Re: patch "USB: serial: fix hang when opening port" added to usb tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Mar 26, 2013 at 08:53:34PM +0100, Johan Hovold wrote:
> On Tue, Mar 26, 2013 at 09:29:46AM -0700, Greg KH wrote:
> > 
> > This is a note to let you know that I've just added the patch titled
> > 
> >     USB: serial: fix hang when opening port
> > 
> 
> > From eba0e3c3a0ba7b96f01cbe997680f6a4401a0bfc Mon Sep 17 00:00:00 2001
> > From: Ming Lei <tom.leiming@xxxxxxxxx>
> > Date: Tue, 26 Mar 2013 10:49:55 +0800
> > Subject: USB: serial: fix hang when opening port
> > 
> > Johan's 'fix use-after-free in TIOCMIWAIT' patchset[1] introduces
> > one bug which can cause kernel hang when opening port.
> > 
> > This patch initialized the 'port->delta_msr_wait' waitqueue head
> > to fix the bug which is introduced in 3.9-rc4.
> > 
> > [1], http://marc.info/?l=linux-usb&m=136368139627876&w=2
> > 
> > Cc: stable <stable@xxxxxxxxxxxxxxx>
> > Signed-off-by: Ming Lei <tom.leiming@xxxxxxxxx>
> > Acked-by: Johan Hovold <jhovold@xxxxxxxxx>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> > ---
> >  drivers/usb/serial/usb-serial.c | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
> > index 2e70efa..5d9b178 100644
> > --- a/drivers/usb/serial/usb-serial.c
> > +++ b/drivers/usb/serial/usb-serial.c
> > @@ -903,6 +903,7 @@ static int usb_serial_probe(struct usb_interface *interface,
> >  		port->port.ops = &serial_port_ops;
> >  		port->serial = serial;
> >  		spin_lock_init(&port->lock);
> > +		init_waitqueue_head(&port->delta_msr_wait);
> 
> Greg, 
> 
> The port wait-queue initialised above was introduced temporarily in 3.9
> to fix the TIOCMIWAIT use-after-frees but is removed again in usb-next
> after all the drivers are moved over to use the tty-port queue. This
> means that you will get a compilation failure once you merge -rc5 and
> the above patch into usb-next.
> 
> Shall I send a fix or do you want to fix it when you do the merge?

When I do the merge, if I get it wrong, you can send a fix :)

> Terribly sorry about the mess. The initialisation got lost in the final
> iteration of the series when I realised there was a second
> use-after-free involving the queue itself and wanted something easily
> back-portable...

No worries, these things happen.

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]