I think there is a race between usb_serial_put() and
usb_serial_get_by_index() (and get_free_serial()) with regards
to handling the serial port refcount.

usb_serial_get_by_index() gets a reference on the serial port under
table_lock while return_serial releases all the returned ports
from the table under the same lock.  However, the table_lock is not
taken around the call to kref_put, theoretically allowing to sneak
in and grab a reference after kref_put has already determined that
the reference count is zero (and before calling destroy_serial)
causing use after free.
Signed-off-by: NBenny Halevy <bhalevy@ns1.bhalevy.com>
Cc: Oliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

this fixes the sleep found with the automatic tool.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Might fix bug 8561

On Mon, 4 Jun 2007, Paulo Pereira wrote:

> The patch that you send is not resolving the problem... :(
> I stil have Kernel panic after 45/60 min of work with Ktorrent/Amule...
>
> The Drump is:
>
> Call Trace:
> [<c055fb36>] usb_hcd_submit+0xb1/0x763
> [<f9276488>] ipt_do_table+0x2c7/0x2ef [ip_tables]
> [<f929a6d7>] nf_ct_deliver_cached_events+0x41/0x96 [nf_conntrak]
> [<f9288254>] ipv4_confirm+0x36/0c3b [nf_conntrack_ipv4]
> [<c05ce7c2>] tcp_v4_rcv+0x827/0x899
> [<c05afcc0>] nf_hook_slow+0x4d/0xb5
> [<c042826f>] irq_enter+0x19/0x23
> [<c042826f>] irq_enter+0x19/0x23
> [<c040794c>] do_IRQ+0xbd/0xd1
> [<f90893c9>] option_write+0xa7/0xef [option]

Okay, from this it looks like there's a problem in the option.c serial
driver.  Glancing at the code, it's obvious why: The thing totally
abuses the USB API.

Try applying this patch; it should help.

From: Alan Stern <stern@rowland.harvard.edu>
Cc: Paulo Pereira <pfmp.404@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Some further cleanup after Oliver's patch to update the tty
buffering.  The input buffer is not used at all anymore, so
I removed it.
Signed-off-by: NAl Borchers <alborchers@steinerpoint.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

this is an update of the whiteheat driver. It fixes:

- switch from spinlocks to mutexes to prevent sleeping with a spinlock held
- locking to stop races with disconnect
- error handling for commands that time out
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

in order to be able to switch back to 'flow-control none'
after having activated 'flow-control rts/cts', I made
a small change to 'pl2303.c'.
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

the generic driver also had its own buffering.

Signed-off-by: Oliver Neukum <oneukum@suse.de_
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

this fixes the flushing trouble due to its own buffering for this driver.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Cc: Al Borchers <alborchers@steinerpoint.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

the new tty buffering code allows usb drivers to stop private buffering.
In fact we must do so to allow flushing to work correctly. This does so
for the visor driver.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The new FT232RL allows setting and getting the value of the latency
timer, like on the FT232BM. However, the driver will not create the
sysfs entries for the RL without this one-line patch. 

I have tested it on two systems with successful results.


From: Stepan Moskovchenko <stevenm86@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Improvements and fixes to the MCT U232 USB/serial interface driver.
Implement RTS/CTS hardware flow control.  Implement HUPCL.  Bring
handling of DTR and RTS into conformance with other Linux serial
port drivers - assert both signals when opening device, even if
"crtscts" is not currently selected.
Signed-off-by: NDave Platt <dplatt@radagast.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch adds support for the most recent Digi EdgePort USB serial
devices.
Signed-off-by: NMartin K. Petersen <mkp@mkp.net>
Signed-off-by: NMike Swift <mikes@digi.com>
Signed-off-by: NJeremy McBane <jmcbane@digi.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Last week I've been searching for a driver for the CA-42 cable (see usb
 below) that fitted my kernel 2.6.20. I only found an abandoned version for a
 driver on your website that indeed worked on 2.6.18 but wouldn't even
 compile with a more recent 2.6.20 kernel.

I fiddled 2 evenings with the kernel code and have patched it up now to work
with the modifications in the 2.6.20 kernel. The patch is attached hereafter
and it works fine (at least for me :-) ).

Bus 2 Device 13: ID 0ea0:6858 Ours Technology, Inc.

I had to fiddle a little with the settings in .gnokiirc but that also
 occurred with the older 2.6.18 kernel. Nevertheless, on one system with this
 cable and my Nokia 6070 I had best results with :

model = 6510
connection = dku5

while on an other system with the same kernel, cable and phone it only worked
with :

model = AT
connection = serial
serial_write_usleep = 1


From: Kees Lemmens <C.W.J.Lemmens@ewi.tudelft.nl>
Cc: <pawel.kot@gmail.com>
Cc: <bozo@andrews.hu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Add support for Keyspan adapters: USA-49WG and USA-28XG
Signed-off-by: NLucy P. McCoy <lucy@keyspan.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

this implements generic support for suspend/resume for usb serial.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Reported by Grzegorz Chimosz <gchimi@gmail.com>
Signed-off-by: NLuiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Cc: Matthias Urlichs <smurf@smurf.noris.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

usb_unlink_urb() is asynchronous, therefore an URB's buffer may not
be freed without waiting for the completion handler. This patch switches
to usb_kill_urb(), which is synchronous.
Thanks to Alan for making me look at the remaining users of usb_unlink_urb()
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NAl Borchers <alborchers@steinerpoint.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

you are submitting an URB with GFP_KERNEL holding a spinlock.
In this case the spinlock can be dropped earlier.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Cc: Al Borchers <alborchers@steinerpoint.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch adds support for the serial port on Olimex arm-usb-ocd
JTAG interface.

The device appears as two serial ports, but the first one is reserved
for the JTAG interface. The JTAG interface can be used with OpenOCD
from userspace. For more information, please see:

http://openocd.berlios.de/web/
http://www.olimex.com/dev/arm-usb-ocd.htmlSigned-off-by: NTony Lindgren <tony@atomide.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch adds support for the newly released Aircard 595U EVDO
modem to the Sierra Wireless driver (sierra.c) in kernel 2.6.21.

I suspect that my mailer may be mangling patches so let me know and
I'll try to resend it.


From: Danny Budik <dbudik@ist-traffic.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

USB product id registration for the OpenDCC (www.opendcc.de)
model railway central unit. Applies to 2.6.21.1.
Signed-off-by: NGuido Scholz <guido.scholz@bayernline.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Fix debug output. Previously, it would output "0xFFFFFFB0" on 32-bit
archs (and probably "0xFFFFFFFFFFFFFFB0" on 64-bits), because buf is
taken as signed char, which is promoted to signed int, while %x always
expects an unsigned int.
Signed-off-by: NJan Engelhardt <jengelh@gmx.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Cc: Matthias Urlichs <smurf@smurf.noris.de>
Signed-off-by: NBen Collins <bcollins@ubuntu.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Hello,

I need to use MaxStream's PKG-U modules which includes a ftdi sio chipset for
usb2serial communication, here are the patches for handling Maxstream's modules.

The VID & PID to use with the open-source driver are provided on the CD-ROM
bundled with the modules.

From: Neil Superna ARMSTRONG <superna@na-prod.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

this useless check should be removed.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

the transfer of allocating the descriptor in attach and no longer in open
was incomplete resulting in a memory leak coverity spotted. This fix
is against the patch set you posted.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Fix the misspellings of "propogate", "writting" and (oh, the shame
:-) "kenrel" in the source tree.
Signed-off-by: NRobert P. J. Day <rpjday@mindspring.com>
Signed-off-by: NAdrian Bunk <bunk@stusta.de>

Fix several typos in help text in Kconfig* files.
Signed-off-by: NDavid Sterba <dave@jikos.cz>
Signed-off-by: NAdrian Bunk <bunk@stusta.de>

Remove includes of <linux/smp_lock.h> where it is not used/needed.
Suggested by Al Viro.

Builds cleanly on x86_64, i386, alpha, ia64, powerpc, sparc,
sparc64, and arm (all 59 defconfigs).
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Two new device IDs for CP2101 driver.
Signed-off-by: NCraig Shelley <craig@microtron.org.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Add the detection for the BandRich BandLuxe C100/C100S/C120 HSDPA Data
Card.  With the vendor and product IDs are set properly, the data card can
be detected and works fine.
Signed-off-by: NLeon Leong <upleong@bandrich.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This should help with any potential NULL pointer usages as reported by a
few users.
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NRichard Knutsson <ricknu-0@student.ltu.se>
Acked-by: NStuart MacDonald <stuartm@connecttech.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

omninet kills all URBs in close. However write() returns as soon as
the URB has been submitted. Killing the last URB means a race that
can lose that date written in the last call to write().
As a fix this is moved to shutdown().
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

we report errors to the caller. THis patch adds error handling to the driver.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

- report errors
- cleanup in error case
- use of endianness macros
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

this driver has a memory leak in an error case.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch adds the USB ID of the ADS Tech USBX-707 USB IR blaster (that
comes with the ADS Tech PTV-305 grabber card), which has a ftdi232bm
inside hooked up to a pic.

With this it should be fairly straightforward to make at least lirc
receiving work with this device. I will submit a patch to lirc for that
as soon as I have one ready, I'm getting data with minicom with this
patch, but need to figure out some more details such as best/correct
baudrate.
Signed-off-by: NJelle Foks <jelle@foks.8m.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>