kernel/linux.git/drivers/usb/serial/console.c, branch v4.4.235

USB: serial: console: fix use-after-free after failed setup

2017-10-18T07:20:43+00:00

commit 299d7572e46f98534033a9e65973f13ad1ce9047 upstream. Make sure to reset the USB-console port pointer when console setup fails in order to avoid having the struct usb_serial be prematurely freed by the console code when the device is later disconnected. Fixes: 73e487fdb75f ("[PATCH] USB console: fix disconnection issues") Acked-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman

USB: console: add dummy __module_get

2015-02-26T16:06:39+00:00

Add call to __module_get when initialising the fake tty in usb_console_setup to match the module_put in release_one_tty. Note that the tty-driver (i.e. usb-serial core) must be compiled-in to enable the usb console so the __module_get is essentially a noop as driver->owner will be null. Reported-by: Ben Hutchings Signed-off-by: Johan Hovold

USB: console: fix potential use after free

2015-01-10T11:48:21+00:00

Use tty kref to release the fake tty in usb_console_setup to avoid use after free if the underlying serial driver has acquired a reference. Note that using the tty destructor release_one_tty requires some more state to be initialised. Fixes: 4a90f09b20f4 ("tty: usb-serial krefs") Cc: stable Signed-off-by: Johan Hovold

USB: console: fix uninitialised ldisc semaphore

2015-01-10T11:48:15+00:00

The USB console currently allocates a temporary fake tty which is used to pass terminal settings to the underlying serial driver. The tty struct is not fully initialised, something which can lead to a lockdep warning (or worse) if a serial driver tries to acquire a line-discipline reference: usbserial: USB Serial support registered for pl2303 pl2303 1-2.1:1.0: pl2303 converter detected usb 1-2.1: pl2303 converter now attached to ttyUSB0 INFO: trying to register non-static key. the code is fine but needs lockdep annotation. turning off the locking correctness validator. CPU: 0 PID: 68 Comm: udevd Tainted: G W 3.18.0-rc5 #10 [] (unwind_backtrace) from [] (show_stack+0x20/0x24) [] (show_stack) from [] (dump_stack+0x24/0x28) [] (dump_stack) from [] (__lock_acquire+0x1e50/0x2004) [] (__lock_acquire) from [] (lock_acquire+0xe4/0x18c) [] (lock_acquire) from [] (ldsem_down_read_trylock+0x78/0x90) [] (ldsem_down_read_trylock) from [] (tty_ldisc_ref+0x24/0x58) [] (tty_ldisc_ref) from [] (usb_serial_handle_dcd_change+0x48/0xe8) [] (usb_serial_handle_dcd_change) from [] (pl2303_read_int_callback+0x210/0x220 [pl2303]) [] (pl2303_read_int_callback [pl2303]) from [] (__usb_hcd_giveback_urb+0x80/0x140) [] (__usb_hcd_giveback_urb) from [] (usb_giveback_urb_bh+0x98/0xd4) [] (usb_giveback_urb_bh) from [] (tasklet_hi_action+0x9c/0x108) [] (tasklet_hi_action) from [] (__do_softirq+0x148/0x42c) [] (__do_softirq) from [] (irq_exit+0xd8/0x114) [] (irq_exit) from [] (__handle_domain_irq+0x84/0xdc) [] (__handle_domain_irq) from [] (omap_intc_handle_irq+0xd8/0xe0) [] (omap_intc_handle_irq) from [] (__irq_svc+0x44/0x7c) Exception stack(0xdf4e7f08 to 0xdf4e7f50) 7f00: debc0b80 df4e7f5c 00000000 00000000 debc0b80 be8da96c 7f20: 00000000 00000128 c000fc84 df4e6000 00000000 df4e7f94 00000004 df4e7f50 7f40: c038ebc0 c038d74c 600f0013 ffffffff [] (__irq_svc) from [] (___sys_sendmsg.part.29+0x0/0x2e0) [] (___sys_sendmsg.part.29) from [] (SyS_sendmsg+0x18/0x1c) [] (SyS_sendmsg) from [] (ret_fast_syscall+0x0/0x48) console [ttyUSB0] enabled Fixes: 36697529b5bb ("tty: Replace ldisc locking with ldisc_sem") Cc: stable Signed-off-by: Johan Hovold

usb: delete non-required instances of include

2014-01-08T23:01:39+00:00

None of these files are actually using any __init type directives and hence don't need to include . Most are just a left over from __devinit and __cpuinit removal, or simply due to code getting copied from one driver to the next. Signed-off-by: Paul Gortmaker Signed-off-by: Greg Kroah-Hartman

USB: serial: remove redundant OOM messages

2014-01-03T20:31:46+00:00

Remove redundant error messages on allocation failures, which have already been logged. Cc: Joe Perches Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman

USB: console: remove unnecessary operations test

2013-07-23T23:24:32+00:00

Remove unnecessary tests for open and write operations as these are set to the generic implementations by usb-serial core if left unset by a subdriver. Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman

USB: console: use dev_dbg

2013-07-23T23:24:32+00:00

Use dev_dbg for debugging. Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman

USB: serial: make minor allocation dynamic

2013-06-17T20:30:02+00:00

This moves the allocation of minor device numbers from a static array to be dynamic, using the idr interface. This means that you could potentially get "gaps" in a minor number range for a single USB serial device with multiple ports, but all should still work properly. We remove the 'minor' field from the usb_serial structure, as it no longer makes any sense for it (use the field in the usb_serial_port structure if you really want to know this number), and take the fact that we were overloading a number in this field to determine if we had initialized the minor numbers or not, and just use a flag variable instead. Note, we still have the limitation of 255 USB to serial devices in the system, as that is all we are registering with the TTY layer at this point in time. Tested-by: Tobias Winter Reviewed-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman

USB: serial: ports: add minor and port number

2013-06-10T21:46:40+00:00

The usb_serial_port structure had the number field, which was the minor number for the port, which almost no one really cared about. They really wanted the number of the port within the device, which you had to subtract from the minor of the parent usb_serial_device structure. To clean this up, provide the real minor number of the port, and the number of the port within the serial device separately, as these numbers might not be related in the future. Bonus is that this cleans up a lot of logic in the drivers, and saves lines overall. Tested-by: Tobias Winter Reviewed-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman -- drivers/staging/serqt_usb2/serqt_usb2.c | 21 +++-------- drivers/usb/serial/ark3116.c | 2 - drivers/usb/serial/bus.c | 6 +-- drivers/usb/serial/console.c | 2 - drivers/usb/serial/cp210x.c | 2 - drivers/usb/serial/cypress_m8.c | 4 +- drivers/usb/serial/digi_acceleport.c | 6 --- drivers/usb/serial/f81232.c | 5 +- drivers/usb/serial/garmin_gps.c | 6 +-- drivers/usb/serial/io_edgeport.c | 58 ++++++++++++-------------------- drivers/usb/serial/io_ti.c | 21 ++++------- drivers/usb/serial/keyspan.c | 29 +++++++--------- drivers/usb/serial/metro-usb.c | 4 +- drivers/usb/serial/mos7720.c | 37 +++++++++----------- drivers/usb/serial/mos7840.c | 52 +++++++++------------------- drivers/usb/serial/opticon.c | 2 - drivers/usb/serial/pl2303.c | 2 - drivers/usb/serial/quatech2.c | 7 +-- drivers/usb/serial/sierra.c | 2 - drivers/usb/serial/ti_usb_3410_5052.c | 10 ++--- drivers/usb/serial/usb-serial.c | 7 ++- drivers/usb/serial/usb_wwan.c | 2 - drivers/usb/serial/whiteheat.c | 20 +++++------ include/linux/usb/serial.h | 6 ++- 24 files changed, 133 insertions(+), 180 deletions(-)