From 960fbd1ca584a5b4cd818255769769d42bfc6dbe Mon Sep 17 00:00:00 2001 From: Johan Hovold Date: Thu, 7 Nov 2019 14:28:56 +0100 Subject: [PATCH] USB: serial: mos7840: fix probe error handling The driver would return success and leave the port structures half-initialised if any of the register accesses during probe fails. This would specifically leave the port control urb unallocated, something which could trigger a NULL pointer dereference on interrupt events. Fortunately the interrupt implementation is completely broken and has never even been enabled... Note that the zero-length-enable register write used to set the zle-flag for all ports is moved to attach. Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold --- drivers/usb/serial/mos7840.c | 48 +++++++++++++++++++++--------------- 1 file changed, 28 insertions(+), 20 deletions(-) diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c index 6de41a3c2dab..ddd8db3be110 100644 --- a/drivers/usb/serial/mos7840.c +++ b/drivers/usb/serial/mos7840.c @@ -2066,6 +2066,23 @@ static int mos7840_calc_num_ports(struct usb_serial *serial, return num_ports; } +static int mos7840_attach(struct usb_serial *serial) +{ + struct device *dev = &serial->interface->dev; + int status; + u16 val; + + /* Zero Length flag enable */ + val = 0x0f; + status = mos7840_set_reg_sync(serial->port[0], ZLP_REG5, val); + if (status < 0) + dev_dbg(dev, "Writing ZLP_REG5 failed status-0x%x\n", status); + else + dev_dbg(dev, "ZLP_REG5 Writing success status%d\n", status); + + return status; +} + static int mos7840_port_probe(struct usb_serial_port *port) { struct usb_serial *serial = port->serial; @@ -2123,7 +2140,7 @@ static int mos7840_port_probe(struct usb_serial_port *port) mos7840_port->ControlRegOffset, &Data); if (status < 0) { dev_dbg(&port->dev, "Reading ControlReg failed status-0x%x\n", status); - goto out; + goto error; } else dev_dbg(&port->dev, "ControlReg Reading success val is %x, status%d\n", Data, status); Data |= 0x08; /* setting driver done bit */ @@ -2135,7 +2152,7 @@ static int mos7840_port_probe(struct usb_serial_port *port) mos7840_port->ControlRegOffset, Data); if (status < 0) { dev_dbg(&port->dev, "Writing ControlReg failed(rx_disable) status-0x%x\n", status); - goto out; + goto error; } else dev_dbg(&port->dev, "ControlReg Writing success(rx_disable) status%d\n", status); @@ -2146,7 +2163,7 @@ static int mos7840_port_probe(struct usb_serial_port *port) (__u16) (mos7840_port->DcrRegOffset + 0), Data); if (status < 0) { dev_dbg(&port->dev, "Writing DCR0 failed status-0x%x\n", status); - goto out; + goto error; } else dev_dbg(&port->dev, "DCR0 Writing success status%d\n", status); @@ -2155,7 +2172,7 @@ static int mos7840_port_probe(struct usb_serial_port *port) (__u16) (mos7840_port->DcrRegOffset + 1), Data); if (status < 0) { dev_dbg(&port->dev, "Writing DCR1 failed status-0x%x\n", status); - goto out; + goto error; } else dev_dbg(&port->dev, "DCR1 Writing success status%d\n", status); @@ -2164,7 +2181,7 @@ static int mos7840_port_probe(struct usb_serial_port *port) (__u16) (mos7840_port->DcrRegOffset + 2), Data); if (status < 0) { dev_dbg(&port->dev, "Writing DCR2 failed status-0x%x\n", status); - goto out; + goto error; } else dev_dbg(&port->dev, "DCR2 Writing success status%d\n", status); @@ -2173,7 +2190,7 @@ static int mos7840_port_probe(struct usb_serial_port *port) status = mos7840_set_reg_sync(port, CLK_START_VALUE_REGISTER, Data); if (status < 0) { dev_dbg(&port->dev, "Writing CLK_START_VALUE_REGISTER failed status-0x%x\n", status); - goto out; + goto error; } else dev_dbg(&port->dev, "CLK_START_VALUE_REGISTER Writing success status%d\n", status); @@ -2190,7 +2207,7 @@ static int mos7840_port_probe(struct usb_serial_port *port) status = mos7840_set_uart_reg(port, SCRATCH_PAD_REGISTER, Data); if (status < 0) { dev_dbg(&port->dev, "Writing SCRATCH_PAD_REGISTER failed status-0x%x\n", status); - goto out; + goto error; } else dev_dbg(&port->dev, "SCRATCH_PAD_REGISTER Writing success status%d\n", status); @@ -2204,7 +2221,7 @@ static int mos7840_port_probe(struct usb_serial_port *port) (__u16)(ZLP_REG1 + ((__u16) mos7840_port->port_num))); if (status < 0) { dev_dbg(&port->dev, "Writing ZLP_REG%d failed status-0x%x\n", pnum + 2, status); - goto out; + goto error; } else dev_dbg(&port->dev, "ZLP_REG%d Writing success status%d\n", pnum + 2, status); } else { @@ -2216,7 +2233,7 @@ static int mos7840_port_probe(struct usb_serial_port *port) (__u16)(ZLP_REG1 + ((__u16) mos7840_port->port_num) - 0x1)); if (status < 0) { dev_dbg(&port->dev, "Writing ZLP_REG%d failed status-0x%x\n", pnum + 1, status); - goto out; + goto error; } else dev_dbg(&port->dev, "ZLP_REG%d Writing success status%d\n", pnum + 1, status); @@ -2254,17 +2271,7 @@ static int mos7840_port_probe(struct usb_serial_port *port) /* Turn off LED */ mos7840_set_led_sync(port, MODEM_CONTROL_REGISTER, 0x0300); } -out: - if (pnum == serial->num_ports - 1) { - /* Zero Length flag enable */ - Data = 0x0f; - status = mos7840_set_reg_sync(serial->port[0], ZLP_REG5, Data); - if (status < 0) { - dev_dbg(&port->dev, "Writing ZLP_REG5 failed status-0x%x\n", status); - goto error; - } else - dev_dbg(&port->dev, "ZLP_REG5 Writing success status%d\n", status); - } + return 0; error: kfree(mos7840_port->led_dr); @@ -2320,6 +2327,7 @@ static struct usb_serial_driver moschip7840_4port_device = { .unthrottle = mos7840_unthrottle, .calc_num_ports = mos7840_calc_num_ports, .probe = mos7840_probe, + .attach = mos7840_attach, .ioctl = mos7840_ioctl, .get_serial = mos7840_get_serial_info, .set_termios = mos7840_set_termios, -- 2.45.2