:
[c106df30] [c01b20e8] tty_wakeup+0x4c/0x9c (unreliable)
[c106df40] [c0216138] usb_serial_port_work+0x3c/0x78
[c106df50] [c00432e8] run_workqueue+0xc4/0x15c
[c106df90] [c0043798] worker_thread+0xa0/0x124
[c106dfd0] [c0048224] kthread+0x48/0x84
[c106dff0] [c00129bc] kernel_thread+0x44/0x60
Instruction dump:
XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
Slab corruption: size-2048 start=c2d613a0, len=2048
Redzone: 0x9f911029d74e35b/0x9f911029d74e35b.
Last user: [<c01b16d8>](release_one_tty+0xbc/0xf4)
050: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
Prev obj: start=c2d60b88, len=2048
Redzone: 0x9f911029d74e35b/0x9f911029d74e35b.
Last user: [<c00f30ec>](show_stat+0x410/0x428)
000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
This patch avoids this, clearing port->tty considering if the port is
used as serial console or not
Signed-off-by: Aristeu Rozanski <arozansk@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
|
||
|---|---|---|
| .. | ||
| aircable.c | ||
| airprime.c | ||
| ark3116.c | ||
| belkin_sa.c | ||
| belkin_sa.h | ||
| bus.c | ||
| ch341.c | ||
| ChangeLog.history | ||
| console.c | ||
| cp2101.c | ||
| cyberjack.c | ||
| cypress_m8.c | ||
| cypress_m8.h | ||
| digi_acceleport.c | ||
| empeg.c | ||
| ezusb_convert.pl | ||
| ezusb.c | ||
| ftdi_sio.c | ||
| ftdi_sio.h | ||
| funsoft.c | ||
| garmin_gps.c | ||
| generic.c | ||
| hp4x.c | ||
| io_16654.h | ||
| io_edgeport.c | ||
| io_edgeport.h | ||
| io_fw_boot2.h | ||
| io_fw_boot.h | ||
| io_fw_down2.h | ||
| io_fw_down3.h | ||
| io_fw_down.h | ||
| io_ionsp.h | ||
| io_tables.h | ||
| io_ti.c | ||
| io_ti.h | ||
| io_usbvend.h | ||
| ipaq.c | ||
| ipaq.h | ||
| ipw.c | ||
| ir-usb.c | ||
| iuu_phoenix.c | ||
| iuu_phoenix.h | ||
| Kconfig | ||
| keyspan_mpr_fw.h | ||
| keyspan_pda_fw.h | ||
| keyspan_pda.c | ||
| keyspan_pda.S | ||
| keyspan_usa18x_fw.h | ||
| keyspan_usa19_fw.h | ||
| keyspan_usa19qi_fw.h | ||
| keyspan_usa19qw_fw.h | ||
| keyspan_usa19w_fw.h | ||
| keyspan_usa26msg.h | ||
| keyspan_usa28_fw.h | ||
| keyspan_usa28msg.h | ||
| keyspan_usa28x_fw.h | ||
| keyspan_usa28xa_fw.h | ||
| keyspan_usa28xb_fw.h | ||
| keyspan_usa49msg.h | ||
| keyspan_usa49w_fw.h | ||
| keyspan_usa49wlc_fw.h | ||
| keyspan_usa67msg.h | ||
| keyspan_usa90msg.h | ||
| keyspan.c | ||
| keyspan.h | ||
| kl5kusb105.c | ||
| kl5kusb105.h | ||
| kobil_sct.c | ||
| kobil_sct.h | ||
| Makefile | ||
| Makefile-keyspan_pda_fw | ||
| mct_u232.c | ||
| mct_u232.h | ||
| mos7720.c | ||
| mos7840.c | ||
| navman.c | ||
| omninet.c | ||
| option.c | ||
| oti6858.c | ||
| oti6858.h | ||
| pl2303.c | ||
| pl2303.h | ||
| safe_serial.c | ||
| sierra.c | ||
| ti_fw_3410.h | ||
| ti_fw_5052.h | ||
| ti_usb_3410_5052.c | ||
| ti_usb_3410_5052.h | ||
| usb_debug.c | ||
| usb-serial.c | ||
| visor.c | ||
| visor.h | ||
| whiteheat_fw.h | ||
| whiteheat.c | ||
| whiteheat.h | ||
| xircom_pgs_fw.h | ||
| xircom_pgs.S | ||