Move control-urb dereference to after NULL-check. There is otherwise a
risk of a possible null pointer dereference.

Was largely found by using a static code analysis program called
cppcheck.

[Johan: modify commit message somewhat ]
[gkh: remove stable tag as it's not a real problem that anyone has ever hit]
Signed-off-by: NRickard Strandqvist <rickard_strandqvist@spectrumdigital.se>
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Remove out-commented and ifdeffed debugging code.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <greg@kroah.com>

None of these files are actually using any __init type directives
and hence don't need to include <linux/init.h>.  Most are just a
left over from __devinit and __cpuinit removal, or simply due to
code getting copied from one driver to the next.
Signed-off-by: NPaul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NRahul Bedarkar <rahulbedarkar89@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Remove redundant error messages on allocation failures, which have
already been logged.

Cc: Joe Perches <joe@perches.com>
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Make sure port DMA-buffers are allocated separately from containing
structure to prevent potential memory corruption on non-cache-coherent
systems.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Make sure serial DMA-buffers are allocated separately from containing
structure to prevent potential memory corruption on non-cache-coherent
systems.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Make sure to fail properly if the device is not accepted during attach
in order to avoid null-pointer derefs (of missing interface private
data) at disconnect or release.

Cc: stable@vger.kernel.org
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The usb_serial_port structure had the number field, which was the minor
number for the port, which almost no one really cared about.  They
really wanted the number of the port within the device, which you had to
subtract from the minor of the parent usb_serial_device structure.  To
clean this up, provide the real minor number of the port, and the number
of the port within the serial device separately, as these numbers might
not be related in the future.

Bonus is that this cleans up a lot of logic in the drivers, and saves
lines overall.
Tested-by: NTobias Winter <tobias@linuxdingsda.de>
Reviewed-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

--
 drivers/staging/serqt_usb2/serqt_usb2.c |   21 +++--------
 drivers/usb/serial/ark3116.c            |    2 -
 drivers/usb/serial/bus.c                |    6 +--
 drivers/usb/serial/console.c            |    2 -
 drivers/usb/serial/cp210x.c             |    2 -
 drivers/usb/serial/cypress_m8.c         |    4 +-
 drivers/usb/serial/digi_acceleport.c    |    6 ---
 drivers/usb/serial/f81232.c             |    5 +-
 drivers/usb/serial/garmin_gps.c         |    6 +--
 drivers/usb/serial/io_edgeport.c        |   58 ++++++++++++--------------------
 drivers/usb/serial/io_ti.c              |   21 ++++-------
 drivers/usb/serial/keyspan.c            |   29 +++++++---------
 drivers/usb/serial/metro-usb.c          |    4 +-
 drivers/usb/serial/mos7720.c            |   37 +++++++++-----------
 drivers/usb/serial/mos7840.c            |   52 +++++++++-------------------
 drivers/usb/serial/opticon.c            |    2 -
 drivers/usb/serial/pl2303.c             |    2 -
 drivers/usb/serial/quatech2.c           |    7 +--
 drivers/usb/serial/sierra.c             |    2 -
 drivers/usb/serial/ti_usb_3410_5052.c   |   10 ++---
 drivers/usb/serial/usb-serial.c         |    7 ++-
 drivers/usb/serial/usb_wwan.c           |    2 -
 drivers/usb/serial/whiteheat.c          |   20 +++++------
 include/linux/usb/serial.h              |    6 ++-
 24 files changed, 133 insertions(+), 180 deletions(-)

Remove the no longer used endpoint-array access completely.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The outcont_endpoints array was indexed using the port minor number
(which can be greater than the array size) rather than the device port
number.

Cc: stable@vger.kernel.org
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

There is a specifier we may use to dump small buffers.
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

"len" comes from the USB transfer and it's probably correct.  The thing
is that we already have similar checks like:

        if (data[i] >= serial->num_ports) {

So adding a sanity test here matches the rest of the code and is a good
idea.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

We can remove the "if (urb->actual_length) {" check because checking for
"while (i < urb->actual_length) {" is sufficient.  This lets us pull the
code in one indent level.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Remove bogus (and unnecessary) test for serial->dev being NULL in close.

The device is never cleared, and close is never called after a completed
disconnect anyway.

Remove some out-commented bogus code while at it.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

It allows for cleaning up on a considerable amount of places. They did
port_get, hangup, kref_put. Now the only thing needed is to call
tty_port_tty_hangup which does exactly that. And they can also decide
whether to consider CLOCAL or completely ignore that.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Now, we start converting tty buffer functions to actually use
tty_port. This will allow us to get rid of the need of tty in many
call sites. Only tty_port will needed and hence no more
tty_port_tty_get in those paths.

Now, the one where most of tty_port_tty_get gets removed:
tty_flip_buffer_push.

IOW we also closed all the races in drivers not using tty_port_tty_get
at all yet.

Also we move tty_flip_buffer_push declaration from include/linux/tty.h
to include/linux/tty_flip.h to all others while we are changing it
anyway.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Now, we start converting tty buffer functions to actually use
tty_port. This will allow us to get rid of the need of tty in many
call sites. Only tty_port will needed and hence no more
tty_port_tty_get in those paths.

tty_insert_flip_string this time.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Now, we start converting tty buffer functions to actually use
tty_port. This will allow us to get rid of the need of tty in many
call sites. Only tty_port will needed and hence no more
tty_port_tty_get in those paths.

tty_insert_flip_char is the next one to proceed. This one is used all
over the code, so the patch is huge.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

fixed coding style issues.
Signed-off-by: NStefan Hubner <s.hubner@tilburguniversity.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Commit f79b2d0f (USB: keyspan: fix NULL-pointer dereferences and
memory leaks) had a small typo which made the driver use wrong
offsets when mapping serial port private data.  This results in
in a GPF when the port is opened.
Reported-by: NRichard <richjunk@pacbell.net>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NBjørn Mork <bjorn@mork.no>
Acked-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Remove all MODULE_VERSION macros and driver-version information (except
for garmin_gps which uses it in a status reply).

It is the kernel version that matters and not some private version
scheme which rarely even gets updated.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Fix NULL-pointer dereference at release by moving port data allocation
and deallocation to port_probe and port_remove.

Fix NULL-pointer dereference at disconnect by stopping port urbs at
port_remove.

Since commit 0998d063 (device-core: Ensure drvdata = NULL when no
driver is bound) the port private data is no longer accessible at
disconnect or release.

Note that this patch also fixes port and interface-data memory leaks in
the error path of attach should port initialisation fail for any port.

Compile-only tested.

Cc: <stable@vger.kernel.org>
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch adds new functions to upload firmware to the controller. The
drivers currently using ezusb are adapted to use these new functions.

This also fixes a bug occuring during firmware loading in the
whiteheat-driver:
The driver iterates over an ihex-formatted firmware using ++ on a "const
struct ihex_binrec*" which leads to faulty results, because ihex data is
read as length. The function "ihex_next_binrec(record)" has so be used
to work correctly
Signed-off-by: NRené Bürgel <rene.buergel@sohard.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This Patch adds support for the newer Cypress FX2LP. It also adapts
three drivers currently using ezusb to the interface change. (whiteheat
and keyspan[_pda])
Signed-off-by: NRené Bürgel <rene.buergel@sohard.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Now that all usb-serial modules are only using dev_dbg()
the debug module parameter does not do anything at all, so
remove it to reduce any confusion if someone were to try to
use it.
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

I accidentally caused some compiler warnings, that were correct in
pointing out problems, so fix them up now.
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

dbg() was a very old USB-serial-specific macro.
This patch removes it from being used in the keyspan
driver and uses dev_dbg() instead.
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch removes the dependency on the usb_serial interface and names
some magic constants
Signed-off-by: NRené Bürgel <rene.buergel@sohard.de>
--
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Changes to conform with checkpatch.sh script. - return is not a
function, parentheses not required. Removed 1 checkpatch.sh error.
Signed-off-by: NBen Minerds <puzzleduck@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Changes to conform with checkpatch.sh script. - trailing whitespace.
Removed 1 checkpatch.sh error.
Signed-off-by: NBen Minerds <puzzleduck@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Changes to conform with checkpatch.sh script. - space near open
parenthesis '('. Removed 2 checkpatch.sh errors.
Signed-off-by: NBen Minerds <puzzleduck@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Changes to conform with checkpatch.sh script. - space around '='.
Removed 1 checkpatch.sh error.
Signed-off-by: NBen Minerds <puzzleduck@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Changes to conform with checkpatch.sh script. - spaces around '?' and
':'.  Removed 14 checkpatch.sh errors.
Signed-off-by: NBen Minerds <puzzleduck@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This will let us sort out a whole pile of tty related races. The
alternative would be to keep points and refcount the termios objects.
However
1. They are tiny anyway
2. Many devices don't use the stored copies
3. We can remove a pty special case
Signed-off-by: NAlan Cox <alan@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

s_priv was set but never used in keyspan_open() and keyspan_close(),
remove it.

This also makes the serial variable in keyspan_open() unused since
it's only use was to set s_priv, so it is also removed.
Signed-off-by: NBill Pemberton <wfp5p@virginia.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This reworks the usb_serial_register_drivers() and
usb_serial_deregister_drivers() to not need a pointer to a struct
usb_driver anymore.  The usb_driver structure is now created dynamically
and registered and unregistered as needed.

This saves lines of code in each usb-serial driver.  All in-kernel users
of these functions were also fixed up at this time.  The pl2303 driver
was tested that everything worked properly.

Thanks for the idea to do this from Alan Stern.

Cc: Adhir Ramjiawan <adhirramjiawan0@gmail.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Al Borchers <alborchers@steinerpoint.com>
Cc: Aleksey Babahin <tamerlan311@gmail.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andrew Worsley <amworsley@gmail.com>
Cc: Bart Hartgers <bart.hartgers@gmail.com>
Cc: Bill Pemberton <wfp5p@virginia.edu>
Cc: Dan Carpenter <error27@gmail.com>
Cc: Dan Williams <dcbw@redhat.com>
Cc: Donald Lee <donald@asix.com.tw>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Felipe Balbi <balbi@ti.com>
Cc: Gary Brubaker <xavyer@ix.netcom.com>
Cc: Jesper Juhl <jj@chaosbits.net>
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: Johan Hovold <jhovold@gmail.com>
Cc: Julia Lawall <julia@diku.dk>
Cc: Kautuk Consul <consul.kautuk@gmail.com>
Cc: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Cc: Lonnie Mendez <dignome@gmail.com>
Cc: Matthias Bruestle and Harald Welte <support@reiner-sct.com>
Cc: Matthias Urlichs <smurf@smurf.noris.de>
Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
Cc: Michal Sroczynski <msroczyn@gmail.com>
Cc: "Michał Wróbel" <michal.wrobel@flytronic.pl>
Cc: Oliver Neukum <oliver@neukum.name>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: Peter Berger <pberger@brimson.com>
Cc: Preston Fick <preston.fick@silabs.com>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Cc: Rigbert Hamisch <rigbert@gmx.de>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Simon Arlott <simon@fire.lp0.eu>
Cc: Support Department <support@connecttech.com>
Cc: Thomas Tuttle <ttuttle@chromium.org>
Cc: Uwe Bonnes <bon@elektron.ikp.physik.tu-darmstadt.de>
Cc: Wang YanQing <Udknight@gmail.com>
Cc: William Greathouse <wgreathouse@smva.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

dbg() was used a lot a long time ago to trace code flow.  Now that we have
ftrace, this isn't needed at all, so remove these calls.
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This converts the keyspan.c driver to use the module_usb_serial_driver() call
instead of having to have a module_init/module_exit function, saving a lot
of duplicated code.
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1526) modifies the following usb-serial drivers to
utilize the new usb_serial_{de}register_drivers() routines:

	keyspan, kl5kusb105, kobil_sct, mct_u232, mos7720,
	mos7840, and moto_modem.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>