From: Greg Kroah-Hartman Date: Sun, 25 Jan 2015 14:41:03 +0000 (+0800) Subject: 3.14-stable patches X-Git-Tag: v3.10.66~21 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=69c3f9339103624808270582ecd5baf7e61d9765;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: ohci-add-a-quirk-for-uli-m5237-blocking-on-reset.patch usb-console-fix-potential-use-after-free.patch usb-console-fix-uninitialised-ldisc-semaphore.patch usb-cp210x-add-ids-for-cel-usb-sticks-and-meshworks-devices.patch usb-cp210x-fix-id-for-production-cel-meshconnect-usb-stick.patch usb-dwc3-gadget-fix-trb-preparation-during-sg.patch usb-dwc3-gadget-stop-trb-preparation-after-limit-is-reached.patch usb-keyspan-fix-null-deref-at-probe.patch --- diff --git a/queue-3.14/ohci-add-a-quirk-for-uli-m5237-blocking-on-reset.patch b/queue-3.14/ohci-add-a-quirk-for-uli-m5237-blocking-on-reset.patch new file mode 100644 index 00000000000..aadf569abfe --- /dev/null +++ b/queue-3.14/ohci-add-a-quirk-for-uli-m5237-blocking-on-reset.patch @@ -0,0 +1,81 @@ +From 56abcab833fafcfaeb2f5b25e0364c1dec45f53e Mon Sep 17 00:00:00 2001 +From: Arseny Solokha +Date: Sat, 6 Dec 2014 09:54:06 +0700 +Subject: OHCI: add a quirk for ULi M5237 blocking on reset + +From: Arseny Solokha + +commit 56abcab833fafcfaeb2f5b25e0364c1dec45f53e upstream. + +Commit 8dccddbc2368 ("OHCI: final fix for NVIDIA problems (I hope)") +introduced into 3.1.9 broke boot on e.g. Freescale P2020DS development +board. The code path that was previously specific to NVIDIA controllers +had then become taken for all chips. + +However, the M5237 installed on the board wedges solid when accessing +its base+OHCI_FMINTERVAL register, making it impossible to boot any +kernel newer than 3.1.8 on this particular and apparently other similar +machines. + +Don't readl() and writel() base+OHCI_FMINTERVAL on PCI ID 10b9:5237. + +The patch is suitable for the -next tree as well as all maintained +kernels up to 3.2 inclusive. + +Signed-off-by: Arseny Solokha +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/pci-quirks.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -571,7 +571,8 @@ static void quirk_usb_handoff_ohci(struc + { + void __iomem *base; + u32 control; +- u32 fminterval; ++ u32 fminterval = 0; ++ bool no_fminterval = false; + int cnt; + + if (!mmio_resource_enabled(pdev, 0)) +@@ -581,6 +582,13 @@ static void quirk_usb_handoff_ohci(struc + if (base == NULL) + return; + ++ /* ++ * ULi M5237 OHCI controller locks the whole system when accessing ++ * the OHCI_FMINTERVAL offset. ++ */ ++ if (pdev->vendor == PCI_VENDOR_ID_AL && pdev->device == 0x5237) ++ no_fminterval = true; ++ + control = readl(base + OHCI_CONTROL); + + /* On PA-RISC, PDC can leave IR set incorrectly; ignore it there. */ +@@ -619,7 +627,9 @@ static void quirk_usb_handoff_ohci(struc + } + + /* software reset of the controller, preserving HcFmInterval */ +- fminterval = readl(base + OHCI_FMINTERVAL); ++ if (!no_fminterval) ++ fminterval = readl(base + OHCI_FMINTERVAL); ++ + writel(OHCI_HCR, base + OHCI_CMDSTATUS); + + /* reset requires max 10 us delay */ +@@ -628,7 +638,9 @@ static void quirk_usb_handoff_ohci(struc + break; + udelay(1); + } +- writel(fminterval, base + OHCI_FMINTERVAL); ++ ++ if (!no_fminterval) ++ writel(fminterval, base + OHCI_FMINTERVAL); + + /* Now the controller is safely in SUSPEND and nothing can wake it up */ + iounmap(base); diff --git a/queue-3.14/series b/queue-3.14/series index 7c7319483c7..ecfd67e20f6 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -55,3 +55,11 @@ ftrace-jprobes-x86-fix-conflict-between-jprobes-and-function-graph-tracing.patch nfsv4.1-fix-client-id-trunking-on-linux.patch gpiolib-of-correct-error-handling-in-of_get_named_gpiod_flags.patch gpio-fix-memory-and-reference-leaks-in-gpiochip_add-error-path.patch +ohci-add-a-quirk-for-uli-m5237-blocking-on-reset.patch +usb-dwc3-gadget-fix-trb-preparation-during-sg.patch +usb-dwc3-gadget-stop-trb-preparation-after-limit-is-reached.patch +usb-cp210x-fix-id-for-production-cel-meshconnect-usb-stick.patch +usb-cp210x-add-ids-for-cel-usb-sticks-and-meshworks-devices.patch +usb-keyspan-fix-null-deref-at-probe.patch +usb-console-fix-uninitialised-ldisc-semaphore.patch +usb-console-fix-potential-use-after-free.patch diff --git a/queue-3.14/usb-console-fix-potential-use-after-free.patch b/queue-3.14/usb-console-fix-potential-use-after-free.patch new file mode 100644 index 00000000000..fb195a72615 --- /dev/null +++ b/queue-3.14/usb-console-fix-potential-use-after-free.patch @@ -0,0 +1,74 @@ +From 32a4bf2e81ec378e5925d4e069e0677a6c86a6ad Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 5 Jan 2015 16:04:13 +0100 +Subject: USB: console: fix potential use after free + +From: Johan Hovold + +commit 32a4bf2e81ec378e5925d4e069e0677a6c86a6ad upstream. + +Use tty kref to release the fake tty in usb_console_setup to avoid use +after free if the underlying serial driver has acquired a reference. + +Note that using the tty destructor release_one_tty requires some more +state to be initialised. + +Fixes: 4a90f09b20f4 ("tty: usb-serial krefs") +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/console.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/drivers/usb/serial/console.c ++++ b/drivers/usb/serial/console.c +@@ -46,6 +46,8 @@ static struct console usbcons; + * ------------------------------------------------------------ + */ + ++static const struct tty_operations usb_console_fake_tty_ops = { ++}; + + /* + * The parsing of the command line works exactly like the +@@ -137,14 +139,17 @@ static int usb_console_setup(struct cons + goto reset_open_count; + } + kref_init(&tty->kref); +- tty_port_tty_set(&port->port, tty); + tty->driver = usb_serial_tty_driver; + tty->index = co->index; + init_ldsem(&tty->ldisc_sem); ++ INIT_LIST_HEAD(&tty->tty_files); ++ kref_get(&tty->driver->kref); ++ tty->ops = &usb_console_fake_tty_ops; + if (tty_init_termios(tty)) { + retval = -ENOMEM; +- goto free_tty; ++ goto put_tty; + } ++ tty_port_tty_set(&port->port, tty); + } + + /* only call the device specific open if this +@@ -162,7 +167,7 @@ static int usb_console_setup(struct cons + serial->type->set_termios(tty, port, &dummy); + + tty_port_tty_set(&port->port, NULL); +- kfree(tty); ++ tty_kref_put(tty); + } + set_bit(ASYNCB_INITIALIZED, &port->port.flags); + } +@@ -178,8 +183,8 @@ static int usb_console_setup(struct cons + + fail: + tty_port_tty_set(&port->port, NULL); +- free_tty: +- kfree(tty); ++ put_tty: ++ tty_kref_put(tty); + reset_open_count: + port->port.count = 0; + usb_autopm_put_interface(serial->interface); diff --git a/queue-3.14/usb-console-fix-uninitialised-ldisc-semaphore.patch b/queue-3.14/usb-console-fix-uninitialised-ldisc-semaphore.patch new file mode 100644 index 00000000000..2433bb36107 --- /dev/null +++ b/queue-3.14/usb-console-fix-uninitialised-ldisc-semaphore.patch @@ -0,0 +1,66 @@ +From d269d4434c72ed0da3a9b1230c30da82c4918c63 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 5 Jan 2015 16:04:12 +0100 +Subject: USB: console: fix uninitialised ldisc semaphore + +From: Johan Hovold + +commit d269d4434c72ed0da3a9b1230c30da82c4918c63 upstream. + +The USB console currently allocates a temporary fake tty which is used +to pass terminal settings to the underlying serial driver. + +The tty struct is not fully initialised, something which can lead to a +lockdep warning (or worse) if a serial driver tries to acquire a +line-discipline reference: + + usbserial: USB Serial support registered for pl2303 + pl2303 1-2.1:1.0: pl2303 converter detected + usb 1-2.1: pl2303 converter now attached to ttyUSB0 + INFO: trying to register non-static key. + the code is fine but needs lockdep annotation. + turning off the locking correctness validator. + CPU: 0 PID: 68 Comm: udevd Tainted: G W 3.18.0-rc5 #10 + [] (unwind_backtrace) from [] (show_stack+0x20/0x24) + [] (show_stack) from [] (dump_stack+0x24/0x28) + [] (dump_stack) from [] (__lock_acquire+0x1e50/0x2004) + [] (__lock_acquire) from [] (lock_acquire+0xe4/0x18c) + [] (lock_acquire) from [] (ldsem_down_read_trylock+0x78/0x90) + [] (ldsem_down_read_trylock) from [] (tty_ldisc_ref+0x24/0x58) + [] (tty_ldisc_ref) from [] (usb_serial_handle_dcd_change+0x48/0xe8) + [] (usb_serial_handle_dcd_change) from [] (pl2303_read_int_callback+0x210/0x220 [pl2303]) + [] (pl2303_read_int_callback [pl2303]) from [] (__usb_hcd_giveback_urb+0x80/0x140) + [] (__usb_hcd_giveback_urb) from [] (usb_giveback_urb_bh+0x98/0xd4) + [] (usb_giveback_urb_bh) from [] (tasklet_hi_action+0x9c/0x108) + [] (tasklet_hi_action) from [] (__do_softirq+0x148/0x42c) + [] (__do_softirq) from [] (irq_exit+0xd8/0x114) + [] (irq_exit) from [] (__handle_domain_irq+0x84/0xdc) + [] (__handle_domain_irq) from [] (omap_intc_handle_irq+0xd8/0xe0) + [] (omap_intc_handle_irq) from [] (__irq_svc+0x44/0x7c) + Exception stack(0xdf4e7f08 to 0xdf4e7f50) + 7f00: debc0b80 df4e7f5c 00000000 00000000 debc0b80 be8da96c + 7f20: 00000000 00000128 c000fc84 df4e6000 00000000 df4e7f94 00000004 df4e7f50 + 7f40: c038ebc0 c038d74c 600f0013 ffffffff + [] (__irq_svc) from [] (___sys_sendmsg.part.29+0x0/0x2e0) + [] (___sys_sendmsg.part.29) from [] (SyS_sendmsg+0x18/0x1c) + [] (SyS_sendmsg) from [] (ret_fast_syscall+0x0/0x48) + console [ttyUSB0] enabled + +Fixes: 36697529b5bb ("tty: Replace ldisc locking with ldisc_sem") +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/console.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/console.c ++++ b/drivers/usb/serial/console.c +@@ -140,6 +140,7 @@ static int usb_console_setup(struct cons + tty_port_tty_set(&port->port, tty); + tty->driver = usb_serial_tty_driver; + tty->index = co->index; ++ init_ldsem(&tty->ldisc_sem); + if (tty_init_termios(tty)) { + retval = -ENOMEM; + goto free_tty; diff --git a/queue-3.14/usb-cp210x-add-ids-for-cel-usb-sticks-and-meshworks-devices.patch b/queue-3.14/usb-cp210x-add-ids-for-cel-usb-sticks-and-meshworks-devices.patch new file mode 100644 index 00000000000..eabfbc8516b --- /dev/null +++ b/queue-3.14/usb-cp210x-add-ids-for-cel-usb-sticks-and-meshworks-devices.patch @@ -0,0 +1,36 @@ +From 1ae78a4870989a354028cb17dabf819b595e70e3 Mon Sep 17 00:00:00 2001 +From: David Peterson +Date: Tue, 6 Jan 2015 15:00:52 +0000 +Subject: USB: cp210x: add IDs for CEL USB sticks and MeshWorks devices + +From: David Peterson + +commit 1ae78a4870989a354028cb17dabf819b595e70e3 upstream. + +Added virtual com port VID/PID entries for CEL USB sticks and MeshWorks +devices. + +Signed-off-by: David Peterson +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cp210x.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -120,10 +120,12 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ + { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */ + { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */ +- { USB_DEVICE(0x10C4, 0x8857) }, /* CEL MeshConnect USB Stick */ ++ { USB_DEVICE(0x10C4, 0x8856) }, /* CEL EM357 ZigBee USB Stick - LR */ ++ { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */ + { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */ + { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ + { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ ++ { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ + { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ diff --git a/queue-3.14/usb-cp210x-fix-id-for-production-cel-meshconnect-usb-stick.patch b/queue-3.14/usb-cp210x-fix-id-for-production-cel-meshconnect-usb-stick.patch new file mode 100644 index 00000000000..743bcd3f6e4 --- /dev/null +++ b/queue-3.14/usb-cp210x-fix-id-for-production-cel-meshconnect-usb-stick.patch @@ -0,0 +1,32 @@ +From 90441b4dbe90ba0c38111ea89fa093a8c9627801 Mon Sep 17 00:00:00 2001 +From: Preston Fick +Date: Sat, 27 Dec 2014 01:32:41 -0600 +Subject: USB: cp210x: fix ID for production CEL MeshConnect USB Stick + +From: Preston Fick + +commit 90441b4dbe90ba0c38111ea89fa093a8c9627801 upstream. + +Fixing typo for MeshConnect IDs. The original PID (0x8875) is not in +production and is not needed. Instead it has been changed to the +official production PID (0x8857). + +Signed-off-by: Preston Fick +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cp210x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -120,7 +120,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ + { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */ + { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */ +- { USB_DEVICE(0x10C4, 0x8875) }, /* CEL MeshConnect USB Stick */ ++ { USB_DEVICE(0x10C4, 0x8857) }, /* CEL MeshConnect USB Stick */ + { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */ + { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ + { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ diff --git a/queue-3.14/usb-dwc3-gadget-fix-trb-preparation-during-sg.patch b/queue-3.14/usb-dwc3-gadget-fix-trb-preparation-during-sg.patch new file mode 100644 index 00000000000..6bb2c9776c8 --- /dev/null +++ b/queue-3.14/usb-dwc3-gadget-fix-trb-preparation-during-sg.patch @@ -0,0 +1,44 @@ +From ec512fb8e5611fed1df2895f90317ce6797d6b32 Mon Sep 17 00:00:00 2001 +From: Amit Virdi +Date: Tue, 13 Jan 2015 14:27:20 +0530 +Subject: usb: dwc3: gadget: Fix TRB preparation during SG + +From: Amit Virdi + +commit ec512fb8e5611fed1df2895f90317ce6797d6b32 upstream. + +When scatter gather (SG) is used, multiple TRBs are prepared from one DWC3 +request (dwc3_request). So while preparing TRBs, the 'last' flag should be set +only when it is the last TRB being prepared from the last dwc3_request entry. + +The current implementation uses list_is_last to check if the dwc3_request is the +last entry from the request_list. However, list_is_last returns false for the +last entry too. This is because, while preparing the first TRB from a request, +the function dwc3_prepare_one_trb modifies the request's next and prev pointers +while moving the URB to req_queued. Hence, list_is_last always returns false no +matter what. + +The correct way is not to access the modified pointers of dwc3_request but to +use list_empty macro instead. + +Fixes: e5ba5ec833aa (usb: dwc3: gadget: fix scatter gather implementation) +Signed-off-by: Amit Virdi +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -887,8 +887,7 @@ static void dwc3_prepare_trbs(struct dwc + + if (i == (request->num_mapped_sgs - 1) || + sg_is_last(s)) { +- if (list_is_last(&req->list, +- &dep->request_list)) ++ if (list_empty(&dep->request_list)) + last_one = true; + chain = false; + } diff --git a/queue-3.14/usb-dwc3-gadget-stop-trb-preparation-after-limit-is-reached.patch b/queue-3.14/usb-dwc3-gadget-stop-trb-preparation-after-limit-is-reached.patch new file mode 100644 index 00000000000..efeb29843c5 --- /dev/null +++ b/queue-3.14/usb-dwc3-gadget-stop-trb-preparation-after-limit-is-reached.patch @@ -0,0 +1,44 @@ +From 39e60635a01520e8c8ed3946a28c2b98e6a46f79 Mon Sep 17 00:00:00 2001 +From: Amit Virdi +Date: Tue, 13 Jan 2015 14:27:21 +0530 +Subject: usb: dwc3: gadget: Stop TRB preparation after limit is reached + +From: Amit Virdi + +commit 39e60635a01520e8c8ed3946a28c2b98e6a46f79 upstream. + +DWC3 gadget sets up a pool of 32 TRBs for each EP during initialization. This +means, the max TRBs that can be submitted for an EP is fixed to 32. Since the +request queue for an EP is a linked list, any number of requests can be queued +to it by the gadget layer. However, the dwc3 driver must not submit TRBs more +than the pool it has created for. This limit wasn't respected when SG was used +resulting in submitting more than the max TRBs, eventually leading to +non-transfer of the TRBs submitted over the max limit. + +Root cause: +When SG is used, there are two loops iterating to prepare TRBs: + - Outer loop over the request_list + - Inner loop over the SG list +The code was missing break to get out of the outer loop. + +Fixes: eeb720fb21d6 (usb: dwc3: gadget: add support for SG lists) +Signed-off-by: Amit Virdi +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/gadget.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -905,6 +905,9 @@ static void dwc3_prepare_trbs(struct dwc + if (last_one) + break; + } ++ ++ if (last_one) ++ break; + } else { + dma = req->request.dma; + length = req->request.length; diff --git a/queue-3.14/usb-keyspan-fix-null-deref-at-probe.patch b/queue-3.14/usb-keyspan-fix-null-deref-at-probe.patch new file mode 100644 index 00000000000..f2d7769e233 --- /dev/null +++ b/queue-3.14/usb-keyspan-fix-null-deref-at-probe.patch @@ -0,0 +1,116 @@ +From b5122236bba8d7ef62153da5b55cc65d0944c61e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 22 Dec 2014 18:39:39 +0100 +Subject: USB: keyspan: fix null-deref at probe + +From: Johan Hovold + +commit b5122236bba8d7ef62153da5b55cc65d0944c61e upstream. + +Fix null-pointer dereference during probe if the interface-status +completion handler is called before the individual ports have been set +up. + +Fixes: f79b2d0fe81e ("USB: keyspan: fix NULL-pointer dereferences and +memory leaks") +Reported-by: Richard +Tested-by: Richard +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/keyspan.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +--- a/drivers/usb/serial/keyspan.c ++++ b/drivers/usb/serial/keyspan.c +@@ -421,6 +421,8 @@ static void usa26_instat_callback(struct + } + port = serial->port[msg->port]; + p_priv = usb_get_serial_port_data(port); ++ if (!p_priv) ++ goto resubmit; + + /* Update handshaking pin state information */ + old_dcd_state = p_priv->dcd_state; +@@ -431,7 +433,7 @@ static void usa26_instat_callback(struct + + if (old_dcd_state != p_priv->dcd_state) + tty_port_tty_hangup(&port->port, true); +- ++resubmit: + /* Resubmit urb so we continue receiving */ + err = usb_submit_urb(urb, GFP_ATOMIC); + if (err != 0) +@@ -541,6 +543,8 @@ static void usa28_instat_callback(struct + } + port = serial->port[msg->port]; + p_priv = usb_get_serial_port_data(port); ++ if (!p_priv) ++ goto resubmit; + + /* Update handshaking pin state information */ + old_dcd_state = p_priv->dcd_state; +@@ -551,7 +555,7 @@ static void usa28_instat_callback(struct + + if (old_dcd_state != p_priv->dcd_state && old_dcd_state) + tty_port_tty_hangup(&port->port, true); +- ++resubmit: + /* Resubmit urb so we continue receiving */ + err = usb_submit_urb(urb, GFP_ATOMIC); + if (err != 0) +@@ -624,6 +628,8 @@ static void usa49_instat_callback(struct + } + port = serial->port[msg->portNumber]; + p_priv = usb_get_serial_port_data(port); ++ if (!p_priv) ++ goto resubmit; + + /* Update handshaking pin state information */ + old_dcd_state = p_priv->dcd_state; +@@ -634,7 +640,7 @@ static void usa49_instat_callback(struct + + if (old_dcd_state != p_priv->dcd_state && old_dcd_state) + tty_port_tty_hangup(&port->port, true); +- ++resubmit: + /* Resubmit urb so we continue receiving */ + err = usb_submit_urb(urb, GFP_ATOMIC); + if (err != 0) +@@ -872,6 +878,8 @@ static void usa90_instat_callback(struct + + port = serial->port[0]; + p_priv = usb_get_serial_port_data(port); ++ if (!p_priv) ++ goto resubmit; + + /* Update handshaking pin state information */ + old_dcd_state = p_priv->dcd_state; +@@ -882,7 +890,7 @@ static void usa90_instat_callback(struct + + if (old_dcd_state != p_priv->dcd_state && old_dcd_state) + tty_port_tty_hangup(&port->port, true); +- ++resubmit: + /* Resubmit urb so we continue receiving */ + err = usb_submit_urb(urb, GFP_ATOMIC); + if (err != 0) +@@ -943,6 +951,8 @@ static void usa67_instat_callback(struct + + port = serial->port[msg->port]; + p_priv = usb_get_serial_port_data(port); ++ if (!p_priv) ++ goto resubmit; + + /* Update handshaking pin state information */ + old_dcd_state = p_priv->dcd_state; +@@ -951,7 +961,7 @@ static void usa67_instat_callback(struct + + if (old_dcd_state != p_priv->dcd_state && old_dcd_state) + tty_port_tty_hangup(&port->port, true); +- ++resubmit: + /* Resubmit urb so we continue receiving */ + err = usb_submit_urb(urb, GFP_ATOMIC); + if (err != 0)