linux-kernel - Re: 2.6.31-rc5 regression: Oops when USB Serial disconnected while in use

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44L0.0908211042380.2912-100000@iolanthe.rowland.org>
Date:	Fri, 21 Aug 2009 11:43:11 -0400 (EDT)
From:	Alan Stern <stern@...land.harvard.edu>
To:	Bruno Prémont <bonbons@...ux-vserver.org>
cc:	Alan Cox <alan@...rguk.ukuu.org.uk>, Greg KH <greg@...ah.com>,
	Kernel development list <linux-kernel@...r.kernel.org>,
	USB list <linux-usb@...r.kernel.org>,
	"Rafael J. Wysocki" <rjw@...k.pl>
Subject: Re: 2.6.31-rc5 regression: Oops when USB Serial disconnected while
 in use

On Fri, 21 Aug 2009, Bruno [UTF-8] PrÃ©mont wrote:

> The module refcount was for both. It's the pl2302/ftdi-sio module's
> refcount.
> 
> I don't remember for sure about the panic if it also affects
> pl2302 or not.
> At least one of the panics was when running dmesg after exiting minicom.
> 
> I will redo the tests this evening when I get home and report back with
> more details.

Apparently the problem is in serial_do_free(); it doesn't know 
whether it's getting called for a successful open or an unsuccessful 
open, so it decrements the module count when it shouldn't.  The same is 
true for port->dev's refcount.

Alan, related to this problem is the fact that usb_serial_driver
doesn't include a "hangup" method.  I'm not sure that making
serial_hangup() call serial_do_down() is correct, but if it is then
shouldn't we call port->serial->type->open() afterwards?  Otherwise the
lower driver can't know that the port is still open.

Furthermore, shouldn't we check ASYNCB_INITIALIZED in serial_close()?

Alan Stern

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/