On Mon, May 18, 2009 at 12:53:15AM +0100, David Woodhouse wrote:
> When the device is removed, ftdi_sio_port_remove() calls
> usb_set_serial_port_data(port, NULL).
>
> When userspace subsequently _closes_ the device, ftdi_close() oopses on
> dereferencing that NULL pointer.
>
> The fix is just not to clear the private data in ftdi_sio_port_remove().
> The refcount on the structure reaches zero when the port is closed by
> userspace and the final kref_put() happens in ftdi_close().
>
> Remove a bogus comment too, while we're at it. And stop doing things
> inside "if (priv)" -- it must _always_ be there.
>
> Based loosely on an earlier patch by Daniel Mack, and suggestions by
> Alan Stern.
>
> Signed-off-by: David Woodhouse <David.Woodhouse@xxxxxxxxx>
Tested-by: Daniel Mack <daniel@xxxxxxxx>
> ---
> Wants backporting to 2.6.29 in some form -- maybe a naïve 'if (priv)' in
> fdti_close() is the right thing to do there?
>
> diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
> index 0ab8474..452a61c 100644
> --- a/drivers/usb/serial/ftdi_sio.c
> +++ b/drivers/usb/serial/ftdi_sio.c
> @@ -1487,14 +1488,7 @@ static int ftdi_sio_port_remove(struct usb_serial_port *port)
>
> remove_sysfs_attrs(port);
>
> - /* all open ports are closed at this point
> - * (by usbserial.c:__serial_close, which calls ftdi_close)
> - */
> -
> - if (priv) {
> - usb_set_serial_port_data(port, NULL);
> - kref_put(&priv->kref, ftdi_sio_priv_release);
> - }
> + kref_put(&priv->kref, ftdi_sio_priv_release);
>
> return 0;
> }
>
> --
> David Woodhouse Open Source Technology Centre
> David.Woodhouse@xxxxxxxxx Intel Corporation
>
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
