USB: serial: don't call release without attach

This patch (as1295) fixes a recently-added bug in the USB serial core.
If certain kinds of errors occur during probing, the core may call a
serial driver's release method without previously calling the attach
method.  This causes some drivers (io_ti in particular) to perform an
invalid memory access.

The patch adds a new flag to keep track of whether or not attach has
been called.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: Jean-Denis Girard <jd.girard@sysnux.pf>
CC: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 5 insertions, 1 deletions

diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index aa6b2ae951ae..2d0f75d63ff0 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -156,7 +156,8 @@ static void destroy_serial(struct kref *kref)
         if (serial->minor != SERIAL_TTY_NO_MINOR)
                 return_serial(serial);
 
-        serial->type->release(serial);
+        if (serial->attached)
+                serial->type->release(serial);
 
         /* Now that nothing is using the ports, they can be freed */
         for (i = 0; i < serial->num_port_pointers; ++i) {
@@ -1059,12 +1060,15 @@ int usb_serial_probe(struct usb_interface *interface,
                 module_put(type->driver.owner);
                 if (retval < 0)
                         goto probe_error;
+                serial->attached = 1;
                 if (retval > 0) {
                         /* quietly accept this device, but don't bind to a
                            serial port as it's about to disappear */
                         serial->num_ports = 0;
                         goto exit;
                 }
+        } else {
+                serial->attached = 1;
         }
 
         if (get_free_serial(serial, num_ports, &minor) == NULL) {