Avoid potential null pointer dereference.
Signed-off-by: NSarah Sharp <sarah.a.sharp@intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NAlan Cox <alan@redhat.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as997) fixes a bug in the USB serial core.  The core needs
to pay attention to drivers' requirements regarding the number and
type of endpoints a device has.

At the same time, the patch changes the NUM_DONT_CARE constant (which
is stored in a single-byte field) from -1 to a safer, unsigned value.
It also improves the kerneldoc for several fields in the
usb_serial_driver structure.

Finally, the patch replaces a list_for_each() with list_for_each_entry().
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

the iuu_phoenix driver submits another URB from a completion handler.
This dictates a certain order of calls to usb_kill_urb() in kill_traffic().
As other drivers may do it the other way round, we need to use both
orders in kill_traffic().
This patch does so and should be merged before iuu_phoenix is merged.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

USB: fix BUG: sleeping function called from invalid context at /home/jeremy/hg/xen/paravirt/linux/drivers/usb/core/urb.c:524, in_atomic():1, irqs_disabled():0

Clearly there's a bug in
drivers/usb/serial/usb-serial.c:usb_serial_put().  It shouldn't call
kref_put() while holding a spinlock.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Am Montag 23 Juli 2007 schrieb Adrian Bunk:
> Commit ec22559e added the following 
> function to drivers/usb/serial/usb-serial.c:
> 
[..]
> 
> The Coverity checker spotted the inconsequent NULL checking for "serial".
> 
> Looking at the code it also doesn't seem to have been intended to always 
> return 0.

Coverity is right. The check for NULL is wrongly done and the error
return is lost.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

I think there is a race between usb_serial_put() and
usb_serial_get_by_index() (and get_free_serial()) with regards
to handling the serial port refcount.

usb_serial_get_by_index() gets a reference on the serial port under
table_lock while return_serial releases all the returned ports
from the table under the same lock.  However, the table_lock is not
taken around the call to kref_put, theoretically allowing to sneak
in and grab a reference after kref_put has already determined that
the reference count is zero (and before calling destroy_serial)
causing use after free.
Signed-off-by: NBenny Halevy <bhalevy@ns1.bhalevy.com>
Cc: Oliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

this implements generic support for suspend/resume for usb serial.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Remove includes of <linux/smp_lock.h> where it is not used/needed.
Suggested by Al Viro.

Builds cleanly on x86_64, i386, alpha, ia64, powerpc, sparc,
sparc64, and arm (all 59 defconfigs).
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This patch reverts d9a7ecac since it
breaks drivers that need to access the ->port[] array in shutdown
(most of them).

Signed-Off: Jim Radford <radford@blackbean.org>
Acked-by: NMark Lord <mlord@pobox.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

this is a fix for the outstanding usb-serial issues.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Am Montag, 26. Februar 2007 15:16 schrieb Craig Schlenter:
> Hi Greg
> 
> 34ef50e5 is definitely
> the source of the problem. Reverting that makes the
> ftdi port show up as ttyUSB0 again for me and it
> can actually be opened.

This patch should fix the issue.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NCraig Schlenter <craig@codefountain.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Ensure that the ->port_remove() callbacks get called before the
->shutdown() callback which makeing the order symmetric with
->attach() being called before ->port_probe().
Signed-off-by: NJim Radford <radford@blackbean.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

- fix an error code returned if a device has been disconnected
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

- take BKL before looking up a driver to associate with a device to make
  sure the module is not unloaded after looking up but before association
  & bumping module count
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

- introduce a spinlock for serial_table to eliminate the window between
  looking up a device and getting a reference
- delay inscription of a new device into serial_table until it is fully
  initialised
- make sure disconnect() kills all URBs to avoid leckage across a soft unbind
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Thanks to Johannes Hölzl <johannes.hoelzl@gmx.de> for fixing a few
things and getting it all working properly.

This adds support for dynamic usb ids to the usb serial core.  The file
"new_id" will show up under the usb serial driver, not the usb driver
associated with the usb-serial driver (yeah, it can be a bit confusing
at first glance...)

This patch also modifies the USB core to allow the usb-serial core to
reuse much of the dynamic id logic.
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: NJohannes Hölzl <johannes.hoelzl@gmx.de>

This is the grungy swap all the occurrences in the right places patch that
goes with the updates.  At this point we have the same functionality as
before (except that sgttyb() returns speeds not zero) and are ready to
begin turning new stuff on providing nobody reports lots of bugs

If you are a tty driver author converting an out of tree driver the only
impact should be termios->ktermios name changes for the speed/property
setting functions from your upper layers.

If you are implementing your own TCGETS function before then your driver
was broken already and its about to get a whole lot more painful for you so
please fix it 8)

Also fill in c_ispeed/ospeed on init for most devices, although the current
code will do this for you anyway but I'd like eventually to lose that extra
paranoia

[akpm@osdl.org: bluetooth fix]
[mp3@de.ibm.com: sclp fix]
[mp3@de.ibm.com: warning fix for tty3270]
[hugh@veritas.com: fix tty_ioctl powerpc build]
[jdike@addtoit.com: uml: fix ->set_termios declaration]
Signed-off-by: NAlan Cox <alan@redhat.com>
Signed-off-by: NMartin Peschke <mp3@de.ibm.com>
Acked-by: NPeter Oberparleiter <oberpar@de.ibm.com>
Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: NHugh Dickins <hugh@veritas.com>
Signed-off-by: NJeff Dike <jdike@addtoit.com>
Cc: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

- usb_free_urb() cleanup
Signed-off-by: NMariusz Kozlowski <m.kozlowski@tuxland.pl>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Fix up for make allyesconfig.
Signed-Off-By: NDavid Howells <dhowells@redhat.com>

As part of an SMP cleanliness pass over UML, I consted a bunch of
structures in order to not have to document their locking.  One of these
structures was a struct tty_operations.  In order to const it in UML
without introducing compiler complaints, the declaration of
tty_set_operations needs to be changed, and then all of its callers need to
be fixed.

This patch declares all struct tty_operations in the tree as const.  In all
cases, they are static and used only as input to tty_set_operations.  As an
extra check, I ran an i386 allyesconfig build which produced no extra
warnings.

53 drivers are affected.  I checked the history of a bunch of them, and in
most cases, there have been only a handful of maintenance changes in the
last six months.  serial_core.c was the busiest one that I looked at.
Signed-off-by: NJeff Dike <jdike@addtoit.com>
Acked-by: NAlan Cox <alan@redhat.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Patch to add support for Alcor Micro Corp. USB 2.0 TO RS-232 converter.
This patch adds VID and PID to pl2303.[ch], adds it to the "HORRIBLE
HACK FOR PL2303" in usb-serial.c and also prevents cdc-acm to claim
driving this device by blacklisting it in hid-core.
Signed-off-by: NJohannes Steingraeber <Jo_Stein@web.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NLuiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

A sufficiently-large number of USB serial devices causes a reference leak
when /proc/tty/drivers/usbserial is read.
Signed-Off-By: NMatthias Urlichs <smurf@smurf.noris.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

USB serial outside of the kernel tree can not build properly due to
usb-serial.h being buried down in the source tree.  This patch moves the
location of the file to include/linux/usb and fixes up all of the usb
serial drivers to handle the move properly.

Cc: Sergei Organov <osv@javad.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This fix addresses two issues:
- Unattached port structures were not freed
- My initial fix for crash when eventd runs a work in a freed port
  did not go far enough
Signed-off-by: NPete Zaitcev <zaitcev@redhat.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NJörn Engel <joern@wohnheim.fh-wedel.de>
Signed-off-by: NAdrian Bunk <bunk@stusta.de>

I've always found this flag confusing.  Now that devfs is no longer around, it
has been renamed, and the documentation for when this flag should be used has
been updated.

Also fixes all drivers that use this flag.
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Also fixes all drivers that set this field.
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Some usbserial functions returns -EINVAL if the port doesn't exist or if
it's not opened. However, the right error code for such situations is
-ENODEV.
Signed-off-by: NLuiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

If either the driver's open() method or try_module_get() fails, we need to
set 'tty->driver_data' and 'port->tty' to NULL in serial_open(), otherwise
we'll get an OOPS in usb_device_disconnect() when the device is disconnected.
Signed-off-by: NFrank Gevaerts <frank.gevaerts@fks.be>
Acked-by: NLuiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Wait for the scheduled work to finish before freeing memory, prevent oops.
http://bugzilla.kernel.org/show_bug.cgi?id=6596Signed-off-by: NPete Zaitcev <zaitcev@redhat.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

I'm going to throw schedule_work away, it's retarded. But for starters,
let's have it encapsulated.

Also, generic and whiteheat were both calling usb_serial_port_softint
and scheduled work. Only one was necessary.
Signed-off-by: NPete Zaitcev <zaitcev@redhat.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Prevent sending further output to a USB-serial console after the dongle is
disconnected, take care not to leak kref.
Signed-off-by: NGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Prevent ENODEV on a /dev/ttyUSBx, used as a USB-serial console.

From: Paul Fulghum <paulkf@microgate.com>
Signed-off-by: NGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

If serial_open() fails at the port assignment or mutex_lock_interruptible()
is interrupted, the 'serial' object will never be freed.

We should call kref_put() when those errors happens.
Signed-off-by: NLuiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

If the device is disconnected while serial_open() is executing and
either try_module_get() or the device specific open function fails, the
kref_put() call in the 'bailout_kref_put' label will free the memory
pointed out by 'port'.

The subsequent dereferences in the 'bailout_kref_put' label will be
invalid.

The fix is just to assure kref_put() is called after any 'port' usage.
Signed-off-by: NLuiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The usbserial's port semaphore used to synchronize serial_open()
and serial_close() are strict mutexes, convert them to the mutex
implementation.
Signed-off-by: NLuiz Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NEric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>