linux-stable.git/drivers/usb/serial/console.c, branch linux-4.9.y

USB: serial: console: fix use-after-free after failed setup

2017-10-18T07:35:41+00:00

commit 299d7572e46f98534033a9e65973f13ad1ce9047 upstream.

Make sure to reset the USB-console port pointer when console setup fails
in order to avoid having the struct usb_serial be prematurely freed by
the console code when the device is later disconnected.

Fixes: 73e487fdb75f ("[PATCH] USB console: fix disconnection issues")
Acked-by: Greg Kroah-Hartman 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: serial: console: fix uninitialised spinlock

2017-02-26T10:10:52+00:00

commit 14816b16fa0adac24f82492f18fa62c55acabbbe upstream.

Since commit 4a510969374a ("tty: Make tty_files_lock per-tty") a new
tty_struct spin lock is taken in the tty release path, but the
USB-serial-console hack was never updated hence leaving the lock of its
"fake" tty uninitialised. This was eventually detected by lockdep.

Make sure to initialise the new lock also for the fake tty to address
this regression.

Yes, this code is a mess, but cleaning it up is left for another day.

Fixes: 4a510969374a ("tty: Make tty_files_lock per-tty")
Reviewed-by: Greg Kroah-Hartman 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

tty: Replace ASYNC_INITIALIZED bit and update atomically

2016-04-30T16:26:55+00:00

Replace ASYNC_INITIALIZED bit in the tty_port::flags field with
TTY_PORT_INITIALIZED bit in the tty_port::iflags field. Introduce helpers
tty_port_set_initialized() and tty_port_initialized() to abstract
atomic bit ops.

Note: the transforms for test_and_set_bit() and test_and_clear_bit()
are unnecessary as the state transitions are already mutually exclusive;
the tty lock prevents concurrent open/close/hangup.

Signed-off-by: Peter Hurley 
Signed-off-by: Greg Kroah-Hartman

tty: Fix tty_init_termios() declaration

2016-01-27T22:28:20+00:00

tty_init_termios() never returns an error; re-declare as void. Remove
unnecessary error handling from callers. Remove extern declarations
of tty_free_termios() and free_tty_struct() and re-declare in file
scope.

Signed-off-by: Peter Hurley 
Acked-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: console: add dummy __module_get

2015-02-26T16:06:39+00:00

Add call to __module_get when initialising the fake tty in
usb_console_setup to match the module_put in release_one_tty.

Note that the tty-driver (i.e. usb-serial core) must be compiled-in to
enable the usb console so the __module_get is essentially a noop as
driver->owner will be null.

Reported-by: Ben Hutchings 
Signed-off-by: Johan Hovold

USB: console: fix potential use after free

2015-01-10T11:48:21+00:00

Use tty kref to release the fake tty in usb_console_setup to avoid use
after free if the underlying serial driver has acquired a reference.

Note that using the tty destructor release_one_tty requires some more
state to be initialised.

Fixes: 4a90f09b20f4 ("tty: usb-serial krefs")
Cc: stable 
Signed-off-by: Johan Hovold

USB: console: fix uninitialised ldisc semaphore

2015-01-10T11:48:15+00:00

The USB console currently allocates a temporary fake tty which is used
to pass terminal settings to the underlying serial driver.

The tty struct is not fully initialised, something which can lead to a
lockdep warning (or worse) if a serial driver tries to acquire a
line-discipline reference:

	usbserial: USB Serial support registered for pl2303
	pl2303 1-2.1:1.0: pl2303 converter detected
	usb 1-2.1: pl2303 converter now attached to ttyUSB0
	INFO: trying to register non-static key.
	the code is fine but needs lockdep annotation.
	turning off the locking correctness validator.
	CPU: 0 PID: 68 Comm: udevd Tainted: G        W      3.18.0-rc5 #10
	[] (unwind_backtrace) from [] (show_stack+0x20/0x24)
	[] (show_stack) from [] (dump_stack+0x24/0x28)
	[] (dump_stack) from [] (__lock_acquire+0x1e50/0x2004)
	[] (__lock_acquire) from [] (lock_acquire+0xe4/0x18c)
	[] (lock_acquire) from [] (ldsem_down_read_trylock+0x78/0x90)
	[] (ldsem_down_read_trylock) from [] (tty_ldisc_ref+0x24/0x58)
	[] (tty_ldisc_ref) from [] (usb_serial_handle_dcd_change+0x48/0xe8)
	[] (usb_serial_handle_dcd_change) from [] (pl2303_read_int_callback+0x210/0x220 [pl2303])
	[] (pl2303_read_int_callback [pl2303]) from [] (__usb_hcd_giveback_urb+0x80/0x140)
	[] (__usb_hcd_giveback_urb) from [] (usb_giveback_urb_bh+0x98/0xd4)
	[] (usb_giveback_urb_bh) from [] (tasklet_hi_action+0x9c/0x108)
	[] (tasklet_hi_action) from [] (__do_softirq+0x148/0x42c)
	[] (__do_softirq) from [] (irq_exit+0xd8/0x114)
	[] (irq_exit) from [] (__handle_domain_irq+0x84/0xdc)
	[] (__handle_domain_irq) from [] (omap_intc_handle_irq+0xd8/0xe0)
	[] (omap_intc_handle_irq) from [] (__irq_svc+0x44/0x7c)
	Exception stack(0xdf4e7f08 to 0xdf4e7f50)
	7f00:                   debc0b80 df4e7f5c 00000000 00000000 debc0b80 be8da96c
	7f20: 00000000 00000128 c000fc84 df4e6000 00000000 df4e7f94 00000004 df4e7f50
	7f40: c038ebc0 c038d74c 600f0013 ffffffff
	[] (__irq_svc) from [] (___sys_sendmsg.part.29+0x0/0x2e0)
	[] (___sys_sendmsg.part.29) from [] (SyS_sendmsg+0x18/0x1c)
	[] (SyS_sendmsg) from [] (ret_fast_syscall+0x0/0x48)
	console [ttyUSB0] enabled

Fixes: 36697529b5bb ("tty: Replace ldisc locking with ldisc_sem")
Cc: stable 
Signed-off-by: Johan Hovold

usb: delete non-required instances of include

2014-01-08T23:01:39+00:00

None of these files are actually using any __init type directives
and hence don't need to include .  Most are just a
left over from __devinit and __cpuinit removal, or simply due to
code getting copied from one driver to the next.

Signed-off-by: Paul Gortmaker 
Signed-off-by: Greg Kroah-Hartman

USB: serial: remove redundant OOM messages

2014-01-03T20:31:46+00:00

Remove redundant error messages on allocation failures, which have
already been logged.

Cc: Joe Perches 
Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman

USB: console: remove unnecessary operations test

2013-07-23T23:24:32+00:00

Remove unnecessary tests for open and write operations as these are set
to the generic implementations by usb-serial core if left unset by a
subdriver.

Signed-off-by: Johan Hovold 
Signed-off-by: Greg Kroah-Hartman