Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7d28e74b authored by Oliver Neukum's avatar Oliver Neukum Committed by Greg Kroah-Hartman
Browse files

USB: option close race 



the option driver does not directly use usb_kill_urb(). It uses a wrapper.
This wrapper means that callbacks which are running are not killed during
close, resubmitting and illicitly pushing data into the tty layer.
The whole purpose of usb_kill_urb() is subverted. The wrapper must be removed.

Signed-off-by: default avatarOliver Neukum <oneukum@suse.de>
Signed-off-by: default avatarMatthias Urlichs <smurf@smurf.noris.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 4f93b3e8

drivers/usb/serial/option.c

+4 −10
Original line number Diff line number Diff line
@@ -591,12 +591,6 @@ static int option_open(struct usb_serial_port *port, struct file *filp) 
	return (0);

}



static inline void stop_urb(struct urb *urb)

{

	if (urb && urb->status == -EINPROGRESS)

		usb_kill_urb(urb);

}



static void option_close(struct usb_serial_port *port, struct file *filp)

{

	int i;
@@ -614,9 +608,9 @@ static void option_close(struct usb_serial_port *port, struct file *filp) 


		/* Stop reading/writing urbs */

		for (i = 0; i < N_IN_URB; i++)

			stop_urb(portdata->in_urbs[i]);

			usb_kill_urb(portdata->in_urbs[i]);

		for (i = 0; i < N_OUT_URB; i++)

			stop_urb(portdata->out_urbs[i]);

			usb_kill_urb(portdata->out_urbs[i]);

	}

	port->tty = NULL;

}
@@ -747,9 +741,9 @@ static void option_shutdown(struct usb_serial *serial) 
		port = serial->port[i];

		portdata = usb_get_serial_port_data(port);

		for (j = 0; j < N_IN_URB; j++)

			stop_urb(portdata->in_urbs[j]);

			usb_kill_urb(portdata->in_urbs[j]);

		for (j = 0; j < N_OUT_URB; j++)

			stop_urb(portdata->out_urbs[j]);

			usb_kill_urb(portdata->out_urbs[j]);

	}



	/* Now free them */