summaryrefslogtreecommitdiffstats
path: root/drivers/usb/serial/ti_usb_3410_5052.c
diff options
context:
space:
mode:
authorJohan Hovold <johan@kernel.org>2019-10-11 11:57:35 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2019-10-29 09:22:08 +0100
commitde83289d42bb1c4a6c1ce2386241977a76653007 (patch)
tree19bb4c60c2b5327668876fd4debe1f6d4adc3d80 /drivers/usb/serial/ti_usb_3410_5052.c
parent5ca15922a65f69d66cb03311c8a6920b92ac33e9 (diff)
downloadlinux-stable-de83289d42bb1c4a6c1ce2386241977a76653007.tar.gz
linux-stable-de83289d42bb1c4a6c1ce2386241977a76653007.tar.bz2
linux-stable-de83289d42bb1c4a6c1ce2386241977a76653007.zip
USB: serial: ti_usb_3410_5052: fix port-close races
commit 6f1d1dc8d540a9aa6e39b9cb86d3a67bbc1c8d8d upstream. Fix races between closing a port and opening or closing another port on the same device which could lead to a failure to start or stop the shared interrupt URB. The latter could potentially cause a use-after-free or worse in the completion handler on driver unbind. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable <stable@vger.kernel.org> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb/serial/ti_usb_3410_5052.c')
-rw-r--r--drivers/usb/serial/ti_usb_3410_5052.c10
1 files changed, 3 insertions, 7 deletions
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index dd0ad67aa71e..9174ba2e06da 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -776,7 +776,6 @@ static void ti_close(struct usb_serial_port *port)
struct ti_port *tport;
int port_number;
int status;
- int do_unlock;
unsigned long flags;
tdev = usb_get_serial_data(port->serial);
@@ -800,16 +799,13 @@ static void ti_close(struct usb_serial_port *port)
"%s - cannot send close port command, %d\n"
, __func__, status);
- /* if mutex_lock is interrupted, continue anyway */
- do_unlock = !mutex_lock_interruptible(&tdev->td_open_close_lock);
+ mutex_lock(&tdev->td_open_close_lock);
--tport->tp_tdev->td_open_port_count;
- if (tport->tp_tdev->td_open_port_count <= 0) {
+ if (tport->tp_tdev->td_open_port_count == 0) {
/* last port is closed, shut down interrupt urb */
usb_kill_urb(port->serial->port[0]->interrupt_in_urb);
- tport->tp_tdev->td_open_port_count = 0;
}
- if (do_unlock)
- mutex_unlock(&tdev->td_open_close_lock);
+ mutex_unlock(&tdev->td_open_close_lock);
}