Avoid usb reset crashes by making tty_io cdevs truly dynamic

Avoid usb reset crashes by making tty_io cdevs truly dynamic

Signed-off-by: Richard Watts <rrw@kynesim.co.uk>
Reported-by: Duncan Mackintosh <DMackintosh@cbnl.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index c37a215177c098cfb2d9b3235a0e5ad24aa56ab9..02785d844354be01b9774ad10e70ab398297c6da 100644 (file)
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -3152,9 +3152,12 @@ static int tty_cdev_add(struct tty_driver *driver, dev_t dev,
                unsigned int index, unsigned int count)
 {
        /* init here, since reused cdevs cause crashes */
-       cdev_init(&driver->cdevs[index], &tty_fops);
-       driver->cdevs[index].owner = driver->owner;
-       return cdev_add(&driver->cdevs[index], dev, count);
+       driver->cdevs[index] = cdev_alloc();
+       if (!driver->cdevs[index])
+               return -ENOMEM;
+       cdev_init(driver->cdevs[index], &tty_fops);
+       driver->cdevs[index]->owner = driver->owner;
+       return cdev_add(driver->cdevs[index], dev, count);
 }
 
 /**
@@ -3260,8 +3263,10 @@ struct device *tty_register_device_attr(struct tty_driver *driver,
 
 error:
        put_device(dev);
-       if (cdev)
-               cdev_del(&driver->cdevs[index]);
+       if (cdev) {
+               cdev_del(driver->cdevs[index]);
+               driver->cdevs[index] = NULL;
+       }
        return ERR_PTR(retval);
 }
 EXPORT_SYMBOL_GPL(tty_register_device_attr);
@@ -3281,8 +3286,10 @@ void tty_unregister_device(struct tty_driver *driver, unsigned index)
 {
        device_destroy(tty_class,
                MKDEV(driver->major, driver->minor_start) + index);
-       if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC))
-               cdev_del(&driver->cdevs[index]);
+       if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
+               cdev_del(driver->cdevs[index]);
+               driver->cdevs[index] = NULL;
+       }
 }
 EXPORT_SYMBOL(tty_unregister_device);
 
@@ -3347,6 +3354,7 @@ err_free_all:
        kfree(driver->ports);
        kfree(driver->ttys);
        kfree(driver->termios);
+       kfree(driver->cdevs);
        kfree(driver);
        return ERR_PTR(err);
 }
@@ -3375,7 +3383,7 @@ static void destruct_tty_driver(struct kref *kref)
                }
                proc_tty_unregister_driver(driver);
                if (driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)
-                       cdev_del(&driver->cdevs[0]);
+                       cdev_del(driver->cdevs[0]);
        }
        kfree(driver->cdevs);
        kfree(driver->ports);

diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h
index 92e337c18839b0df2e9c213fd0604983dfcdaefd..161052477f77009e59744339ac5377e4a9b03356 100644 (file)
--- a/include/linux/tty_driver.h
+++ b/include/linux/tty_driver.h
@@ -296,7 +296,7 @@ struct tty_operations {
 struct tty_driver {
        int     magic;          /* magic number for this structure */
        struct kref kref;       /* Reference management */
-       struct cdev *cdevs;
+       struct cdev **cdevs;
        struct module   *owner;
        const char      *driver_name;
        const char      *name;