[patch 11/16] USB: fix bug in visor driver with throttle/unthrottle causing oopses.

Chris Wright
2005-05-23T23:40:58Z

Thanks to Mark Lord <mlord@pobox.com> for reporting this and helping with testing.

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
drivers/usb/serial/visor.c | 38 +++++++++++++++++++++++++++-----------
1 files changed, 27 insertions(+), 11 deletions(-)

--- linux-2.6.11.10.orig/drivers/usb/serial/visor.c 2005-05-16 10:50:37.000000000 -0700
+++ linux-2.6.11.10/drivers/usb/serial/visor.c 2005-05-20 09:36:44.139463608 -0700
@@ -386,6 +386,7 @@
int bytes_in;
int bytes_out;
int outstanding_urbs;
+ int throttled;
};

/* number of outstanding urbs to prevent userspace DoS from happening */
@@ -415,6 +416,7 @@
priv->bytes_in = 0;
priv->bytes_out = 0;
priv->outstanding_urbs = 0;
+ priv->throttled = 0;
spin_unlock_irqrestore(&priv->lock, flags);

/*
@@ -602,6 +604,7 @@
struct tty_struct *tty;
unsigned long flags;
int i;
+ int throttled;
int result;

dbg("%s - port %d", __FUNCTION__, port->number);
@@ -627,18 +630,21 @@
}
spin_lock_irqsave(&priv->lock, flags);
priv->bytes_in += urb->actual_length;
+ throttled = priv->throttled;
spin_unlock_irqrestore(&priv->lock, flags);

- /* Continue trying to always read */
- usb_fill_bulk_urb (port->read_urb, port->serial->dev,
- usb_rcvbulkpipe(port->serial->dev,
- port->bulk_in_endpointAddress),
- port->read_urb->transfer_buffer,
- port->read_urb->transfer_buffer_length,
- visor_read_bulk_callback, port);
- result = usb_submit_urb(port->read_urb, GFP_ATOMIC);
- if (result)
- dev_err(&port->dev, "%s - failed resubmitting read urb, error %d\n", __FUNCTION__, result);
+ /* Continue trying to always read if we should */
+ if (!throttled) {
+ usb_fill_bulk_urb (port->read_urb, port->serial->dev,
+ usb_rcvbulkpipe(port->serial->dev,
+ port->bulk_in_endpointAddress),
+ port->read_urb->transfer_buffer,
+ port->read_urb->transfer_buffer_length,
+ visor_read_bulk_callback, port);
+ result = usb_submit_urb(port->read_urb, GFP_ATOMIC);
+ if (result)
+ dev_err(&port->dev, "%s - failed resubmitting read urb, error %d\n", __FUNCTION__, result);
+ }
return;
}

@@ -683,16 +689,26 @@

static void visor_throttle (struct usb_serial_port *port)
{
+ struct visor_private *priv = usb_get_serial_port_data(port);
+ unsigned long flags;
+
dbg("%s - port %d", __FUNCTION__, port->number);
- usb_kill_urb(port->read_urb);
+ spin_lock_irqsave(&priv->lock, flags);
+ priv->throttled = 1;
+ spin_unlock_irqrestore(&priv->lock, flags);
}

static void visor_unthrottle (struct usb_serial_port *port)
{
+ struct visor_private *priv = usb_get_serial_port_data(port);
+ unsigned long flags;
int result;

dbg("%s - port %d", __FUNCTION__, port->number);
+ spin_lock_irqsave(&priv->lock, flags);
+ priv->throttled = 0;
+ spin_unlock_irqrestore(&priv->lock, flags);

port->read_urb->dev = port->serial->dev;
result = usb_submit_urb(port->read_urb, GFP_ATOMIC);