USB: serial: io_ti: fix NULL-deref at open
[pandora-kernel.git] / drivers / usb / serial / io_ti.c
index 0aac00a..a50df9d 100644 (file)
@@ -36,6 +36,7 @@
 #include <linux/spinlock.h>
 #include <linux/mutex.h>
 #include <linux/serial.h>
+#include <linux/swab.h>
 #include <linux/kfifo.h>
 #include <linux/ioctl.h>
 #include <linux/firmware.h>
@@ -98,9 +99,6 @@ struct edgeport_port {
        int close_pending;
        int lsr_event;
        struct async_icount     icount;
-       wait_queue_head_t       delta_msr_wait; /* for handling sleeping while
-                                                  waiting for msr change to
-                                                  happen */
        struct edgeport_serial  *edge_serial;
        struct usb_serial_port  *port;
        __u8 bUartMode;         /* Port type, 0: RS232, etc. */
@@ -309,7 +307,7 @@ static int read_download_mem(struct usb_device *dev, int start_address,
 {
        int status = 0;
        __u8 read_length;
-       __be16 be_start_address;
+       u16 be_start_address;
 
        dbg("%s - @ %x for %d", __func__, start_address, length);
 
@@ -326,10 +324,14 @@ static int read_download_mem(struct usb_device *dev, int start_address,
                        dbg("%s - @ %x for %d", __func__,
                             start_address, read_length);
                }
-               be_start_address = cpu_to_be16(start_address);
+               /*
+                * NOTE: Must use swab as wIndex is sent in little-endian
+                *       byte order regardless of host byte order.
+                */
+               be_start_address = swab16((u16)start_address);
                status = ti_vread_sync(dev, UMPC_MEMORY_READ,
                                        (__u16)address_type,
-                                       (__force __u16)be_start_address,
+                                       be_start_address,
                                        buffer, read_length);
 
                if (status) {
@@ -429,7 +431,7 @@ static int write_i2c_mem(struct edgeport_serial *serial,
 {
        int status = 0;
        int write_length;
-       __be16 be_start_address;
+       u16 be_start_address;
 
        /* We can only send a maximum of 1 aligned byte page at a time */
 
@@ -445,11 +447,16 @@ static int write_i2c_mem(struct edgeport_serial *serial,
        usb_serial_debug_data(debug, &serial->serial->dev->dev,
                                                __func__, write_length, buffer);
 
-       /* Write first page */
-       be_start_address = cpu_to_be16(start_address);
+       /*
+        * Write first page.
+        *
+        * NOTE: Must use swab as wIndex is sent in little-endian byte order
+        *       regardless of host byte order.
+        */
+       be_start_address = swab16((u16)start_address);
        status = ti_vsend_sync(serial->serial->dev,
                                UMPC_MEMORY_WRITE, (__u16)address_type,
-                               (__force __u16)be_start_address,
+                               be_start_address,
                                buffer, write_length);
        if (status) {
                dbg("%s - ERROR %d", __func__, status);
@@ -473,11 +480,16 @@ static int write_i2c_mem(struct edgeport_serial *serial,
                usb_serial_debug_data(debug, &serial->serial->dev->dev,
                                        __func__, write_length, buffer);
 
-               /* Write next page */
-               be_start_address = cpu_to_be16(start_address);
+               /*
+                * Write next page.
+                *
+                * NOTE: Must use swab as wIndex is sent in little-endian byte
+                *       order regardless of host byte order.
+                */
+               be_start_address = swab16((u16)start_address);
                status = ti_vsend_sync(serial->serial->dev, UMPC_MEMORY_WRITE,
                                (__u16)address_type,
-                               (__force __u16)be_start_address,
+                               be_start_address,
                                buffer, write_length);
                if (status) {
                        dev_err(&serial->serial->dev->dev, "%s - ERROR %d\n",
@@ -558,6 +570,9 @@ static void chase_port(struct edgeport_port *port, unsigned long timeout,
        wait_queue_t wait;
        unsigned long flags;
 
+       if (!tty)
+               return;
+
        if (!timeout)
                timeout = (HZ * EDGE_CLOSING_WAIT)/100;
 
@@ -681,8 +696,8 @@ static int get_descriptor_addr(struct edgeport_serial *serial,
                if (rom_desc->Type == desc_type)
                        return start_address;
 
-               start_address = start_address + sizeof(struct ti_i2c_desc)
-                                                       + rom_desc->Size;
+               start_address = start_address + sizeof(struct ti_i2c_desc) +
+                                               le16_to_cpu(rom_desc->Size);
 
        } while ((start_address < TI_MAX_I2C_SIZE) && rom_desc->Type);
 
@@ -695,7 +710,7 @@ static int valid_csum(struct ti_i2c_desc *rom_desc, __u8 *buffer)
        __u16 i;
        __u8 cs = 0;
 
-       for (i = 0; i < rom_desc->Size; i++)
+       for (i = 0; i < le16_to_cpu(rom_desc->Size); i++)
                cs = (__u8)(cs + buffer[i]);
 
        if (cs != rom_desc->CheckSum) {
@@ -749,7 +764,7 @@ static int check_i2c_image(struct edgeport_serial *serial)
                        break;
 
                if ((start_address + sizeof(struct ti_i2c_desc) +
-                                       rom_desc->Size) > TI_MAX_I2C_SIZE) {
+                       le16_to_cpu(rom_desc->Size)) > TI_MAX_I2C_SIZE) {
                        status = -ENODEV;
                        dbg("%s - structure too big, erroring out.", __func__);
                        break;
@@ -764,7 +779,8 @@ static int check_i2c_image(struct edgeport_serial *serial)
                        /* Read the descriptor data */
                        status = read_rom(serial, start_address +
                                                sizeof(struct ti_i2c_desc),
-                                               rom_desc->Size, buffer);
+                                               le16_to_cpu(rom_desc->Size),
+                                               buffer);
                        if (status)
                                break;
 
@@ -773,7 +789,7 @@ static int check_i2c_image(struct edgeport_serial *serial)
                                break;
                }
                start_address = start_address + sizeof(struct ti_i2c_desc) +
-                                                               rom_desc->Size;
+                                               le16_to_cpu(rom_desc->Size);
 
        } while ((rom_desc->Type != I2C_DESC_TYPE_ION) &&
                                (start_address < TI_MAX_I2C_SIZE));
@@ -812,7 +828,7 @@ static int get_manuf_info(struct edgeport_serial *serial, __u8 *buffer)
 
        /* Read the descriptor data */
        status = read_rom(serial, start_address+sizeof(struct ti_i2c_desc),
-                                               rom_desc->Size, buffer);
+                                       le16_to_cpu(rom_desc->Size), buffer);
        if (status)
                goto exit;
 
@@ -907,7 +923,7 @@ static int build_i2c_fw_hdr(__u8 *header, struct device *dev)
        firmware_rec =  (struct ti_i2c_firmware_rec*)i2c_header->Data;
 
        i2c_header->Type        = I2C_DESC_TYPE_FIRMWARE_BLANK;
-       i2c_header->Size        = (__u16)buffer_size;
+       i2c_header->Size        = cpu_to_le16(buffer_size);
        i2c_header->CheckSum    = cs;
        firmware_rec->Ver_Major = OperationalMajorVersion;
        firmware_rec->Ver_Minor = OperationalMinorVersion;
@@ -1554,7 +1570,7 @@ static void handle_new_msr(struct edgeport_port *edge_port, __u8 msr)
                        icount->dcd++;
                if (msr & EDGEPORT_MSR_DELTA_RI)
                        icount->rng++;
-               wake_up_interruptible(&edge_port->delta_msr_wait);
+               wake_up_interruptible(&edge_port->port->delta_msr_wait);
        }
 
        /* Save the new modem status */
@@ -1873,7 +1889,6 @@ static int edge_open(struct tty_struct *tty, struct usb_serial_port *port)
        dev = port->serial->dev;
 
        memset(&(edge_port->icount), 0x00, sizeof(edge_port->icount));
-       init_waitqueue_head(&edge_port->delta_msr_wait);
 
        /* turn off loopback */
        status = ti_do_config(edge_port, UMPC_SET_CLR_LOOPBACK, 0);
@@ -2571,10 +2586,14 @@ static int edge_ioctl(struct tty_struct *tty,
                dbg("%s - (%d) TIOCMIWAIT", __func__, port->number);
                cprev = edge_port->icount;
                while (1) {
-                       interruptible_sleep_on(&edge_port->delta_msr_wait);
+                       interruptible_sleep_on(&port->delta_msr_wait);
                        /* see if a signal did it */
                        if (signal_pending(current))
                                return -ERESTARTSYS;
+
+                       if (port->serial->disconnected)
+                               return -EIO;
+
                        cnow = edge_port->icount;
                        if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
                            cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
@@ -2623,6 +2642,13 @@ static int edge_startup(struct usb_serial *serial)
 
        dev = serial->dev;
 
+       /* Make sure we have the required endpoints when in download mode. */
+       if (serial->interface->cur_altsetting->desc.bNumEndpoints > 1) {
+               if (serial->num_bulk_in < serial->num_ports ||
+                               serial->num_bulk_out < serial->num_ports)
+                       return -ENODEV;
+       }
+
        /* create our private serial structure */
        edge_serial = kzalloc(sizeof(struct edgeport_serial), GFP_KERNEL);
        if (edge_serial == NULL) {
@@ -2677,15 +2703,7 @@ cleanup:
 
 static void edge_disconnect(struct usb_serial *serial)
 {
-       int i;
-       struct edgeport_port *edge_port;
-
        dbg("%s", __func__);
-
-       for (i = 0; i < serial->num_ports; ++i) {
-               edge_port = usb_get_serial_port_data(serial->port[i]);
-               edge_remove_sysfs_attrs(edge_port->port);
-       }
 }
 
 static void edge_release(struct usb_serial *serial)
@@ -2764,6 +2782,7 @@ static struct usb_serial_driver edgeport_1port_device = {
        .disconnect             = edge_disconnect,
        .release                = edge_release,
        .port_probe             = edge_create_sysfs_attrs,
+       .port_remove            = edge_remove_sysfs_attrs,
        .ioctl                  = edge_ioctl,
        .set_termios            = edge_set_termios,
        .tiocmget               = edge_tiocmget,
@@ -2795,10 +2814,12 @@ static struct usb_serial_driver edgeport_2port_device = {
        .disconnect             = edge_disconnect,
        .release                = edge_release,
        .port_probe             = edge_create_sysfs_attrs,
+       .port_remove            = edge_remove_sysfs_attrs,
        .ioctl                  = edge_ioctl,
        .set_termios            = edge_set_termios,
        .tiocmget               = edge_tiocmget,
        .tiocmset               = edge_tiocmset,
+       .get_icount             = edge_get_icount,
        .write                  = edge_write,
        .write_room             = edge_write_room,
        .chars_in_buffer        = edge_chars_in_buffer,