releases/3.4.96/usb-usb_wwan-fix-urb-leak-at-shutdown.patch

   1 From 79eed03e77d481b55d85d1cfe5a1636a0d3897fd Mon Sep 17 00:00:00 2001
   2 From: Johan Hovold <jhovold@gmail.com>
   3 Date: Mon, 26 May 2014 19:23:16 +0200
   4 Subject: USB: usb_wwan: fix urb leak at shutdown
   5
   6 From: Johan Hovold <jhovold@gmail.com>
   7
   8 commit 79eed03e77d481b55d85d1cfe5a1636a0d3897fd upstream.
   9
  10 The delayed-write queue was never emptied at shutdown (close), something
  11 which could lead to leaked urbs if the port is closed before being
  12 runtime resumed due to a write.
  13
  14 When this happens the output buffer would not drain on close
  15 (closing_wait timeout), and after consecutive opens, writes could be
  16 corrupted with previously buffered data, transfered with reduced
  17 throughput or completely blocked.
  18
  19 Note that unbusy_queued_urb() was simply moved out of CONFIG_PM.
  20
  21 Fixes: 383cedc3bb43 ("USB: serial: full autosuspend support for the
  22 option driver")
  23
  24 Signed-off-by: Johan Hovold <jhovold@gmail.com>
  25 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  26
  27 ---
  28  drivers/usb/serial/usb_wwan.c |   34 ++++++++++++++++++++++------------
  29  1 file changed, 22 insertions(+), 12 deletions(-)
  30
  31 --- a/drivers/usb/serial/usb_wwan.c
  32 +++ b/drivers/usb/serial/usb_wwan.c
  33 @@ -434,12 +434,26 @@ int usb_wwan_open(struct tty_struct *tty
  34  }
  35  EXPORT_SYMBOL(usb_wwan_open);
  36
  37 +static void unbusy_queued_urb(struct urb *urb,
  38 +                                       struct usb_wwan_port_private *portdata)
  39 +{
  40 +       int i;
  41 +
  42 +       for (i = 0; i < N_OUT_URB; i++) {
  43 +               if (urb == portdata->out_urbs[i]) {
  44 +                       clear_bit(i, &portdata->out_busy);
  45 +                       break;
  46 +               }
  47 +       }
  48 +}
  49 +
  50  void usb_wwan_close(struct usb_serial_port *port)
  51  {
  52         int i;
  53         struct usb_serial *serial = port->serial;
  54         struct usb_wwan_port_private *portdata;
  55         struct usb_wwan_intf_private *intfdata = port->serial->private;
  56 +       struct urb *urb;
  57
  58         dbg("%s", __func__);
  59         portdata = usb_get_serial_port_data(port);
  60 @@ -450,6 +464,14 @@ void usb_wwan_close(struct usb_serial_po
  61                 portdata->opened = 0;
  62                 spin_unlock_irq(&intfdata->susp_lock);
  63
  64 +               for (;;) {
  65 +                       urb = usb_get_from_anchor(&portdata->delayed);
  66 +                       if (!urb)
  67 +                               break;
  68 +                       unbusy_queued_urb(urb, portdata);
  69 +                       usb_autopm_put_interface_async(serial->interface);
  70 +               }
  71 +
  72                 for (i = 0; i < N_IN_URB; i++)
  73                         usb_kill_urb(portdata->in_urbs[i]);
  74                 for (i = 0; i < N_OUT_URB; i++)
  75 @@ -667,18 +689,6 @@ int usb_wwan_suspend(struct usb_serial *
  76  }
  77  EXPORT_SYMBOL(usb_wwan_suspend);
  78
  79 -static void unbusy_queued_urb(struct urb *urb, struct usb_wwan_port_private *portdata)
  80 -{
  81 -       int i;
  82 -
  83 -       for (i = 0; i < N_OUT_URB; i++) {
  84 -               if (urb == portdata->out_urbs[i]) {
  85 -                       clear_bit(i, &portdata->out_busy);
  86 -                       break;
  87 -               }
  88 -       }
  89 -}
  90 -
  91  static void play_delayed(struct usb_serial_port *port)
  92  {
  93         struct usb_wwan_intf_private *data;