This is a note to let you know that I've just added the patch titled
USB: fix port probing and removal in garmin_gps
to the 3.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
usb-fix-port-probing-and-removal-in-garmin_gps.patch
and it can be found in the queue-3.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From db5c8b524444d4fc6b1f32d368a50a3729e50002 Mon Sep 17 00:00:00 2001
From: Alan Stern <[email protected]>
Date: Wed, 10 Oct 2012 14:10:21 -0400
Subject: USB: fix port probing and removal in garmin_gps
From: Alan Stern <[email protected]>
commit db5c8b524444d4fc6b1f32d368a50a3729e50002 upstream.
This patch (as1615) fixes a bug in the Garmin USB serial driver. It
uses attach, disconnect, and release routines to carry out actions
that should be handled by port_probe and port_remove routines, because
they access port-specific data.
The bug causes an oops when the device in unplugged, because the
private data for each port structure now gets erased when the port is
unbound from the driver, resulting in a null-pointer dereference.
Signed-off-by: Alan Stern <[email protected]>
Reported--by: Markus Schauler <[email protected]>
Tested-by: Markus Schauler <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/usb/serial/garmin_gps.c | 24 +++++++-----------------
1 file changed, 7 insertions(+), 17 deletions(-)
--- a/drivers/usb/serial/garmin_gps.c
+++ b/drivers/usb/serial/garmin_gps.c
@@ -1414,11 +1414,10 @@ static void timeout_handler(unsigned lon
-static int garmin_attach(struct usb_serial *serial)
+static int garmin_port_probe(struct usb_serial_port *port)
{
- int status = 0;
- struct usb_serial_port *port = serial->port[0];
- struct garmin_data *garmin_data_p = NULL;
+ int status;
+ struct garmin_data *garmin_data_p;
garmin_data_p = kzalloc(sizeof(struct garmin_data), GFP_KERNEL);
if (garmin_data_p == NULL) {
@@ -1443,22 +1442,14 @@ static int garmin_attach(struct usb_seri
}
-static void garmin_disconnect(struct usb_serial *serial)
+static int garmin_port_remove(struct usb_serial_port *port)
{
- struct usb_serial_port *port = serial->port[0];
struct garmin_data *garmin_data_p = usb_get_serial_port_data(port);
usb_kill_urb(port->interrupt_in_urb);
del_timer_sync(&garmin_data_p->timer);
-}
-
-
-static void garmin_release(struct usb_serial *serial)
-{
- struct usb_serial_port *port = serial->port[0];
- struct garmin_data *garmin_data_p = usb_get_serial_port_data(port);
-
kfree(garmin_data_p);
+ return 0;
}
@@ -1475,9 +1466,8 @@ static struct usb_serial_driver garmin_d
.close = garmin_close,
.throttle = garmin_throttle,
.unthrottle = garmin_unthrottle,
- .attach = garmin_attach,
- .disconnect = garmin_disconnect,
- .release = garmin_release,
+ .port_probe = garmin_port_probe,
+ .port_remove = garmin_port_remove,
.write = garmin_write,
.write_room = garmin_write_room,
.write_bulk_callback = garmin_write_bulk_callback,
Patches currently in stable-queue which might be from [email protected]
are
queue-3.6/usb-fix-port-probing-and-removal-in-garmin_gps.patch
queue-3.6/usbdevfs-fix-broken-scatter-gather-transfer.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
