USB: serial: mos7840: fix probe error handling

The driver would return success and leave the port structures
half-initialised if any of the register accesses during probe fails.

This would specifically leave the port control urb unallocated,
something which could trigger a NULL pointer dereference on interrupt
events.

Fortunately the interrupt implementation is completely broken and has
never even been enabled...

Note that the zero-length-enable register write used to set the zle-flag
for all ports is moved to attach.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>

diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 6de41a3c2dab1afa3a18a1ff9c77625da3a070ca..ddd8db3be1102903882a81a006fcca3db0b3004e 100644 (file)
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -2066,6 +2066,23 @@ static int mos7840_calc_num_ports(struct usb_serial *serial,
        return num_ports;
 }
 
+static int mos7840_attach(struct usb_serial *serial)
+{
+       struct device *dev = &serial->interface->dev;
+       int status;
+       u16 val;
+
+       /* Zero Length flag enable */
+       val = 0x0f;
+       status = mos7840_set_reg_sync(serial->port[0], ZLP_REG5, val);
+       if (status < 0)
+               dev_dbg(dev, "Writing ZLP_REG5 failed status-0x%x\n", status);
+       else
+               dev_dbg(dev, "ZLP_REG5 Writing success status%d\n", status);
+
+       return status;
+}
+
 static int mos7840_port_probe(struct usb_serial_port *port)
 {
        struct usb_serial *serial = port->serial;
@@ -2123,7 +2140,7 @@ static int mos7840_port_probe(struct usb_serial_port *port)
                        mos7840_port->ControlRegOffset, &Data);
        if (status < 0) {
                dev_dbg(&port->dev, "Reading ControlReg failed status-0x%x\n", status);
-               goto out;
+               goto error;
        } else
                dev_dbg(&port->dev, "ControlReg Reading success val is %x, status%d\n", Data, status);
        Data |= 0x08;   /* setting driver done bit */
@@ -2135,7 +2152,7 @@ static int mos7840_port_probe(struct usb_serial_port *port)
                        mos7840_port->ControlRegOffset, Data);
        if (status < 0) {
                dev_dbg(&port->dev, "Writing ControlReg failed(rx_disable) status-0x%x\n", status);
-               goto out;
+               goto error;
        } else
                dev_dbg(&port->dev, "ControlReg Writing success(rx_disable) status%d\n", status);
 
@@ -2146,7 +2163,7 @@ static int mos7840_port_probe(struct usb_serial_port *port)
                        (__u16) (mos7840_port->DcrRegOffset + 0), Data);
        if (status < 0) {
                dev_dbg(&port->dev, "Writing DCR0 failed status-0x%x\n", status);
-               goto out;
+               goto error;
        } else
                dev_dbg(&port->dev, "DCR0 Writing success status%d\n", status);
 
@@ -2155,7 +2172,7 @@ static int mos7840_port_probe(struct usb_serial_port *port)
                        (__u16) (mos7840_port->DcrRegOffset + 1), Data);
        if (status < 0) {
                dev_dbg(&port->dev, "Writing DCR1 failed status-0x%x\n", status);
-               goto out;
+               goto error;
        } else
                dev_dbg(&port->dev, "DCR1 Writing success status%d\n", status);
 
@@ -2164,7 +2181,7 @@ static int mos7840_port_probe(struct usb_serial_port *port)
                        (__u16) (mos7840_port->DcrRegOffset + 2), Data);
        if (status < 0) {
                dev_dbg(&port->dev, "Writing DCR2 failed status-0x%x\n", status);
-               goto out;
+               goto error;
        } else
                dev_dbg(&port->dev, "DCR2 Writing success status%d\n", status);
 
@@ -2173,7 +2190,7 @@ static int mos7840_port_probe(struct usb_serial_port *port)
        status = mos7840_set_reg_sync(port, CLK_START_VALUE_REGISTER, Data);
        if (status < 0) {
                dev_dbg(&port->dev, "Writing CLK_START_VALUE_REGISTER failed status-0x%x\n", status);
-               goto out;
+               goto error;
        } else
                dev_dbg(&port->dev, "CLK_START_VALUE_REGISTER Writing success status%d\n", status);
 
@@ -2190,7 +2207,7 @@ static int mos7840_port_probe(struct usb_serial_port *port)
        status = mos7840_set_uart_reg(port, SCRATCH_PAD_REGISTER, Data);
        if (status < 0) {
                dev_dbg(&port->dev, "Writing SCRATCH_PAD_REGISTER failed status-0x%x\n", status);
-               goto out;
+               goto error;
        } else
                dev_dbg(&port->dev, "SCRATCH_PAD_REGISTER Writing success status%d\n", status);
 
@@ -2204,7 +2221,7 @@ static int mos7840_port_probe(struct usb_serial_port *port)
                                (__u16)(ZLP_REG1 + ((__u16) mos7840_port->port_num)));
                if (status < 0) {
                        dev_dbg(&port->dev, "Writing ZLP_REG%d failed status-0x%x\n", pnum + 2, status);
-                       goto out;
+                       goto error;
                } else
                        dev_dbg(&port->dev, "ZLP_REG%d Writing success status%d\n", pnum + 2, status);
        } else {
@@ -2216,7 +2233,7 @@ static int mos7840_port_probe(struct usb_serial_port *port)
                                (__u16)(ZLP_REG1 + ((__u16) mos7840_port->port_num) - 0x1));
                if (status < 0) {
                        dev_dbg(&port->dev, "Writing ZLP_REG%d failed status-0x%x\n", pnum + 1, status);
-                       goto out;
+                       goto error;
                } else
                        dev_dbg(&port->dev, "ZLP_REG%d Writing success status%d\n", pnum + 1, status);
 
@@ -2254,17 +2271,7 @@ static int mos7840_port_probe(struct usb_serial_port *port)
                /* Turn off LED */
                mos7840_set_led_sync(port, MODEM_CONTROL_REGISTER, 0x0300);
        }
-out:
-       if (pnum == serial->num_ports - 1) {
-               /* Zero Length flag enable */
-               Data = 0x0f;
-               status = mos7840_set_reg_sync(serial->port[0], ZLP_REG5, Data);
-               if (status < 0) {
-                       dev_dbg(&port->dev, "Writing ZLP_REG5 failed status-0x%x\n", status);
-                       goto error;
-               } else
-                       dev_dbg(&port->dev, "ZLP_REG5 Writing success status%d\n", status);
-       }
+
        return 0;
 error:
        kfree(mos7840_port->led_dr);
@@ -2320,6 +2327,7 @@ static struct usb_serial_driver moschip7840_4port_device = {
        .unthrottle = mos7840_unthrottle,
        .calc_num_ports = mos7840_calc_num_ports,
        .probe = mos7840_probe,
+       .attach = mos7840_attach,
        .ioctl = mos7840_ioctl,
        .get_serial = mos7840_get_serial_info,
        .set_termios = mos7840_set_termios,