linux-kernel - tty: usb-serial krefs - ti_usb returns EIO when reopening the device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date:	Tue, 14 Apr 2009 03:14:39 +0200
From:	Christoph Mair <christoph.mair@...il.com>
To:	alan@...rguk.ukuu.org.uk
Cc:	linux-kernel@...r.kernel.org
Subject: tty: usb-serial krefs - ti_usb returns EIO when reopening the device

Hello,

commit 4a90f09b20f4622dcbff1f0e1e6bae1704f8ad8c

tty: usb-serial krefs

Use kref in the USB serial drivers so that we don't free tty structures
from under the URB receive handlers as has historically been the case if
you were unlucky. This also gives us a framework for general tty drivers to
use tty_port objects and refcount.

Contains two err->dev_err changes merged together to fix clashes in the
-next tree.

Signed-off-by: Alan Cox <alan@...xxxxxxx>
Signed-off-by: Linus Torvalds <torvalds@...xxxxxxxxxxxxxxxxx>

----

introduced a problem to the TI USB to serial converter code, which is needed 
for the debug interface device MSP-FET430UIF from Texas Instruments.
The driver works as expected until you close the device and try to reopen it. 
All you get from now on, is an I/O error. It seems that something
isn't released correctly, because the refcount of the usbserial module does 
not drop to zero, even when unloading all dependend drivers.

A "it works for me now" patch is attached. I've tested it with a vanilla 
2.6.29.

Christoph

diff --git a/drivers/usb/serial/ti_usb_3410_5052.c 
b/drivers/usb/serial/ti_usb_3410_5052.c
index 2620bf6..f11d8ac 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -1229,8 +1229,8 @@ static void ti_bulk_in_callback(struct urb *urb)
                spin_lock(&tport->tp_lock);
                tport->tp_icount.rx += urb->actual_length;
                spin_unlock(&tport->tp_lock);
-               tty_kref_put(tty);
        }
+       tty_kref_put(tty);

 exit:
        /* continue to read unless stopping */
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/