linux-kernel - [PATCH] [usb-serial] fix Ooops on uplug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1248112313-7842-1-git-send-email-daniel@caiaq.de>
Date:	Mon, 20 Jul 2009 19:51:53 +0200
From:	Daniel Mack <daniel@...aq.de>
To:	linux-kernel@...r.kernel.org
Cc:	Daniel Mack <daniel@...aq.de>, Greg Kroah-Hartman <gregkh@...e.de>,
	Alan Cox <alan@...hat.com>,
	Alan Stern <stern@...land.harvard.edu>,
	Oliver Neukum <oneukum@...e.de>,
	Alan Cox <alan@...ux.intel.com>, linux-usb@...r.kernel.org
Subject: [PATCH] [usb-serial] fix Ooops on uplug

When an USB serial adapter is disconnected and <Enter> is pressed on a
connection still open on it (cu, minicom, ...), the kernel crashes.

The reason is that the serial port's resources are freed upon disconnect
(in serial_hangup()) but the tty device layer is not made aware of that.
Hence, the close callback will later access the resources again.

Fix that by postponing the resources freeing to the close callback and
remove it from the hangup callback.

Signed-off-by: Daniel Mack <daniel@...aq.de>
Cc: Greg Kroah-Hartman <gregkh@...e.de>
Cc: Alan Cox <alan@...hat.com>
Cc: Alan Stern <stern@...land.harvard.edu>
Cc: Oliver Neukum <oneukum@...e.de>
Cc: Alan Cox <alan@...ux.intel.com>
Cc: linux-usb@...r.kernel.org
---
 drivers/usb/serial/usb-serial.c |    1 -
 1 files changed, 0 insertions(+), 1 deletions(-)

diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index bd7581b..77cb3cd 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -355,7 +355,6 @@ static void serial_hangup(struct tty_struct *tty)
 	struct usb_serial_port *port = tty->driver_data;
 	serial_do_down(port);
 	tty_port_hangup(&port->port);
-	serial_do_free(port);
 }
 
 static int serial_write(struct tty_struct *tty, const unsigned char *buf,
-- 
1.6.3.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/