USB: serial: mos7840: fix another NULL-deref at open
[pandora-kernel.git] / drivers / usb / serial / mos7840.c
index c72abd5..c868953 100644 (file)
 
 #define CLK_MULTI_REGISTER         ((__u16)(0x02))
 #define CLK_START_VALUE_REGISTER   ((__u16)(0x03))
+#define GPIO_REGISTER              ((__u16)(0x07))
 
 #define SERIAL_LCR_DLAB            ((__u16)(0x0080))
 
 #define URB_TRANSFER_BUFFER_SIZE        32     /* URB Size  */
 
 
+enum mos7840_flag {
+       MOS7840_FLAG_CTRL_BUSY,
+};
+
 static const struct usb_device_id moschip_port_id_table[] = {
        {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7840)},
        {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7820)},
@@ -234,14 +239,11 @@ struct moschip_port {
        int port_num;           /*Actual port number in the device(1,2,etc) */
        struct urb *write_urb;  /* write URB for this port */
        struct urb *read_urb;   /* read URB for this port */
-       struct urb *int_urb;
        __u8 shadowLCR;         /* last LCR value received */
        __u8 shadowMCR;         /* last MCR value received */
        char open;
        char open_ports;
-       char zombie;
        wait_queue_head_t wait_chase;   /* for handling sleeping while waiting for chase to finish */
-       wait_queue_head_t delta_msr_wait;       /* for handling sleeping while waiting for msr change to happen */
        int delta_msr_cond;
        struct async_icount icount;
        struct usb_serial_port *port;   /* loop back to the owner of this object */
@@ -260,6 +262,8 @@ struct moschip_port {
        struct urb *write_urb_pool[NUM_URBS];
        char busy[NUM_URBS];
        bool read_urb_busy;
+
+       unsigned long flags;
 };
 
 
@@ -454,6 +458,9 @@ static void mos7840_handle_new_msr(struct moschip_port *port, __u8 new_msr)
                        icount->rng++;
                        smp_wmb();
                }
+
+               mos7840_port->delta_msr_cond = 1;
+               wake_up_interruptible(&port->port->delta_msr_wait);
        }
 }
 
@@ -504,7 +511,6 @@ static void mos7840_control_callback(struct urb *urb)
        unsigned char *data;
        struct moschip_port *mos7840_port;
        __u8 regval = 0x0;
-       int result = 0;
        int status = urb->status;
 
        mos7840_port = urb->context;
@@ -519,11 +525,11 @@ static void mos7840_control_callback(struct urb *urb)
                /* this urb is terminated, clean up */
                dbg("%s - urb shutting down with status: %d", __func__,
                    status);
-               return;
+               goto out;
        default:
                dbg("%s - nonzero urb status received: %d", __func__,
                    status);
-               goto exit;
+               goto out;
        }
 
        dbg("%s urb buffer size is %d", __func__, urb->actual_length);
@@ -536,17 +542,8 @@ static void mos7840_control_callback(struct urb *urb)
                mos7840_handle_new_msr(mos7840_port, regval);
        else if (mos7840_port->MsrLsr == 1)
                mos7840_handle_new_lsr(mos7840_port, regval);
-
-exit:
-       spin_lock(&mos7840_port->pool_lock);
-       if (!mos7840_port->zombie)
-               result = usb_submit_urb(mos7840_port->int_urb, GFP_ATOMIC);
-       spin_unlock(&mos7840_port->pool_lock);
-       if (result) {
-               dev_err(&urb->dev->dev,
-                       "%s - Error %d submitting interrupt urb\n",
-                       __func__, result);
-       }
+out:
+       clear_bit_unlock(MOS7840_FLAG_CTRL_BUSY, &mos7840_port->flags);
 }
 
 static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
@@ -557,6 +554,9 @@ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
        unsigned char *buffer = mcs->ctrl_buf;
        int ret;
 
+       if (test_and_set_bit_lock(MOS7840_FLAG_CTRL_BUSY, &mcs->flags))
+               return -EBUSY;
+
        dr->bRequestType = MCS_RD_RTYPE;
        dr->bRequest = MCS_RDREQ;
        dr->wValue = cpu_to_le16(Wval); /* 0 */
@@ -568,6 +568,9 @@ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
                             mos7840_control_callback, mcs);
        mcs->control_urb->transfer_buffer_length = 2;
        ret = usb_submit_urb(mcs->control_urb, GFP_ATOMIC);
+       if (ret)
+               clear_bit_unlock(MOS7840_FLAG_CTRL_BUSY, &mcs->flags);
+
        return ret;
 }
 
@@ -654,14 +657,7 @@ static void mos7840_interrupt_callback(struct urb *urb)
                                        wreg = MODEM_STATUS_REGISTER;
                                        break;
                                }
-                               spin_lock(&mos7840_port->pool_lock);
-                               if (!mos7840_port->zombie) {
-                                       rv = mos7840_get_reg(mos7840_port, wval, wreg, &Data);
-                               } else {
-                                       spin_unlock(&mos7840_port->pool_lock);
-                                       return;
-                               }
-                               spin_unlock(&mos7840_port->pool_lock);
+                               rv = mos7840_get_reg(mos7840_port, wval, wreg, &Data);
                        }
                }
        }
@@ -943,20 +939,20 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
        status = mos7840_get_reg_sync(port, mos7840_port->SpRegOffset, &Data);
        if (status < 0) {
                dbg("Reading Spreg failed");
-               return -1;
+               goto err;
        }
        Data |= 0x80;
        status = mos7840_set_reg_sync(port, mos7840_port->SpRegOffset, Data);
        if (status < 0) {
                dbg("writing Spreg failed");
-               return -1;
+               goto err;
        }
 
        Data &= ~0x80;
        status = mos7840_set_reg_sync(port, mos7840_port->SpRegOffset, Data);
        if (status < 0) {
                dbg("writing Spreg failed");
-               return -1;
+               goto err;
        }
        /* End of block to be checked */
 
@@ -965,7 +961,7 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
                                                                        &Data);
        if (status < 0) {
                dbg("Reading Controlreg failed");
-               return -1;
+               goto err;
        }
        Data |= 0x08;           /* Driver done bit */
        Data |= 0x20;           /* rx_disable */
@@ -973,7 +969,7 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
                                mos7840_port->ControlRegOffset, Data);
        if (status < 0) {
                dbg("writing Controlreg failed");
-               return -1;
+               goto err;
        }
        /* do register settings here */
        /* Set all regs to the device default values. */
@@ -984,21 +980,21 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
        status = mos7840_set_uart_reg(port, INTERRUPT_ENABLE_REGISTER, Data);
        if (status < 0) {
                dbg("disabling interrupts failed");
-               return -1;
+               goto err;
        }
        /* Set FIFO_CONTROL_REGISTER to the default value */
        Data = 0x00;
        status = mos7840_set_uart_reg(port, FIFO_CONTROL_REGISTER, Data);
        if (status < 0) {
                dbg("Writing FIFO_CONTROL_REGISTER  failed");
-               return -1;
+               goto err;
        }
 
        Data = 0xcf;
        status = mos7840_set_uart_reg(port, FIFO_CONTROL_REGISTER, Data);
        if (status < 0) {
                dbg("Writing FIFO_CONTROL_REGISTER  failed");
-               return -1;
+               goto err;
        }
 
        Data = 0x03;
@@ -1062,6 +1058,7 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
         * (can't set it up in mos7840_startup as the structures *
         * were not set up at that time.)                        */
        if (port0->open_ports == 1) {
+               /* FIXME: Buffer never NULL, so URB is not submitted. */
                if (serial->port[0]->interrupt_in_buffer == NULL) {
                        /* set up interrupt urb */
                        usb_fill_int_urb(serial->port[0]->interrupt_in_urb,
@@ -1075,9 +1072,7 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
                                serial,
                                serial->port[0]->interrupt_in_urb->interval);
 
-                       /* start interrupt read for mos7840               *
-                        * will continue as long as mos7840 is connected  */
-
+                       /* start interrupt read for mos7840 */
                        response =
                            usb_submit_urb(serial->port[0]->interrupt_in_urb,
                                           GFP_KERNEL);
@@ -1103,14 +1098,25 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
        mos7840_port->read_urb = port->read_urb;
 
        /* set up our bulk in urb */
-
-       usb_fill_bulk_urb(mos7840_port->read_urb,
-                         serial->dev,
-                         usb_rcvbulkpipe(serial->dev,
-                                         port->bulk_in_endpointAddress),
-                         port->bulk_in_buffer,
-                         mos7840_port->read_urb->transfer_buffer_length,
-                         mos7840_bulk_in_callback, mos7840_port);
+       if ((serial->num_ports == 2)
+               && ((((__u16)port->number -
+                       (__u16)(port->serial->minor)) % 2) != 0)) {
+               usb_fill_bulk_urb(mos7840_port->read_urb,
+                       serial->dev,
+                       usb_rcvbulkpipe(serial->dev,
+                               (port->bulk_in_endpointAddress) + 2),
+                       port->bulk_in_buffer,
+                       mos7840_port->read_urb->transfer_buffer_length,
+                       mos7840_bulk_in_callback, mos7840_port);
+       } else {
+               usb_fill_bulk_urb(mos7840_port->read_urb,
+                       serial->dev,
+                       usb_rcvbulkpipe(serial->dev,
+                               port->bulk_in_endpointAddress),
+                       port->bulk_in_buffer,
+                       mos7840_port->read_urb->transfer_buffer_length,
+                       mos7840_bulk_in_callback, mos7840_port);
+       }
 
        dbg("mos7840_open: bulkin endpoint is %d",
            port->bulk_in_endpointAddress);
@@ -1124,7 +1130,6 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
 
        /* initialize our wait queues */
        init_waitqueue_head(&mos7840_port->wait_chase);
-       init_waitqueue_head(&mos7840_port->delta_msr_wait);
 
        /* initialize our icount structure */
        memset(&(mos7840_port->icount), 0x00, sizeof(mos7840_port->icount));
@@ -1144,7 +1149,15 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
        dbg ("%s leave", __func__);
 
        return 0;
-
+err:
+       for (j = 0; j < NUM_URBS; ++j) {
+               urb = mos7840_port->write_urb_pool[j];
+               if (!urb)
+                       continue;
+               kfree(urb->transfer_buffer);
+               usb_free_urb(urb);
+       }
+       return status;
 }
 
 /*****************************************************************************
@@ -1179,9 +1192,12 @@ static int mos7840_chars_in_buffer(struct tty_struct *tty)
        }
 
        spin_lock_irqsave(&mos7840_port->pool_lock, flags);
-       for (i = 0; i < NUM_URBS; ++i)
-               if (mos7840_port->busy[i])
-                       chars += URB_TRANSFER_BUFFER_SIZE;
+       for (i = 0; i < NUM_URBS; ++i) {
+               if (mos7840_port->busy[i]) {
+                       struct urb *urb = mos7840_port->write_urb_pool[i];
+                       chars += urb->transfer_buffer_length;
+               }
+       }
        spin_unlock_irqrestore(&mos7840_port->pool_lock, flags);
        dbg("%s - returns %d", __func__, chars);
        return chars;
@@ -1507,8 +1523,8 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port,
        }
 
        if (urb->transfer_buffer == NULL) {
-               urb->transfer_buffer =
-                   kmalloc(URB_TRANSFER_BUFFER_SIZE, GFP_KERNEL);
+               urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
+                                              GFP_ATOMIC);
 
                if (urb->transfer_buffer == NULL) {
                        dev_err(&port->dev, "%s no more kernel memory...\n",
@@ -1521,13 +1537,25 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port,
        memcpy(urb->transfer_buffer, current_position, transfer_size);
 
        /* fill urb with data and submit  */
-       usb_fill_bulk_urb(urb,
-                         serial->dev,
-                         usb_sndbulkpipe(serial->dev,
-                                         port->bulk_out_endpointAddress),
-                         urb->transfer_buffer,
-                         transfer_size,
-                         mos7840_bulk_out_data_callback, mos7840_port);
+       if ((serial->num_ports == 2)
+               && ((((__u16)port->number -
+                       (__u16)(port->serial->minor)) % 2) != 0)) {
+               usb_fill_bulk_urb(urb,
+                       serial->dev,
+                       usb_sndbulkpipe(serial->dev,
+                               (port->bulk_out_endpointAddress) + 2),
+                       urb->transfer_buffer,
+                       transfer_size,
+                       mos7840_bulk_out_data_callback, mos7840_port);
+       } else {
+               usb_fill_bulk_urb(urb,
+                       serial->dev,
+                       usb_sndbulkpipe(serial->dev,
+                               port->bulk_out_endpointAddress),
+                       urb->transfer_buffer,
+                       transfer_size,
+                       mos7840_bulk_out_data_callback, mos7840_port);
+       }
 
        data1 = urb->transfer_buffer;
        dbg("bulkout endpoint is %d", port->bulk_out_endpointAddress);
@@ -1660,7 +1688,11 @@ static int mos7840_tiocmget(struct tty_struct *tty)
                return -ENODEV;
 
        status = mos7840_get_uart_reg(port, MODEM_STATUS_REGISTER, &msr);
+       if (status != 1)
+               return -EIO;
        status = mos7840_get_uart_reg(port, MODEM_CONTROL_REGISTER, &mcr);
+       if (status != 1)
+               return -EIO;
        result = ((mcr & MCR_DTR) ? TIOCM_DTR : 0)
            | ((mcr & MCR_RTS) ? TIOCM_RTS : 0)
            | ((mcr & MCR_LOOPBACK) ? TIOCM_LOOP : 0)
@@ -1840,7 +1872,7 @@ static int mos7840_send_cmd_write_baud_rate(struct moschip_port *mos7840_port,
 
        } else {
 #ifdef HW_flow_control
-               / *setting h/w flow control bit to 0 */
+               /setting h/w flow control bit to 0 */
                Data = 0xb;
                mos7840_port->shadowMCR = Data;
                status = mos7840_set_uart_reg(port, MODEM_CONTROL_REGISTER,
@@ -1954,25 +1986,25 @@ static void mos7840_change_port_settings(struct tty_struct *tty,
        iflag = tty->termios->c_iflag;
 
        /* Change the number of bits */
-       if (cflag & CSIZE) {
-               switch (cflag & CSIZE) {
-               case CS5:
-                       lData = LCR_BITS_5;
-                       break;
+       switch (cflag & CSIZE) {
+       case CS5:
+               lData = LCR_BITS_5;
+               break;
 
-               case CS6:
-                       lData = LCR_BITS_6;
-                       break;
+       case CS6:
+               lData = LCR_BITS_6;
+               break;
 
-               case CS7:
-                       lData = LCR_BITS_7;
-                       break;
-               default:
-               case CS8:
-                       lData = LCR_BITS_8;
-                       break;
-               }
+       case CS7:
+               lData = LCR_BITS_7;
+               break;
+
+       default:
+       case CS8:
+               lData = LCR_BITS_8;
+               break;
        }
+
        /* Change the Parity bit */
        if (cflag & PARENB) {
                if (cflag & PARODD) {
@@ -2067,8 +2099,6 @@ static void mos7840_change_port_settings(struct tty_struct *tty,
                        mos7840_port->read_urb_busy = false;
                }
        }
-       wake_up(&mos7840_port->delta_msr_wait);
-       mos7840_port->delta_msr_cond = 1;
        dbg("mos7840_change_port_settings mos7840_port->shadowLCR is End %x",
            mos7840_port->shadowLCR);
 }
@@ -2278,13 +2308,18 @@ static int mos7840_ioctl(struct tty_struct *tty,
                while (1) {
                        /* interruptible_sleep_on(&mos7840_port->delta_msr_wait); */
                        mos7840_port->delta_msr_cond = 0;
-                       wait_event_interruptible(mos7840_port->delta_msr_wait,
-                                                (mos7840_port->
+                       wait_event_interruptible(port->delta_msr_wait,
+                                                (port->serial->disconnected ||
+                                                 mos7840_port->
                                                  delta_msr_cond == 1));
 
                        /* see if a signal did it */
                        if (signal_pending(current))
                                return -ERESTARTSYS;
+
+                       if (port->serial->disconnected)
+                               return -EIO;
+
                        cnow = mos7840_port->icount;
                        smp_rmb();
                        if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
@@ -2309,19 +2344,26 @@ static int mos7840_ioctl(struct tty_struct *tty,
 
 static int mos7840_calc_num_ports(struct usb_serial *serial)
 {
-       int mos7840_num_ports = 0;
-
-       dbg("numberofendpoints: cur %d, alt %d",
-           (int)serial->interface->cur_altsetting->desc.bNumEndpoints,
-           (int)serial->interface->altsetting->desc.bNumEndpoints);
-       if (serial->interface->cur_altsetting->desc.bNumEndpoints == 5) {
-               mos7840_num_ports = serial->num_ports = 2;
-       } else if (serial->interface->cur_altsetting->desc.bNumEndpoints == 9) {
+       __u16 Data = 0x00;
+       int ret = 0;
+       int mos7840_num_ports;
+
+       ret = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
+               MCS_RDREQ, MCS_RD_RTYPE, 0, GPIO_REGISTER, &Data,
+               VENDOR_READ_LENGTH, MOS_WDR_TIMEOUT);
+
+       if ((Data & 0x01) == 0) {
+               mos7840_num_ports = 2;
+               serial->num_bulk_in = 2;
+               serial->num_bulk_out = 2;
+               serial->num_ports = 2;
+       } else {
+               mos7840_num_ports = 4;
                serial->num_bulk_in = 4;
                serial->num_bulk_out = 4;
-               mos7840_num_ports = serial->num_ports = 4;
+               serial->num_ports = 4;
        }
-       dbg ("mos7840_num_ports = %d", mos7840_num_ports);
+
        return mos7840_num_ports;
 }
 
@@ -2343,6 +2385,13 @@ static int mos7840_startup(struct usb_serial *serial)
                return -1;
        }
 
+       if (serial->num_bulk_in < serial->num_ports ||
+                       serial->num_bulk_out < serial->num_ports ||
+                       serial->num_interrupt_in < 1) {
+               dev_err(&serial->interface->dev, "missing endpoints\n");
+               return -ENODEV;
+       }
+
        dev = serial->dev;
 
        dbg("%s", "Entering...");
@@ -2560,7 +2609,6 @@ error:
                kfree(mos7840_port->ctrl_buf);
                usb_free_urb(mos7840_port->control_urb);
                kfree(mos7840_port);
-               serial->port[i] = NULL;
        }
        return status;
 }
@@ -2573,7 +2621,6 @@ error:
 static void mos7840_disconnect(struct usb_serial *serial)
 {
        int i;
-       unsigned long flags;
        struct moschip_port *mos7840_port;
        dbg("%s", " disconnect :entering..........");
 
@@ -2591,9 +2638,6 @@ static void mos7840_disconnect(struct usb_serial *serial)
                mos7840_port = mos7840_get_port_private(serial->port[i]);
                dbg ("mos7840_port %d = %p", i, mos7840_port);
                if (mos7840_port) {
-                       spin_lock_irqsave(&mos7840_port->pool_lock, flags);
-                       mos7840_port->zombie = 1;
-                       spin_unlock_irqrestore(&mos7840_port->pool_lock, flags);
                        usb_kill_urb(mos7840_port->control_urb);
                }
        }
@@ -2627,6 +2671,7 @@ static void mos7840_release(struct usb_serial *serial)
                mos7840_port = mos7840_get_port_private(serial->port[i]);
                dbg("mos7840_port %d = %p", i, mos7840_port);
                if (mos7840_port) {
+                       usb_free_urb(mos7840_port->control_urb);
                        kfree(mos7840_port->ctrl_buf);
                        kfree(mos7840_port->dr);
                        kfree(mos7840_port);