Commit a9a2c8a4 authored by Jason Wessel's avatar Jason Wessel Committed by Stephen Rothwell

USB: console: fix kernel crash on stty -a < /dev/ttyUSB0

* Boot with the kernel argument console=ttyUSB0,9600
* Run: stty -a < /dev/ttyUSB0
* Immediately you get an oops warning, which later leads to a hard
  kernel crash

The commit 335f8514 created the
original regression and commit
6e406121 only fixed part of the
problem.

Only protect the serial->type->open() from getting executed when the
device is used as a console.

The wider scope of the console protection added in
6e406121 causes the logic in
serial_open() to fall through and zero out the port->port.count with
the stty sys call.  Once the port.count is zeroed the HW will get
closed while other drivers still have call backs to a non-initialized
device which crashes the kernel.
Signed-off-by: default avatarJason Wessel <jason.wessel@windriver.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 0360a69f
...@@ -223,8 +223,7 @@ static int serial_open (struct tty_struct *tty, struct file *filp) ...@@ -223,8 +223,7 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
tty->driver_data = port; tty->driver_data = port;
tty_port_tty_set(&port->port, tty); tty_port_tty_set(&port->port, tty);
/* If the console is attached, the device is already open */ if (port->port.count == 1) {
if (port->port.count == 1 && !port->console) {
first = 1; first = 1;
/* lock this module before we call it /* lock this module before we call it
* this may fail, which means we must bail out, * this may fail, which means we must bail out,
...@@ -242,11 +241,15 @@ static int serial_open (struct tty_struct *tty, struct file *filp) ...@@ -242,11 +241,15 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
if (retval) if (retval)
goto bailout_module_put; goto bailout_module_put;
/* only call the device specific open if this /* only call the device specific open if this is the
* is the first time the port is opened */ * first time the port is opened and it is not a
retval = serial->type->open(tty, port, filp); * console port where the HW has already been
if (retval) * initialized */
goto bailout_interface_put; if (!port->console) {
retval = serial->type->open(tty, port, filp);
if (retval)
goto bailout_interface_put;
}
mutex_unlock(&serial->disc_mutex); mutex_unlock(&serial->disc_mutex);
set_bit(ASYNCB_INITIALIZED, &port->port.flags); set_bit(ASYNCB_INITIALIZED, &port->port.flags);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment