Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8ba8e197 authored by Johan Hovold's avatar Johan Hovold Committed by Greg Kroah-Hartman
Browse files

USB: serial: keyspan_pda: fix write deadlock 



commit 7353cad7ee4deaefc16e94727e69285563e219f6 upstream.

The write() callback can be called in interrupt context (e.g. when used
as a console) so interrupts must be disabled while holding the port lock
to prevent a possible deadlock.

Fixes: e81ee637 ("usb-serial: possible irq lock inversion (PPP vs. usb/serial)")
Fixes: 507ca9bc ("[PATCH] USB: add ability for usb-serial drivers to determine if their write urb is currently being used.")
Cc: stable <stable@vger.kernel.org>     # 2.6.19
Acked-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a7216fd9

drivers/usb/serial/keyspan_pda.c

+4 −3
Original line number Diff line number Diff line
@@ -443,6 +443,7 @@ static int keyspan_pda_write(struct tty_struct *tty, 
	int request_unthrottle = 0;

	int rc = 0;

	struct keyspan_pda_private *priv;

	unsigned long flags;



	priv = usb_get_serial_port_data(port);

	/* guess how much room is left in the device's ring buffer, and if we
@@ -462,13 +463,13 @@ static int keyspan_pda_write(struct tty_struct *tty, 
	   the TX urb is in-flight (wait until it completes)

	   the device is full (wait until it says there is room)

	*/

	spin_lock_bh(&port->lock);

	spin_lock_irqsave(&port->lock, flags);

	if (!test_bit(0, &port->write_urbs_free) || priv->tx_throttled) {

		spin_unlock_bh(&port->lock);

		spin_unlock_irqrestore(&port->lock, flags);

		return 0;

	}

	clear_bit(0, &port->write_urbs_free);

	spin_unlock_bh(&port->lock);

	spin_unlock_irqrestore(&port->lock, flags);



	/* At this point the URB is in our control, nobody else can submit it

	   again (the only sudden transition was the one from EINPROGRESS to