Re: patch "USB: serial: fix hang when opening port" added to usb tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Mar 26, 2013 at 09:29:46AM -0700, Greg KH wrote:
> 
> This is a note to let you know that I've just added the patch titled
> 
>     USB: serial: fix hang when opening port
> 

> From eba0e3c3a0ba7b96f01cbe997680f6a4401a0bfc Mon Sep 17 00:00:00 2001
> From: Ming Lei <tom.leiming@xxxxxxxxx>
> Date: Tue, 26 Mar 2013 10:49:55 +0800
> Subject: USB: serial: fix hang when opening port
> 
> Johan's 'fix use-after-free in TIOCMIWAIT' patchset[1] introduces
> one bug which can cause kernel hang when opening port.
> 
> This patch initialized the 'port->delta_msr_wait' waitqueue head
> to fix the bug which is introduced in 3.9-rc4.
> 
> [1], http://marc.info/?l=linux-usb&m=136368139627876&w=2
> 
> Cc: stable <stable@xxxxxxxxxxxxxxx>
> Signed-off-by: Ming Lei <tom.leiming@xxxxxxxxx>
> Acked-by: Johan Hovold <jhovold@xxxxxxxxx>
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> ---
>  drivers/usb/serial/usb-serial.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
> index 2e70efa..5d9b178 100644
> --- a/drivers/usb/serial/usb-serial.c
> +++ b/drivers/usb/serial/usb-serial.c
> @@ -903,6 +903,7 @@ static int usb_serial_probe(struct usb_interface *interface,
>  		port->port.ops = &serial_port_ops;
>  		port->serial = serial;
>  		spin_lock_init(&port->lock);
> +		init_waitqueue_head(&port->delta_msr_wait);

Greg, 

The port wait-queue initialised above was introduced temporarily in 3.9
to fix the TIOCMIWAIT use-after-frees but is removed again in usb-next
after all the drivers are moved over to use the tty-port queue. This
means that you will get a compilation failure once you merge -rc5 and
the above patch into usb-next.

Shall I send a fix or do you want to fix it when you do the merge?

Terribly sorry about the mess. The initialisation got lost in the final
iteration of the series when I realised there was a second
use-after-free involving the queue itself and wanted something easily
back-portable...

Johan

>  		/* Keep this for private driver use for the moment but
>  		   should probably go away */
>  		INIT_WORK(&port->work, usb_serial_port_work);
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]