Commit 960fbd1c authored by Johan Hovold's avatar Johan Hovold
Browse files

USB: serial: mos7840: fix probe error handling 



The driver would return success and leave the port structures
half-initialised if any of the register accesses during probe fails.

This would specifically leave the port control urb unallocated,
something which could trigger a NULL pointer dereference on interrupt
events.

Fortunately the interrupt implementation is completely broken and has
never even been enabled...

Note that the zero-length-enable register write used to set the zle-flag
for all ports is moved to attach.

Reviewed-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
parent 1c333550

drivers/usb/serial/mos7840.c

+28 −20
Original line number Diff line number Diff line
@@ -2066,6 +2066,23 @@ static int mos7840_calc_num_ports(struct usb_serial *serial, 
	return num_ports;

}



static int mos7840_attach(struct usb_serial *serial)

{

	struct device *dev = &serial->interface->dev;

	int status;

	u16 val;



	/* Zero Length flag enable */

	val = 0x0f;

	status = mos7840_set_reg_sync(serial->port[0], ZLP_REG5, val);

	if (status < 0)

		dev_dbg(dev, "Writing ZLP_REG5 failed status-0x%x\n", status);

	else

		dev_dbg(dev, "ZLP_REG5 Writing success status%d\n", status);



	return status;

}



static int mos7840_port_probe(struct usb_serial_port *port)

{

	struct usb_serial *serial = port->serial;
@@ -2123,7 +2140,7 @@ static int mos7840_port_probe(struct usb_serial_port *port) 
			mos7840_port->ControlRegOffset, &Data);

	if (status < 0) {

		dev_dbg(&port->dev, "Reading ControlReg failed status-0x%x\n", status);

		goto out;

		goto error;

	} else

		dev_dbg(&port->dev, "ControlReg Reading success val is %x, status%d\n", Data, status);

	Data |= 0x08;	/* setting driver done bit */
@@ -2135,7 +2152,7 @@ static int mos7840_port_probe(struct usb_serial_port *port) 
			mos7840_port->ControlRegOffset, Data);

	if (status < 0) {

		dev_dbg(&port->dev, "Writing ControlReg failed(rx_disable) status-0x%x\n", status);

		goto out;

		goto error;

	} else

		dev_dbg(&port->dev, "ControlReg Writing success(rx_disable) status%d\n", status);
@@ -2146,7 +2163,7 @@ static int mos7840_port_probe(struct usb_serial_port *port) 
			(__u16) (mos7840_port->DcrRegOffset + 0), Data);

	if (status < 0) {

		dev_dbg(&port->dev, "Writing DCR0 failed status-0x%x\n", status);

		goto out;

		goto error;

	} else

		dev_dbg(&port->dev, "DCR0 Writing success status%d\n", status);
@@ -2155,7 +2172,7 @@ static int mos7840_port_probe(struct usb_serial_port *port) 
			(__u16) (mos7840_port->DcrRegOffset + 1), Data);

	if (status < 0) {

		dev_dbg(&port->dev, "Writing DCR1 failed status-0x%x\n", status);

		goto out;

		goto error;

	} else

		dev_dbg(&port->dev, "DCR1 Writing success status%d\n", status);
@@ -2164,7 +2181,7 @@ static int mos7840_port_probe(struct usb_serial_port *port) 
			(__u16) (mos7840_port->DcrRegOffset + 2), Data);

	if (status < 0) {

		dev_dbg(&port->dev, "Writing DCR2 failed status-0x%x\n", status);

		goto out;

		goto error;

	} else

		dev_dbg(&port->dev, "DCR2 Writing success status%d\n", status);
@@ -2173,7 +2190,7 @@ static int mos7840_port_probe(struct usb_serial_port *port) 
	status = mos7840_set_reg_sync(port, CLK_START_VALUE_REGISTER, Data);

	if (status < 0) {

		dev_dbg(&port->dev, "Writing CLK_START_VALUE_REGISTER failed status-0x%x\n", status);

		goto out;

		goto error;

	} else

		dev_dbg(&port->dev, "CLK_START_VALUE_REGISTER Writing success status%d\n", status);
@@ -2190,7 +2207,7 @@ static int mos7840_port_probe(struct usb_serial_port *port) 
	status = mos7840_set_uart_reg(port, SCRATCH_PAD_REGISTER, Data);

	if (status < 0) {

		dev_dbg(&port->dev, "Writing SCRATCH_PAD_REGISTER failed status-0x%x\n", status);

		goto out;

		goto error;

	} else

		dev_dbg(&port->dev, "SCRATCH_PAD_REGISTER Writing success status%d\n", status);
@@ -2204,7 +2221,7 @@ static int mos7840_port_probe(struct usb_serial_port *port) 
				(__u16)(ZLP_REG1 + ((__u16) mos7840_port->port_num)));

		if (status < 0) {

			dev_dbg(&port->dev, "Writing ZLP_REG%d failed status-0x%x\n", pnum + 2, status);

			goto out;

			goto error;

		} else

			dev_dbg(&port->dev, "ZLP_REG%d Writing success status%d\n", pnum + 2, status);

	} else {
@@ -2216,7 +2233,7 @@ static int mos7840_port_probe(struct usb_serial_port *port) 
				(__u16)(ZLP_REG1 + ((__u16) mos7840_port->port_num) - 0x1));

		if (status < 0) {

			dev_dbg(&port->dev, "Writing ZLP_REG%d failed status-0x%x\n", pnum + 1, status);

			goto out;

			goto error;

		} else

			dev_dbg(&port->dev, "ZLP_REG%d Writing success status%d\n", pnum + 1, status);
@@ -2254,17 +2271,7 @@ static int mos7840_port_probe(struct usb_serial_port *port) 
		/* Turn off LED */

		mos7840_set_led_sync(port, MODEM_CONTROL_REGISTER, 0x0300);

	}

out:

	if (pnum == serial->num_ports - 1) {

		/* Zero Length flag enable */

		Data = 0x0f;

		status = mos7840_set_reg_sync(serial->port[0], ZLP_REG5, Data);

		if (status < 0) {

			dev_dbg(&port->dev, "Writing ZLP_REG5 failed status-0x%x\n", status);

			goto error;

		} else

			dev_dbg(&port->dev, "ZLP_REG5 Writing success status%d\n", status);

	}



	return 0;

error:

	kfree(mos7840_port->led_dr);
@@ -2320,6 +2327,7 @@ static struct usb_serial_driver moschip7840_4port_device = { 
	.unthrottle = mos7840_unthrottle,

	.calc_num_ports = mos7840_calc_num_ports,

	.probe = mos7840_probe,

	.attach = mos7840_attach,

	.ioctl = mos7840_ioctl,

	.get_serial = mos7840_get_serial_info,

	.set_termios = mos7840_set_termios,