USB: console: fix potential use after free
[pandora-kernel.git] / drivers / usb / serial / console.c
1 /*
2  * USB Serial Console driver
3  *
4  * Copyright (C) 2001 - 2002 Greg Kroah-Hartman (greg@kroah.com)
5  *
6  *      This program is free software; you can redistribute it and/or
7  *      modify it under the terms of the GNU General Public License version
8  *      2 as published by the Free Software Foundation.
9  *
10  * Thanks to Randy Dunlap for the original version of this code.
11  *
12  */
13
14 #include <linux/kernel.h>
15 #include <linux/init.h>
16 #include <linux/slab.h>
17 #include <linux/tty.h>
18 #include <linux/console.h>
19 #include <linux/serial.h>
20 #include <linux/usb.h>
21 #include <linux/usb/serial.h>
22
23 static int debug;
24
25 struct usbcons_info {
26         int                     magic;
27         int                     break_flag;
28         struct usb_serial_port  *port;
29 };
30
31 static struct usbcons_info usbcons_info;
32 static struct console usbcons;
33
34 /*
35  * ------------------------------------------------------------
36  * USB Serial console driver
37  *
38  * Much of the code here is copied from drivers/char/serial.c
39  * and implements a phony serial console in the same way that
40  * serial.c does so that in case some software queries it,
41  * it will get the same results.
42  *
43  * Things that are different from the way the serial port code
44  * does things, is that we call the lower level usb-serial
45  * driver code to initialize the device, and we set the initial
46  * console speeds based on the command line arguments.
47  * ------------------------------------------------------------
48  */
49
50 static const struct tty_operations usb_console_fake_tty_ops = {
51 };
52
53 /*
54  * The parsing of the command line works exactly like the
55  * serial.c code, except that the specifier is "ttyUSB" instead
56  * of "ttyS".
57  */
58 static int usb_console_setup(struct console *co, char *options)
59 {
60         struct usbcons_info *info = &usbcons_info;
61         int baud = 9600;
62         int bits = 8;
63         int parity = 'n';
64         int doflow = 0;
65         int cflag = CREAD | HUPCL | CLOCAL;
66         char *s;
67         struct usb_serial *serial;
68         struct usb_serial_port *port;
69         int retval;
70         struct tty_struct *tty = NULL;
71         struct ktermios dummy;
72
73         dbg("%s", __func__);
74
75         if (options) {
76                 baud = simple_strtoul(options, NULL, 10);
77                 s = options;
78                 while (*s >= '0' && *s <= '9')
79                         s++;
80                 if (*s)
81                         parity = *s++;
82                 if (*s)
83                         bits   = *s++ - '0';
84                 if (*s)
85                         doflow = (*s++ == 'r');
86         }
87         
88         /* Sane default */
89         if (baud == 0)
90                 baud = 9600;
91
92         switch (bits) {
93         case 7:
94                 cflag |= CS7;
95                 break;
96         default:
97         case 8:
98                 cflag |= CS8;
99                 break;
100         }
101         switch (parity) {
102         case 'o': case 'O':
103                 cflag |= PARODD;
104                 break;
105         case 'e': case 'E':
106                 cflag |= PARENB;
107                 break;
108         }
109         co->cflag = cflag;
110
111         /*
112          * no need to check the index here: if the index is wrong, console
113          * code won't call us
114          */
115         serial = usb_serial_get_by_index(co->index);
116         if (serial == NULL) {
117                 /* no device is connected yet, sorry :( */
118                 err("No USB device connected to ttyUSB%i", co->index);
119                 return -ENODEV;
120         }
121
122         retval = usb_autopm_get_interface(serial->interface);
123         if (retval)
124                 goto error_get_interface;
125
126         port = serial->port[co->index - serial->minor];
127         tty_port_tty_set(&port->port, NULL);
128
129         info->port = port;
130
131         ++port->port.count;
132         if (!test_bit(ASYNCB_INITIALIZED, &port->port.flags)) {
133                 if (serial->type->set_termios) {
134                         /*
135                          * allocate a fake tty so the driver can initialize
136                          * the termios structure, then later call set_termios to
137                          * configure according to command line arguments
138                          */
139                         tty = kzalloc(sizeof(*tty), GFP_KERNEL);
140                         if (!tty) {
141                                 retval = -ENOMEM;
142                                 err("no more memory");
143                                 goto reset_open_count;
144                         }
145                         kref_init(&tty->kref);
146                         tty->driver = usb_serial_tty_driver;
147                         tty->index = co->index;
148                         INIT_LIST_HEAD(&tty->tty_files);
149                         kref_get(&tty->driver->kref);
150                         tty->ops = &usb_console_fake_tty_ops;
151                         if (tty_init_termios(tty)) {
152                                 retval = -ENOMEM;
153                                 err("no more memory");
154                                 goto put_tty;
155                         }
156                         tty_port_tty_set(&port->port, tty);
157                 }
158
159                 /* only call the device specific open if this
160                  * is the first time the port is opened */
161                 if (serial->type->open)
162                         retval = serial->type->open(NULL, port);
163                 else
164                         retval = usb_serial_generic_open(NULL, port);
165
166                 if (retval) {
167                         err("could not open USB console port");
168                         goto fail;
169                 }
170
171                 if (serial->type->set_termios) {
172                         tty->termios->c_cflag = cflag;
173                         tty_termios_encode_baud_rate(tty->termios, baud, baud);
174                         memset(&dummy, 0, sizeof(struct ktermios));
175                         serial->type->set_termios(tty, port, &dummy);
176
177                         tty_port_tty_set(&port->port, NULL);
178                         tty_kref_put(tty);
179                 }
180                 set_bit(ASYNCB_INITIALIZED, &port->port.flags);
181         }
182         /* Now that any required fake tty operations are completed restore
183          * the tty port count */
184         --port->port.count;
185         /* The console is special in terms of closing the device so
186          * indicate this port is now acting as a system console. */
187         port->port.console = 1;
188
189         mutex_unlock(&serial->disc_mutex);
190         return retval;
191
192  fail:
193         tty_port_tty_set(&port->port, NULL);
194  put_tty:
195         tty_kref_put(tty);
196  reset_open_count:
197         port->port.count = 0;
198         usb_autopm_put_interface(serial->interface);
199  error_get_interface:
200         usb_serial_put(serial);
201         mutex_unlock(&serial->disc_mutex);
202         return retval;
203 }
204
205 static void usb_console_write(struct console *co,
206                                         const char *buf, unsigned count)
207 {
208         static struct usbcons_info *info = &usbcons_info;
209         struct usb_serial_port *port = info->port;
210         struct usb_serial *serial;
211         int retval = -ENODEV;
212
213         if (!port || port->serial->dev->state == USB_STATE_NOTATTACHED)
214                 return;
215         serial = port->serial;
216
217         if (count == 0)
218                 return;
219
220         dbg("%s - port %d, %d byte(s)", __func__, port->number, count);
221
222         if (!port->port.console) {
223                 dbg("%s - port not opened", __func__);
224                 return;
225         }
226
227         while (count) {
228                 unsigned int i;
229                 unsigned int lf;
230                 /* search for LF so we can insert CR if necessary */
231                 for (i = 0, lf = 0 ; i < count ; i++) {
232                         if (*(buf + i) == 10) {
233                                 lf = 1;
234                                 i++;
235                                 break;
236                         }
237                 }
238                 /* pass on to the driver specific version of this function if
239                    it is available */
240                 if (serial->type->write)
241                         retval = serial->type->write(NULL, port, buf, i);
242                 else
243                         retval = usb_serial_generic_write(NULL, port, buf, i);
244                 dbg("%s - return value : %d", __func__, retval);
245                 if (lf) {
246                         /* append CR after LF */
247                         unsigned char cr = 13;
248                         if (serial->type->write)
249                                 retval = serial->type->write(NULL,
250                                                                 port, &cr, 1);
251                         else
252                                 retval = usb_serial_generic_write(NULL,
253                                                                 port, &cr, 1);
254                         dbg("%s - return value : %d", __func__, retval);
255                 }
256                 buf += i;
257                 count -= i;
258         }
259 }
260
261 static struct tty_driver *usb_console_device(struct console *co, int *index)
262 {
263         struct tty_driver **p = (struct tty_driver **)co->data;
264
265         if (!*p)
266                 return NULL;
267
268         *index = co->index;
269         return *p;
270 }
271
272 static struct console usbcons = {
273         .name =         "ttyUSB",
274         .write =        usb_console_write,
275         .device =       usb_console_device,
276         .setup =        usb_console_setup,
277         .flags =        CON_PRINTBUFFER,
278         .index =        -1,
279         .data =         &usb_serial_tty_driver,
280 };
281
282 void usb_serial_console_disconnect(struct usb_serial *serial)
283 {
284         if (serial && serial->port && serial->port[0]
285                                 && serial->port[0] == usbcons_info.port) {
286                 usb_serial_console_exit();
287                 usb_serial_put(serial);
288         }
289 }
290
291 void usb_serial_console_init(int serial_debug, int minor)
292 {
293         debug = serial_debug;
294
295         if (minor == 0) {
296                 /*
297                  * Call register_console() if this is the first device plugged
298                  * in.  If we call it earlier, then the callback to
299                  * console_setup() will fail, as there is not a device seen by
300                  * the USB subsystem yet.
301                  */
302                 /*
303                  * Register console.
304                  * NOTES:
305                  * console_setup() is called (back) immediately (from
306                  * register_console). console_write() is called immediately
307                  * from register_console iff CON_PRINTBUFFER is set in flags.
308                  */
309                 dbg("registering the USB serial console.");
310                 register_console(&usbcons);
311         }
312 }
313
314 void usb_serial_console_exit(void)
315 {
316         if (usbcons_info.port) {
317                 unregister_console(&usbcons);
318                 usbcons_info.port->port.console = 0;
319                 usbcons_info.port = NULL;
320         }
321 }
322