USB: fix disconnect bug in cdc-acm

cdc-acm must give up secondary interfaces if the primary is disconnected
and vice versa. This wasn't done correctly.

Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 15 insertions, 13 deletions

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index ba86fec872b4..93b28ee8e8bd 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -838,7 +838,7 @@ static void acm_tty_set_termios(struct tty_struct *tty, struct ktermios *termios
  * USB probe and disconnect routines.
  */
 
-/* Little helper: write buffers free */
+/* Little helpers: write/read buffers free */
 static void acm_write_buffers_free(struct acm *acm)
 {
         int i;
@@ -849,6 +849,15 @@ static void acm_write_buffers_free(struct acm *acm)
         }
 }
 
+static void acm_read_buffers_free(struct acm *acm)
+{
+        struct usb_device *usb_dev = interface_to_usbdev(acm->control);
+        int i, n = acm->rx_buflimit;
+
+        for (i = 0; i < n; i++)
+                usb_buffer_free(usb_dev, acm->readsize, acm->rb[i].base, acm->rb[i].dma);
+}
+
 /* Little helper: write buffers allocate */
 static int acm_write_buffers_alloc(struct acm *acm)
 {
@@ -1171,8 +1180,7 @@ alloc_fail8:
         for (i = 0; i < ACM_NW; i++)
                 usb_free_urb(acm->wb[i].urb);
 alloc_fail7:
-        for (i = 0; i < num_rx_buf; i++)
-                usb_buffer_free(usb_dev, acm->readsize, acm->rb[i].base, acm->rb[i].dma);
+        acm_read_buffers_free(acm);
         for (i = 0; i < num_rx_buf; i++)
                 usb_free_urb(acm->ru[i].urb);
         usb_free_urb(acm->ctrlurb);
@@ -1209,15 +1217,9 @@ static void acm_disconnect(struct usb_interface *intf)
 {
         struct acm *acm = usb_get_intfdata(intf);
         struct usb_device *usb_dev = interface_to_usbdev(intf);
-        int i;
-
-        if (!acm || !acm->dev) {
-                dbg("disconnect on nonexisting interface");
-                return;
-        }
 
         mutex_lock(&open_mutex);
-        if (!usb_get_intfdata(intf)) {
+        if (!acm || !acm->dev) {
                 mutex_unlock(&open_mutex);
                 return;
         }
@@ -1236,10 +1238,10 @@ static void acm_disconnect(struct usb_interface *intf)
 
         acm_write_buffers_free(acm);
         usb_buffer_free(usb_dev, acm->ctrlsize, acm->ctrl_buffer, acm->ctrl_dma);
-        for (i = 0; i < acm->rx_buflimit; i++)
-                usb_buffer_free(usb_dev, acm->readsize, acm->rb[i].base, acm->rb[i].dma);
+        acm_read_buffers_free(acm);
 
-        usb_driver_release_interface(&acm_driver, intf == acm->control ? acm->data : intf);
+        usb_driver_release_interface(&acm_driver, intf == acm->control ?
+                                        acm->data : acm->control);
 
         if (!acm->used) {
                 acm_tty_unregister(acm);