USB: serial: fix null-pointer dereferences on disconnect

Make sure serial-driver dtr_rts is called with disc_mutex held after
checking the disconnected flag.

Due to a bug in the tty layer, dtr_rts may get called after a device has
been disconnected and the tty-device unregistered. Some drivers have had
individual checks for disconnect to make sure the disconnected interface
was not accessed, but this should really be handled in usb-serial core
(at least until the long-standing tty-bug has been fixed).

Note that the problem has been made more acute with commit 0998d0631001
("device-core: Ensure drvdata = NULL when no driver is bound") as the
port data is now also NULL when dtr_rts is called resulting in further
oopses.

Reported-by: Chris Ruehl <chris.ruehl@gtsys.com.hk>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

7 files changed, 50 insertions, 59 deletions

diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 90ceef1776c3..d07fccf3bab5 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1886,24 +1886,22 @@ static void ftdi_dtr_rts(struct usb_serial_port *port, int on)
 {
         struct ftdi_private *priv = usb_get_serial_port_data(port);
 
-        mutex_lock(&port->serial->disc_mutex);
-        if (!port->serial->disconnected) {
-                /* Disable flow control */
-                if (!on && usb_control_msg(port->serial->dev,
+        /* Disable flow control */
+        if (!on) {
+                if (usb_control_msg(port->serial->dev,
                             usb_sndctrlpipe(port->serial->dev, 0),
                             FTDI_SIO_SET_FLOW_CTRL_REQUEST,
                             FTDI_SIO_SET_FLOW_CTRL_REQUEST_TYPE,
                             0, priv->interface, NULL, 0,
                             WDR_TIMEOUT) < 0) {
-                            dev_err(&port->dev, "error from flowcontrol urb\n");
+                        dev_err(&port->dev, "error from flowcontrol urb\n");
                 }
-                /* drop RTS and DTR */
-                if (on)
-                        set_mctrl(port, TIOCM_DTR | TIOCM_RTS);
-                else
-                        clear_mctrl(port, TIOCM_DTR | TIOCM_RTS);
         }
-        mutex_unlock(&port->serial->disc_mutex);
+        /* drop RTS and DTR */
+        if (on)
+                set_mctrl(port, TIOCM_DTR | TIOCM_RTS);
+        else
+                clear_mctrl(port, TIOCM_DTR | TIOCM_RTS);
 }
 
 /*
diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index b6911757c855..d9c86516fed4 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -499,19 +499,15 @@ static void mct_u232_dtr_rts(struct usb_serial_port *port, int on)
         unsigned int control_state;
         struct mct_u232_private *priv = usb_get_serial_port_data(port);
 
-        mutex_lock(&port->serial->disc_mutex);
-        if (!port->serial->disconnected) {
-                /* drop DTR and RTS */
-                spin_lock_irq(&priv->lock);
-                if (on)
-                        priv->control_state |= TIOCM_DTR | TIOCM_RTS;
-                else
-                        priv->control_state &= ~(TIOCM_DTR | TIOCM_RTS);
-                control_state = priv->control_state;
-                spin_unlock_irq(&priv->lock);
-                mct_u232_set_modem_ctrl(port, control_state);
-        }
-        mutex_unlock(&port->serial->disc_mutex);
+        spin_lock_irq(&priv->lock);
+        if (on)
+                priv->control_state |= TIOCM_DTR | TIOCM_RTS;
+        else
+                priv->control_state &= ~(TIOCM_DTR | TIOCM_RTS);
+        control_state = priv->control_state;
+        spin_unlock_irq(&priv->lock);
+
+        mct_u232_set_modem_ctrl(port, control_state);
 }
 
 static void mct_u232_close(struct usb_serial_port *port)
diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c
index d152be97d041..a8d5110d4cc5 100644
--- a/drivers/usb/serial/quatech2.c
+++ b/drivers/usb/serial/quatech2.c
@@ -945,19 +945,17 @@ static void qt2_dtr_rts(struct usb_serial_port *port, int on)
         struct usb_device *dev = port->serial->dev;
         struct qt2_port_private *port_priv = usb_get_serial_port_data(port);
 
-        mutex_lock(&port->serial->disc_mutex);
-        if (!port->serial->disconnected) {
-                /* Disable flow control */
-                if (!on && qt2_setregister(dev, port_priv->device_port,
+        /* Disable flow control */
+        if (!on) {
+                if (qt2_setregister(dev, port_priv->device_port,
                                            UART_MCR, 0) < 0)
                         dev_warn(&port->dev, "error from flowcontrol urb\n");
-                /* drop RTS and DTR */
-                if (on)
-                        update_mctrl(port_priv, TIOCM_DTR | TIOCM_RTS, 0);
-                else
-                        update_mctrl(port_priv, 0, TIOCM_DTR | TIOCM_RTS);
         }
-        mutex_unlock(&port->serial->disc_mutex);
+        /* drop RTS and DTR */
+        if (on)
+                update_mctrl(port_priv, TIOCM_DTR | TIOCM_RTS, 0);
+        else
+                update_mctrl(port_priv, 0, TIOCM_DTR | TIOCM_RTS);
 }
 
 static void qt2_update_msr(struct usb_serial_port *port, unsigned char *ch)
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index af06f2f5f38b..d4426c038c32 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -861,19 +861,13 @@ static int sierra_open(struct tty_struct *tty, struct usb_serial_port *port)
 
 static void sierra_dtr_rts(struct usb_serial_port *port, int on)
 {
-        struct usb_serial *serial = port->serial;
         struct sierra_port_private *portdata;
 
         portdata = usb_get_serial_port_data(port);
         portdata->rts_state = on;
         portdata->dtr_state = on;
 
-        if (serial->dev) {
-                mutex_lock(&serial->disc_mutex);
-                if (!serial->disconnected)
-                        sierra_send_setup(port);
-                mutex_unlock(&serial->disc_mutex);
-        }
+        sierra_send_setup(port);
 }
 
 static int sierra_startup(struct usb_serial *serial)
diff --git a/drivers/usb/serial/ssu100.c b/drivers/usb/serial/ssu100.c
index 4543ea350229..d938396171e8 100644
--- a/drivers/usb/serial/ssu100.c
+++ b/drivers/usb/serial/ssu100.c
@@ -506,19 +506,16 @@ static void ssu100_dtr_rts(struct usb_serial_port *port, int on)
 {
         struct usb_device *dev = port->serial->dev;
 
-        mutex_lock(&port->serial->disc_mutex);
-        if (!port->serial->disconnected) {
-                /* Disable flow control */
-                if (!on &&
-                    ssu100_setregister(dev, 0, UART_MCR, 0) < 0)
+        /* Disable flow control */
+        if (!on) {
+                if (ssu100_setregister(dev, 0, UART_MCR, 0) < 0)
                         dev_err(&port->dev, "error from flowcontrol urb\n");
-                /* drop RTS and DTR */
-                if (on)
-                        set_mctrl(dev, TIOCM_DTR | TIOCM_RTS);
-                else
-                        clear_mctrl(dev, TIOCM_DTR | TIOCM_RTS);
         }
-        mutex_unlock(&port->serial->disc_mutex);
+        /* drop RTS and DTR */
+        if (on)
+                set_mctrl(dev, TIOCM_DTR | TIOCM_RTS);
+        else
+                clear_mctrl(dev, TIOCM_DTR | TIOCM_RTS);
 }
 
 static void ssu100_update_msr(struct usb_serial_port *port, u8 msr)
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 0a17f5942552..a19ed74d770d 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -694,10 +694,20 @@ static int serial_carrier_raised(struct tty_port *port)
 static void serial_dtr_rts(struct tty_port *port, int on)
 {
         struct usb_serial_port *p = container_of(port, struct usb_serial_port, port);
-        struct usb_serial_driver *drv = p->serial->type;
+        struct usb_serial *serial = p->serial;
+        struct usb_serial_driver *drv = serial->type;
 
-        if (drv->dtr_rts)
+        if (!drv->dtr_rts)
+                return;
+        /*
+         * Work-around bug in the tty-layer which can result in dtr_rts
+         * being called after a disconnect (and tty_unregister_device
+         * has returned). Remove once bug has been squashed.
+         */
+        mutex_lock(&serial->disc_mutex);
+        if (!serial->disconnected)
                 drv->dtr_rts(p, on);
+        mutex_unlock(&serial->disc_mutex);
 }
 
 static const struct tty_port_operations serial_port_ops = {
diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
index 01c94aada56c..1355a6cd4508 100644
--- a/drivers/usb/serial/usb_wwan.c
+++ b/drivers/usb/serial/usb_wwan.c
@@ -38,7 +38,6 @@
 
 void usb_wwan_dtr_rts(struct usb_serial_port *port, int on)
 {
-        struct usb_serial *serial = port->serial;
         struct usb_wwan_port_private *portdata;
         struct usb_wwan_intf_private *intfdata;
 
@@ -48,12 +47,11 @@ void usb_wwan_dtr_rts(struct usb_serial_port *port, int on)
                 return;
 
         portdata = usb_get_serial_port_data(port);
-        mutex_lock(&serial->disc_mutex);
+        /* FIXME: locking */
         portdata->rts_state = on;
         portdata->dtr_state = on;
-        if (serial->dev)
-                intfdata->send_setup(port);
-        mutex_unlock(&serial->disc_mutex);
+
+        intfdata->send_setup(port);
 }
 EXPORT_SYMBOL(usb_wwan_dtr_rts);