linux/drivers/usb/class, branch v2.6.32

USB: cdc_acm: Fix memory leak after hangup

2009-11-18T00:46:33Z

Am Donnerstag, 10. September 2009 15:43:53 schrieb Dietmar Hilbrich: > Hello, > > i have the following problem with the cdc-acm - driver: > > I'm using the driver with an "Ericsson F3507G" on a Thinkpad T400. > > If a disable the device (with the RFKill-Switch) while it is used by a > programm like ppp, the driver doesn't seem to correctly clean up the tty, > even after the program has been closed) > > The tty is still active (e.g. there still exists an entry in > /sys/dev/char/166:0 if ttyACM0 was used) and if a reacticate the device, > this device entry will be skipped and the Device-Nodes ttyACM1, ttyACM2 > and ttyACM3 will be used. > > This problem was introduced with the commit > 10077d4a6674f535abdbe25cdecb1202af7948f1 (before 2.6.31-rc1) and still > exists in 2.6.31. > > I was able the fix this problem with the following patch: > > diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c > index 2bfc41e..0970d2f 100644 > --- a/drivers/usb/class/cdc-acm.c > +++ b/drivers/usb/class/cdc-acm.c > @@ -676,6 +676,7 @@ static void acm_tty_hangup(struct tty_struct *tty) > struct acm *acm = tty->driver_data; > tty_port_hangup(&acm->port); > acm_port_down(acm, 0); > + acm_tty_unregister(acm); > } I have the same problem with cdc-acm (I'm using a Samsung SGH-U900): when I unplug it from the USB port during a PPP connection, the ppp daemon gets the hangup correctly (and closes the device), but the struct acm corresponding to the device disconnected is not freed. Hence reconnecting the device results in creation of /dev/ttyACM(x+1). The same happens when the system is hibernated during a PPP connection. This memory leak is due to the fact that when the tty is hung up, tty_port_close_start() returns always zero, and acm_tty_close() never reaches the point where acm_tty_unregister() is called. Here is a fix for this. Signed-off-by: Francesco Lavra Acked-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman

USB: cdc_acm: Fix race condition when opening tty

2009-11-18T00:46:33Z

If acm_rx_tasklet() gets called before tty_port_block_til_ready() returns, then bulk IN urbs may not be sent. This fixes it. Signed-off-by: Henry Gebhardt Acked-by: Oliver Neukum Cc: stable Signed-off-by: Greg Kroah-Hartman

USB: usbtmc: fix timeout increase

2009-10-09T20:52:06Z

The current 10ms timeout is too short for some normal USBTMC device operation, increase it to a value which was tested with previously affected Tektronix oscilloscopes. Signed-off-by: Gergely Imreh Signed-off-by: Greg Kroah-Hartman

const: constify remaining file_operations

2009-10-01T23:11:11Z

[akpm@linux-foundation.org: fix KVM] Signed-off-by: Alexey Dobriyan Acked-by: Mike Frysinger Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

USB: fix USBTMC get_capabilities success handling

2009-09-23T13:46:39Z

In order: Add reference to relevant section of USBTMC usb488 subclass specs. Print debug output of capabilities only when it was retrieved successfully. Clear return value on success, otherwise driver always reports failure. Signed-off-by: Gergely Imreh Signed-off-by: Greg Kroah-Hartman

USB: usbtmc: correct termination condition for reads.

2009-09-23T13:46:35Z

Follow T&M convention of obeying EOM flag. Avoid exception cases where instrument response size matches a buffer size. Signed-off-by: Steve Holland Signed-off-by: Greg Kroah-Hartman

USB: usbtmc: inhibit corruption

2009-09-23T13:46:35Z

Limit data copied to userspace to amount requested. Prevents a faulty instrument from overwriting user memory. Signed-off-by: Steve Holland Signed-off-by: Greg Kroah-Hartman

USB: usbtmc: Fix short reads in usbtmc_read()

2009-09-23T13:46:35Z

The header size should not be included in the number of bytes requested of the instrument Signed-off-by: Steve Holland Signed-off-by: Greg Kroah-Hartman

USB: usbtmc: fix printk format warnings

2009-09-23T13:46:30Z

Fix printk format warnings: drivers/usb/class/usbtmc.c:466: warning: format '%zu' expects type 'size_t', but argument 4 has type 'u32' drivers/usb/class/usbtmc.c:466: warning: format '%zu' expects type 'size_t', but argument 5 has type 'int' Signed-off-by: Randy Dunlap Signed-off-by: Greg Kroah-Hartman

USB: usbtmc: sanity checks for DEV_DEP_MSG_IN urbs

2009-09-23T13:46:30Z

According to the specifications, an instrument should not return more data in a DEV_DEP_MSG_IN urb than requested. However, some instruments can send more than requested. This could cause the kernel to write the extra data past the end of the buffer provided by read(). Fix this by checking that the value of the TranserSize field is not larger than the urb itself and not larger than the size of the userspace buffer. Also correctly decrement the remaining size of the buffer when userspace read()s more than USBTMC_SIZE_IOBUFFER. Signed-off-by: Guus Sliepen Cc: stable Signed-off-by: Greg Kroah-Hartman