USB: usb-serial: replace shutdown with disconnect, release

This patch (as1254) splits up the shutdown method of usb_serial_driver
into a disconnect and a release method.

The problem is that the usb-serial core was calling shutdown during
disconnect handling, but drivers didn't expect it to be called until
after all the open file references had been closed.  The result was an
oops when the close method tried to use memory that had been
deallocated by shutdown.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 20 insertions, 9 deletions

diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index 53ef5996e33d..0191693625d6 100644
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -224,7 +224,8 @@ static int  edge_tiocmget(struct tty_struct *tty, struct file *file);
 static int  edge_tiocmset(struct tty_struct *tty, struct file *file,
                                         unsigned int set, unsigned int clear);
 static int  edge_startup(struct usb_serial *serial);
-static void edge_shutdown(struct usb_serial *serial);
+static void edge_disconnect(struct usb_serial *serial);
+static void edge_release(struct usb_serial *serial);
 
 #include "io_tables.h"  /* all of the devices that this driver supports */
 
@@ -3193,21 +3194,16 @@ static int edge_startup(struct usb_serial *serial)
 
 
 /****************************************************************************
- * edge_shutdown
+ * edge_disconnect
  *      This function is called whenever the device is removed from the usb bus.
  ****************************************************************************/
-static void edge_shutdown(struct usb_serial *serial)
+static void edge_disconnect(struct usb_serial *serial)
 {
         struct edgeport_serial *edge_serial = usb_get_serial_data(serial);
-        int i;
 
         dbg("%s", __func__);
 
         /* stop reads and writes on all ports */
-        for (i = 0; i < serial->num_ports; ++i) {
-                kfree(usb_get_serial_port_data(serial->port[i]));
-                usb_set_serial_port_data(serial->port[i],  NULL);
-        }
         /* free up our endpoint stuff */
         if (edge_serial->is_epic) {
                 usb_kill_urb(edge_serial->interrupt_read_urb);
@@ -3218,9 +3214,24 @@ static void edge_shutdown(struct usb_serial *serial)
                 usb_free_urb(edge_serial->read_urb);
                 kfree(edge_serial->bulk_in_buffer);
         }
+}
+
+
+/****************************************************************************
+ * edge_release
+ *      This function is called when the device structure is deallocated.
+ ****************************************************************************/
+static void edge_release(struct usb_serial *serial)
+{
+        struct edgeport_serial *edge_serial = usb_get_serial_data(serial);
+        int i;
+
+        dbg("%s", __func__);
+
+        for (i = 0; i < serial->num_ports; ++i)
+                kfree(usb_get_serial_port_data(serial->port[i]));
 
         kfree(edge_serial);
-        usb_set_serial_data(serial, NULL);
 }