This is a note to let you know that I've just added the patch titled
USB: cp210x: fix port-data memory leak
to the 3.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-cp210x-fix-port-data-memory-leak.patch
and it can be found in the queue-3.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 4295fe7791a1b20c90cbaaa6f23f2fb94218b8a7 Mon Sep 17 00:00:00 2001
From: Johan Hovold <[email protected]>
Date: Mon, 15 Oct 2012 15:47:20 +0200
Subject: USB: cp210x: fix port-data memory leak
From: Johan Hovold <[email protected]>
commit 4295fe7791a1b20c90cbaaa6f23f2fb94218b8a7 upstream.
Fix port data memory leak by replacing port private data with serial
private data.
Since commit 0998d0631001288 (device-core: Ensure drvdata = NULL when no
driver is bound) the port private data is no longer freed at
release.
The private data is used to store the control interface number, but as
this is the same for all ports on an interface it should be stored as
usb-serial data anyway.
Signed-off-by: Johan Hovold <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/usb/serial/cp210x.c | 43 ++++++++++++++++++-------------------------
1 file changed, 18 insertions(+), 25 deletions(-)
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -164,7 +164,7 @@ static const struct usb_device_id id_tab
MODULE_DEVICE_TABLE(usb, id_table);
-struct cp210x_port_private {
+struct cp210x_serial_private {
__u8 bInterfaceNumber;
};
@@ -278,7 +278,7 @@ static int cp210x_get_config(struct usb_
unsigned int *data, int size)
{
struct usb_serial *serial = port->serial;
- struct cp210x_port_private *port_priv = usb_get_serial_port_data(port);
+ struct cp210x_serial_private *spriv = usb_get_serial_data(serial);
__le32 *buf;
int result, i, length;
@@ -294,7 +294,7 @@ static int cp210x_get_config(struct usb_
/* Issue the request, attempting to read 'size' bytes */
result = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
request, REQTYPE_INTERFACE_TO_HOST, 0x0000,
- port_priv->bInterfaceNumber, buf, size,
+ spriv->bInterfaceNumber, buf, size,
USB_CTRL_GET_TIMEOUT);
/* Convert data into an array of integers */
@@ -326,7 +326,7 @@ static int cp210x_set_config(struct usb_
unsigned int *data, int size)
{
struct usb_serial *serial = port->serial;
- struct cp210x_port_private *port_priv = usb_get_serial_port_data(port);
+ struct cp210x_serial_private *spriv = usb_get_serial_data(serial);
__le32 *buf;
int result, i, length;
@@ -348,13 +348,13 @@ static int cp210x_set_config(struct usb_
result = usb_control_msg(serial->dev,
usb_sndctrlpipe(serial->dev, 0),
request, REQTYPE_HOST_TO_INTERFACE, 0x0000,
- port_priv->bInterfaceNumber, buf, size,
+ spriv->bInterfaceNumber, buf, size,
USB_CTRL_SET_TIMEOUT);
} else {
result = usb_control_msg(serial->dev,
usb_sndctrlpipe(serial->dev, 0),
request, REQTYPE_HOST_TO_INTERFACE, data[0],
- port_priv->bInterfaceNumber, NULL, 0,
+ spriv->bInterfaceNumber, NULL, 0,
USB_CTRL_SET_TIMEOUT);
}
@@ -854,37 +854,30 @@ static void cp210x_break_ctl (struct tty
static int cp210x_startup(struct usb_serial *serial)
{
- struct cp210x_port_private *port_priv;
- int i;
+ struct usb_host_interface *cur_altsetting;
+ struct cp210x_serial_private *spriv;
/* cp210x buffers behave strangely unless device is reset */
usb_reset_device(serial->dev);
- for (i = 0; i < serial->num_ports; i++) {
- port_priv = kzalloc(sizeof(*port_priv), GFP_KERNEL);
- if (!port_priv)
- return -ENOMEM;
-
- memset(port_priv, 0x00, sizeof(*port_priv));
- port_priv->bInterfaceNumber =
- serial->interface->cur_altsetting->desc.bInterfaceNumber;
+ spriv = kzalloc(sizeof(*spriv), GFP_KERNEL);
+ if (!spriv)
+ return -ENOMEM;
- usb_set_serial_port_data(serial->port[i], port_priv);
- }
+ cur_altsetting = serial->interface->cur_altsetting;
+ spriv->bInterfaceNumber = cur_altsetting->desc.bInterfaceNumber;
+
+ usb_set_serial_data(serial, spriv);
return 0;
}
static void cp210x_release(struct usb_serial *serial)
{
- struct cp210x_port_private *port_priv;
- int i;
+ struct cp210x_serial_private *spriv;
- for (i = 0; i < serial->num_ports; i++) {
- port_priv = usb_get_serial_port_data(serial->port[i]);
- kfree(port_priv);
- usb_set_serial_port_data(serial->port[i], NULL);
- }
+ spriv = usb_get_serial_data(serial);
+ kfree(spriv);
}
module_usb_serial_driver(serial_drivers, id_table);
Patches currently in stable-queue which might be from [email protected] are
queue-3.6/usb-io_ti-fix-sysfs-attribute-creation.patch
queue-3.6/usb-kobil_sct-fix-port-data-memory-leak.patch
queue-3.6/usb-iuu_phoenix-fix-port-data-memory-leak.patch
queue-3.6/usb-spcp8x5-fix-port-data-memory-leak.patch
queue-3.6/usb-f81232-fix-port-data-memory-leak.patch
queue-3.6/usb-cypress_m8-fix-port-data-memory-leak.patch
queue-3.6/usb-io_ti-fix-port-data-memory-leak.patch
queue-3.6/usb-cyberjack-fix-port-data-memory-leak.patch
queue-3.6/usb-ark3116-fix-null-pointer-dereference.patch
queue-3.6/usb-ti_usb_3410_5052-fix-port-data-memory-leak.patch
queue-3.6/usb-pl2303-fix-port-data-memory-leak.patch
queue-3.6/usb-iuu_phoenix-fix-sysfs-attribute-creation.patch
queue-3.6/usb-kl5kusb105-fix-port-data-memory-leak.patch
queue-3.6/usb-oti6858-fix-port-data-memory-leak.patch
queue-3.6/usb-cp210x-fix-port-data-memory-leak.patch
queue-3.6/usb-belkin_sa-fix-port-data-memory-leak.patch
queue-3.6/usb-ssu100-fix-port-data-memory-leak.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
