From: Olivier Sobrie Date: Fri, 30 Jan 2015 12:21:54 +0000 (+0100) Subject: hso: fix crash when device disappears while serial port is open X-Git-Tag: fixes-v4.0-rc1~150^2~91^2~9 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=29bd3bc1194c624ce863cab2a7da9bc1f0c3b47b;p=pandora-kernel.git hso: fix crash when device disappears while serial port is open When the device disappear, the function hso_disconnect() is called to perform cleanup. In the cleanup function, hso_free_interface() calls tty_port_tty_hangup() in view of scheduling a work to hang up the tty if needed. If the port was not open then hso_serial_ref_free() is called directly to cleanup everything. Otherwise, hso_serial_ref_free() is called when the last fd associated to the port is closed. For each open port, tty_release() will call the close method, hso_serial_close(), which drops the last kref and call hso_serial_ref_free() which unregisters, destroys the tty port and finally frees the structure in which the tty_port structure is included. Later, in tty_release(), more precisely when release_tty() is called, the tty_port previously freed is accessed to cancel the tty buf workqueue and it leads to a crash. In view of avoiding this crash, we add a cleanup method that is called at the end of the hangup process and we drop the last kref in this function when all the ports have been closed, when tty_port is no more needed and when it is safe to free the structure containing the tty_port structure. Signed-off-by: Olivier Sobrie Signed-off-by: David S. Miller --- Reading git-diff-tree failed