Attachment 634941 Details for Bug 867952 – 0001-USB-fix-port-probing-and-removal-in-garmin_gps.patch

0001-USB-fix-port-probing-and-removal-in-garmin_gps.patch

0001-USB-fix-port-probing-and-removal-in-garmin_gps.patch (text/plain), 2.79 KB, created by Stanislaw Gruszka on 2012-10-29 09:37:08 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stanislaw Gruszka

Created: 2012-10-29 09:37:08 UTC

Size: 2.79 KB

patch

obsolete

>From db5c8b524444d4fc6b1f32d368a50a3729e50002 Mon Sep 17 00:00:00 2001
>From: Alan Stern <stern@rowland.harvard.edu>
>Date: Wed, 10 Oct 2012 14:10:21 -0400
>Subject: [PATCH] USB: fix port probing and removal in garmin_gps
>
>This patch (as1615) fixes a bug in the Garmin USB serial driver.  It
>uses attach, disconnect, and release routines to carry out actions
>that should be handled by port_probe and port_remove routines, because
>they access port-specific data.
>
>The bug causes an oops when the device in unplugged, because the
>private data for each port structure now gets erased when the port is
>unbound from the driver, resulting in a null-pointer dereference.
>
>Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
>Reported--by: Markus Schauler <mschauler@gmail.com>
>Tested-by: Markus Schauler <mschauler@gmail.com>
>Cc: stable <stable@vger.kernel.org>
>Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>---
> drivers/usb/serial/garmin_gps.c |   24 +++++++-----------------
> 1 files changed, 7 insertions(+), 17 deletions(-)
>
>diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
>index 3ee9264..203358d 100644
>--- a/drivers/usb/serial/garmin_gps.c
>+++ b/drivers/usb/serial/garmin_gps.c
>@@ -1405,11 +1405,10 @@ static void timeout_handler(unsigned long data)
> 
> 
> 
>-static int garmin_attach(struct usb_serial *serial)
>+static int garmin_port_probe(struct usb_serial_port *port)
> {
>-	int status = 0;
>-	struct usb_serial_port *port = serial->port[0];
>-	struct garmin_data *garmin_data_p = NULL;
>+	int status;
>+	struct garmin_data *garmin_data_p;
> 
> 	garmin_data_p = kzalloc(sizeof(struct garmin_data), GFP_KERNEL);
> 	if (garmin_data_p == NULL) {
>@@ -1434,22 +1433,14 @@ static int garmin_attach(struct usb_serial *serial)
> }
> 
> 
>-static void garmin_disconnect(struct usb_serial *serial)
>+static int garmin_port_remove(struct usb_serial_port *port)
> {
>-	struct usb_serial_port *port = serial->port[0];
> 	struct garmin_data *garmin_data_p = usb_get_serial_port_data(port);
> 
> 	usb_kill_urb(port->interrupt_in_urb);
> 	del_timer_sync(&garmin_data_p->timer);
>-}
>-
>-
>-static void garmin_release(struct usb_serial *serial)
>-{
>-	struct usb_serial_port *port = serial->port[0];
>-	struct garmin_data *garmin_data_p = usb_get_serial_port_data(port);
>-
> 	kfree(garmin_data_p);
>+	return 0;
> }
> 
> 
>@@ -1466,9 +1457,8 @@ static struct usb_serial_driver garmin_device = {
> 	.close               = garmin_close,
> 	.throttle            = garmin_throttle,
> 	.unthrottle          = garmin_unthrottle,
>-	.attach              = garmin_attach,
>-	.disconnect          = garmin_disconnect,
>-	.release             = garmin_release,
>+	.port_probe		= garmin_port_probe,
>+	.port_remove		= garmin_port_remove,
> 	.write               = garmin_write,
> 	.write_room          = garmin_write_room,
> 	.write_bulk_callback = garmin_write_bulk_callback,
>-- 
>1.7.1
>

Actions: View

Attachments on bug 867952: 632677 | 634941