leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
a1028f0abf
linux/drivers/usb/serial
History
Bjørn Mork a1028f0abf usb: usb_wwan: replace release and disconnect with a port_remove hook 
Doing port specific cleanup in the .port_remove hook is a
lot simpler and safer than doing it in the USB driver
.release or .disconnect methods. The removal of the port
from the usb-serial bus will happen before the USB driver
cleanup, so we must be careful about accessing port specific
driver data from any USB driver functions.

This problem surfaced after the commit

 0998d0631 device-core: Ensure drvdata = NULL when no driver is bound

which turned the previous unsafe access into a reliable NULL
pointer dereference.

Fixes the following Oops:

[  243.148471] BUG: unable to handle kernel NULL pointer dereference at           (null)
[  243.148508] IP: [<ffffffffa0468527>] stop_read_write_urbs+0x37/0x80 [usb_wwan]
[  243.148556] PGD 79d60067 PUD 79d61067 PMD 0
[  243.148590] Oops: 0000 [#1] SMP
[  243.148617] Modules linked in: sr_mod cdrom qmi_wwan usbnet option cdc_wdm usb_wwan usbserial usb_storage uas fuse af_packet ip6table_filter ip6_tables iptable_filter ip_tables x_tables tun edd
cpufreq_conservative cpufreq_userspace cpufreq_powersave snd_pcm_oss snd_mixer_oss acpi_cpufreq snd_seq mperf snd_seq_device coretemp arc4 sg hp_wmi sparse_keymap uvcvideo videobuf2_core
videodev videobuf2_vmalloc videobuf2_memops rtl8192ce rtl8192c_common rtlwifi joydev pcspkr microcode mac80211 i2c_i801 lpc_ich r8169 snd_hda_codec_idt cfg80211 snd_hda_intel snd_hda_codec rfkill
snd_hwdep snd_pcm wmi snd_timer ac snd soundcore snd_page_alloc battery uhci_hcd i915 drm_kms_helper drm i2c_algo_bit ehci_hcd thermal usbcore video usb_common button processor thermal_sys
[  243.149007] CPU 1
[  243.149027] Pid: 135, comm: khubd Not tainted 3.5.0-rc7-next-20120720-1-vanilla #1 Hewlett-Packard HP Mini 110-3700                /1584
[  243.149072] RIP: 0010:[<ffffffffa0468527>]  [<ffffffffa0468527>] stop_read_write_urbs+0x37/0x80 [usb_wwan]
[  243.149118] RSP: 0018:ffff880037e75b30  EFLAGS: 00010286
[  243.149133] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88005912aa28
[  243.149150] RDX: ffff88005e95f028 RSI: 0000000000000000 RDI: ffff88005f7c1a10
[  243.149166] RBP: ffff880037e75b60 R08: 0000000000000000 R09: ffffffff812cea90
[  243.149182] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88006539b440
[  243.149198] R13: ffff88006539b440 R14: 0000000000000000 R15: 0000000000000000
[  243.149216] FS:  0000000000000000(0000) GS:ffff88007ee80000(0000) knlGS:0000000000000000
[  243.149233] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  243.149248] CR2: 0000000000000000 CR3: 0000000079fe0000 CR4: 00000000000007e0
[  243.149264] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  243.149280] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  243.149298] Process khubd (pid: 135, threadinfo ffff880037e74000, task ffff880037d40600)
[  243.149313] Stack:
[  243.149323]  ffff880037e75b40 ffff88006539b440 ffff8800799bc830 ffff88005f7c1800
[  243.149348]  0000000000000001 ffff88006539b448 ffff880037e75b70 ffffffffa04685e9
[  243.149371]  ffff880037e75bc0 ffffffffa0473765 ffff880037354988 ffff88007b594800
[  243.149395] Call Trace:
[  243.149419]  [<ffffffffa04685e9>] usb_wwan_disconnect+0x9/0x10 [usb_wwan]
[  243.149447]  [<ffffffffa0473765>] usb_serial_disconnect+0xd5/0x120 [usbserial]
[  243.149511]  [<ffffffffa0046b48>] usb_unbind_interface+0x58/0x1a0 [usbcore]
[  243.149545]  [<ffffffff8139ebd7>] __device_release_driver+0x77/0xe0
[  243.149567]  [<ffffffff8139ec67>] device_release_driver+0x27/0x40
[  243.149587]  [<ffffffff8139e5cf>] bus_remove_device+0xdf/0x150
[  243.149608]  [<ffffffff8139bc78>] device_del+0x118/0x1a0
[  243.149661]  [<ffffffffa0044590>] usb_disable_device+0xb0/0x280 [usbcore]
[  243.149718]  [<ffffffffa003c6fd>] usb_disconnect+0x9d/0x140 [usbcore]
[  243.149770]  [<ffffffffa003da7d>] hub_port_connect_change+0xad/0x8a0 [usbcore]
[  243.149825]  [<ffffffffa0043bf5>] ? usb_control_msg+0xe5/0x110 [usbcore]
[  243.149878]  [<ffffffffa003e6e3>] hub_events+0x473/0x760 [usbcore]
[  243.149931]  [<ffffffffa003ea05>] hub_thread+0x35/0x1d0 [usbcore]
[  243.149955]  [<ffffffff81061960>] ? add_wait_queue+0x60/0x60
[  243.150004]  [<ffffffffa003e9d0>] ? hub_events+0x760/0x760 [usbcore]
[  243.150026]  [<ffffffff8106133e>] kthread+0x8e/0xa0
[  243.150047]  [<ffffffff8157ec04>] kernel_thread_helper+0x4/0x10
[  243.150068]  [<ffffffff810612b0>] ? flush_kthread_work+0x120/0x120
[  243.150088]  [<ffffffff8157ec00>] ? gs_change+0xb/0xb
[  243.150101] Code: fd 41 54 53 48 83 ec 08 80 7f 1a 00 74 57 49 89 fc 31 db 90 49 8b 7c 24 20 45 31 f6 48 81 c7 10 02 00 00 e8 bc 64 f3 e0 49 89 c7 <4b> 8b 3c 37 49 83 c6 08 e8 4c a5 bd ff 49 83 fe 20
75 ed 45 30
[  243.150257] RIP  [<ffffffffa0468527>] stop_read_write_urbs+0x37/0x80 [usb_wwan]
[  243.150282]  RSP <ffff880037e75b30>
[  243.150294] CR2: 0000000000000000
[  243.177170] ---[ end trace fba433d9015ffb8c ]---

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Reported-by: Thomas Schäfer <tschaefer@t-online.de>
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-08-10 11:51:43 -07:00
..
aircable.c USB: aircable.c: remove dbg() usage 2012-05-15 16:27:08 -07:00
ark3116.c USB: ark3116.c: remove dbg() usage 2012-05-15 16:27:11 -07:00
belkin_sa.c USB: belkin_sa.c: remove dbg() usage 2012-05-15 16:27:11 -07:00
belkin_sa.h
bus.c USB: add read support to usb-serial/../new_id 2012-05-14 09:30:40 -07:00
ch341.c USB: serial: ch341: make the reset_resume callback actually work. 2012-05-16 08:36:13 -07:00
console.c USB: console.c: remove err() usage 2012-04-20 16:53:58 -07:00
cp210x.c USB: CP210x Add 10 Device IDs 2012-06-26 16:14:34 -07:00
cyberjack.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
cypress_m8.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
cypress_m8.h
digi_acceleport.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
empeg.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
ezusb_convert.pl
ezusb.c USB: ezusb.c: remove dbg() tracing calls 2012-05-03 16:44:02 -07:00
f81232.c USB: f81232.c: remove dbg() usage 2012-05-15 16:27:17 -07:00
ftdi_sio_ids.h USB: ftdi_sio: Add VID/PID for Kondo Serial USB 2012-08-10 11:41:25 -07:00
ftdi_sio.c USB: ftdi_sio: Add VID/PID for Kondo Serial USB 2012-08-10 11:41:25 -07:00
ftdi_sio.h USB: ftdi_sio: add support for FT-X series devices 2012-03-14 15:43:05 -07:00
funsoft.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
garmin_gps.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
generic.c USB: serial-generic: use a single set of device IDs 2012-06-13 14:01:56 -07:00
hp4x.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
io_16654.h
io_edgeport.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
io_edgeport.h Fix common misspellings 2011-03-31 11:26:23 -03:00
io_ionsp.h
io_tables.h USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
io_ti.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
io_ti.h
io_usbvend.h
ipaq.c USB: ipaq.c: remove dbg() usage 2012-05-15 16:27:20 -07:00
ipw.c usb: usb_wwan: replace release and disconnect with a port_remove hook 2012-08-10 11:51:43 -07:00
ir-usb.c USB: ir-usb.c: remove dbg() usage 2012-05-15 16:27:23 -07:00
iuu_phoenix.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
iuu_phoenix.h
Kconfig USB: serial: add quatech2 usb to serial driver 2012-05-10 12:46:20 -07:00
keyspan_pda.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
keyspan_usa26msg.h
keyspan_usa28msg.h
keyspan_usa49msg.h
keyspan_usa67msg.h
keyspan_usa90msg.h
keyspan.c USB: serial: keyspan: Removed unrequired parentheses. 2012-07-16 17:09:15 -07:00
keyspan.h USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
kl5kusb105.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
kl5kusb105.h
kobil_sct.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
kobil_sct.h
Makefile USB: serial: add quatech2 usb to serial driver 2012-05-10 12:46:20 -07:00
Makefile-keyspan_pda_fw
mct_u232.c USB: mct_u232: Fix incorrect TIOCMSET return 2012-06-12 16:09:49 -07:00
mct_u232.h Update broken web addresses in the kernel. 2010-10-18 11:03:14 +02:00
metro-usb.c USB: metro-usb: fix tty_flip_buffer_push use 2012-07-05 16:04:57 -07:00
mos7720.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
mos7840.c usb: serial: mos7840: Fixup mos7840_chars_in_buffer() 2012-08-10 11:51:42 -07:00
moto_modem.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
navman.c USB: navman.c: remove dbg() usage 2012-05-15 16:27:25 -07:00
omninet.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
opticon.c USB: serial: opticon: hook up suspend/resume callbacks 2012-05-10 14:35:21 -07:00
option.c usb: usb_wwan: replace release and disconnect with a port_remove hook 2012-08-10 11:51:43 -07:00
oti6858.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
oti6858.h
pl2303.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
pl2303.h USB: serial: pl2303: rm duplicate id 2011-11-15 10:06:15 -08:00
qcaux.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
qcserial.c usb: usb_wwan: replace release and disconnect with a port_remove hook 2012-08-10 11:51:43 -07:00
quatech2.c USB: serial: Remove unused serial_priv variable 2012-06-20 16:20:24 -07:00
safe_serial.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
siemens_mpi.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
sierra.c USB: sierra: QMI mode MC7710 moved to qcserial 2012-07-16 17:17:59 -07:00
spcp8x5.c USB: spcp8x5.c: remove dbg() usage 2012-05-15 16:27:30 -07:00
ssu100.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
symbolserial.c USB: symbolserial.c: remove dbg() usage 2012-05-15 16:27:32 -07:00
ti_usb_3410_5052.c USB: serial: ti_usb_3410_5052: Add support for the FRI2 serial console 2012-05-11 15:14:07 -07:00
ti_usb_3410_5052.h USB: serial: ti_usb_3410_5052: Add support for the FRI2 serial console 2012-05-11 15:14:07 -07:00
usb_debug.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
usb_wwan.c usb: usb_wwan: replace release and disconnect with a port_remove hook 2012-08-10 11:51:43 -07:00
usb-serial.c usb: use usb_serial_put in usb_serial_probe errors 2012-06-13 17:26:11 -07:00
usb-wwan.h usb: usb_wwan: replace release and disconnect with a port_remove hook 2012-08-10 11:51:43 -07:00
visor.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
visor.h
vivopay-serial.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
whiteheat.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00
whiteheat.h
zio.c USB: serial: rework usb_serial_register/deregister_drivers() 2012-05-08 15:46:14 -07:00