xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

USB: xhci: dbc: fix tty registration race

Browse Source 
commit 880de403777376e50bdf60def359fa50a722006f upstream.

Make sure to allocate resources before registering the tty device to
avoid having a racing open() and write() fail to enable rx or
dereference a NULL pointer when accessing the uninitialised fifo.

Fixes: dfba2174dc ("usb: xhci: Add DbC support in xHCI driver")
Cc: stable@vger.kernel.org      # 4.16
Cc: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20211008092547.3996295-4-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Johan Hovold
2021-10-08 12:25:45 +03:00
committed by Greg Kroah-Hartman
parent 9f0d6c781c
commit 0ee66290f0
1 changed files with 13 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
drivers/usb/host/xhci-dbgtty.c
View File

@@ -408,40 +408,38 @@ static int xhci_dbc_tty_register_device(struct xhci_dbc *dbc)
return -EBUSY; return -EBUSY;
xhci_dbc_tty_init_port(dbc, port); xhci_dbc_tty_init_port(dbc, port);
tty_dev = tty_port_register_device(&port->port,
dbc_tty_driver, 0, NULL);
if (IS_ERR(tty_dev)) {
ret = PTR_ERR(tty_dev);
goto register_fail;
}
ret = kfifo_alloc(&port->write_fifo, DBC_WRITE_BUF_SIZE, GFP_KERNEL); ret = kfifo_alloc(&port->write_fifo, DBC_WRITE_BUF_SIZE, GFP_KERNEL);
if (ret) if (ret)
goto buf_alloc_fail; goto err_exit_port;
ret = xhci_dbc_alloc_requests(dbc, BULK_IN, &port->read_pool, ret = xhci_dbc_alloc_requests(dbc, BULK_IN, &port->read_pool,
dbc_read_complete); dbc_read_complete);
if (ret) if (ret)
goto request_fail; goto err_free_fifo;
ret = xhci_dbc_alloc_requests(dbc, BULK_OUT, &port->write_pool, ret = xhci_dbc_alloc_requests(dbc, BULK_OUT, &port->write_pool,
dbc_write_complete); dbc_write_complete);
if (ret) if (ret)
goto request_fail; goto err_free_requests;
tty_dev = tty_port_register_device(&port->port,
dbc_tty_driver, 0, NULL);
if (IS_ERR(tty_dev)) {
ret = PTR_ERR(tty_dev);
goto err_free_requests;
}
port->registered = true; port->registered = true;
return 0; return 0;
request_fail: err_free_requests:
xhci_dbc_free_requests(&port->read_pool); xhci_dbc_free_requests(&port->read_pool);
xhci_dbc_free_requests(&port->write_pool); xhci_dbc_free_requests(&port->write_pool);
err_free_fifo:
kfifo_free(&port->write_fifo); kfifo_free(&port->write_fifo);
err_exit_port:
buf_alloc_fail:
tty_unregister_device(dbc_tty_driver, 0);
register_fail:
xhci_dbc_tty_exit_port(port); xhci_dbc_tty_exit_port(port);
dev_err(dbc->dev, "can't register tty port, err %d\n", ret); dev_err(dbc->dev, "can't register tty port, err %d\n", ret);