Changes in 4.9.190 usb: usbfs: fix double-free of usb memory upon submiturb error usb: iowarrior: fix deadlock on disconnect sound: fix a memory leak bug x86/mm: Check for pfn instead of page in vmalloc_sync_one() x86/mm: Sync also unmappings in vmalloc_sync_all() mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy() perf record: Fix wrong size in perf_record_mmap for last kernel module perf db-export: Fix thread__exec_comm() perf record: Fix module size on s390 usb: yurex: Fix use-after-free in yurex_delete can: peak_usb: fix potential double kfree_skb() netfilter: nfnetlink: avoid deadlock due to synchronous request_module iscsi_ibft: make ISCSI_IBFT dependson ACPI instead of ISCSI_IBFT_FIND mac80211: don't warn about CW params when not using them hwmon: (nct6775) Fix register address and added missed tolerance for nct6106 cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init() s390/qdio: add sanity checks to the fast-requeue path ALSA: compress: Fix regression on compressed capture streams ALSA: compress: Prevent bypasses of set_params ALSA: compress: Don't allow paritial drain operations on capture streams ALSA: compress: Be more restrictive about when a drain is allowed perf probe: Avoid calling freeing routine multiple times for same pointer drbd: dynamically allocate shash descriptor ACPI/IORT: Fix off-by-one check in iort_dev_find_its_id() ARM: davinci: fix sleep.S build error on ARMv4 scsi: megaraid_sas: fix panic on loading firmware crashdump scsi: ibmvfc: fix WARN_ON during event pool release scsi: scsi_dh_alua: always use a 2 second delay before retrying RTPG tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop perf/core: Fix creating kernel counters for PMUs that override event->cpu can: peak_usb: pcan_usb_pro: Fix info-leaks to USB devices can: peak_usb: pcan_usb_fd: Fix info-leaks to USB devices hwmon: (nct7802) Fix wrong detection of in4 presence ALSA: firewire: fix a memory leak bug ALSA: hda - Don't override global PCM hw info flag mac80211: don't WARN on short WMM parameters from AP SMB3: Fix deadlock in validate negotiate hits reconnect smb3: send CAP_DFS capability during session setup mwifiex: fix 802.11n/WPA detection iwlwifi: don't unmap as page memory that was mapped as single scsi: mpt3sas: Use 63-bit DMA addressing on SAS35 HBA sh: kernel: hw_breakpoint: Fix missing break in switch statement mm/usercopy: use memory range to be accessed for wraparound check mm/memcontrol.c: fix use after free in mem_cgroup_iter() bpf: get rid of pure_initcall dependency to enable jits bpf: restrict access to core bpf sysctls bpf: add bpf_jit_limit knob to restrict unpriv allocations vhost-net: set packet weight of tx polling to 2 * vq size vhost_net: use packet weight for rx handler, too vhost_net: introduce vhost_exceeds_weight() vhost: introduce vhost_exceeds_weight() vhost_net: fix possible infinite loop vhost: scsi: add weight support siphash: add cryptographically secure PRF siphash: implement HalfSipHash1-3 for hash tables inet: switch IP ID generator to siphash netfilter: ctnetlink: don't use conntrack/expect object addresses as id xtensa: add missing isync to the cpu_reset TLB code ALSA: hda - Fix a memory leak bug ALSA: hda - Add a generic reboot_notify ALSA: hda - Let all conexant codec enter D3 when rebooting HID: holtek: test for sanity of intfdata HID: hiddev: avoid opening a disconnected device HID: hiddev: do cleanup in failure of opening a device Input: kbtab - sanity check for endpoint type Input: iforce - add sanity checks net: usb: pegasus: fix improper read if get_registers() fail xen/pciback: remove set but not used variable 'old_state' irqchip/irq-imx-gpcv2: Forward irq type to parent perf header: Fix divide by zero error if f_header.attr_size==0 perf header: Fix use of unitialized value warning libata: zpodd: Fix small read overflow in zpodd_get_mech_type() scsi: hpsa: correct scsi command status issue after reset ata: libahci: do not complain in case of deferred probe kbuild: modpost: handle KBUILD_EXTRA_SYMBOLS only for external modules arm64/efi: fix variable 'si' set but not used arm64/mm: fix variable 'pud' set but not used IB/core: Add mitigation for Spectre V1 IB/mad: Fix use-after-free in ib mad completion handling ocfs2: remove set but not used variable 'last_hash' staging: comedi: dt3000: Fix signed integer overflow 'divider * base' staging: comedi: dt3000: Fix rounding up of timer divisor USB: core: Fix races in character device registration and deregistraion usb: cdc-acm: make sure a refcount is taken early enough USB: CDC: fix sanity checks in CDC union parser USB: serial: option: add D-Link DWM-222 device ID USB: serial: option: Add support for ZTE MF871A USB: serial: option: add the BroadMobi BM818 card USB: serial: option: Add Motorola modem UARTs asm-generic: fix -Wtype-limits compiler warnings bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K arm64: compat: Allow single-byte watchpoints on all addresses netfilter: conntrack: Use consistent ct id hash calculation Input: psmouse - fix build error of multiple definition iommu/amd: Move iommu_init_pci() to .init section bnx2x: Fix VF's VLAN reconfiguration in reload. net/packet: fix race in tpacket_snd() sctp: fix the transport error_count check xen/netback: Reset nr_frags before freeing skb net/mlx5e: Only support tx/rx pause setting for port owner net/mlx5e: Use flow keys dissector to parse packets for ARFS team: Add vlan tx offload to hw_enc_features bonding: Add vlan tx offload to hw_enc_features Linux 4.9.190 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
		
			
				
	
	
		
			246 lines
		
	
	
		
			6.1 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			246 lines
		
	
	
		
			6.1 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
/*
 | 
						|
 * drivers/usb/core/file.c
 | 
						|
 *
 | 
						|
 * (C) Copyright Linus Torvalds 1999
 | 
						|
 * (C) Copyright Johannes Erdfelt 1999-2001
 | 
						|
 * (C) Copyright Andreas Gal 1999
 | 
						|
 * (C) Copyright Gregory P. Smith 1999
 | 
						|
 * (C) Copyright Deti Fliegl 1999 (new USB architecture)
 | 
						|
 * (C) Copyright Randy Dunlap 2000
 | 
						|
 * (C) Copyright David Brownell 2000-2001 (kernel hotplug, usb_device_id,
 | 
						|
 *	more docs, etc)
 | 
						|
 * (C) Copyright Yggdrasil Computing, Inc. 2000
 | 
						|
 *     (usb_device_id matching changes by Adam J. Richter)
 | 
						|
 * (C) Copyright Greg Kroah-Hartman 2002-2003
 | 
						|
 *
 | 
						|
 */
 | 
						|
 | 
						|
#include <linux/module.h>
 | 
						|
#include <linux/errno.h>
 | 
						|
#include <linux/rwsem.h>
 | 
						|
#include <linux/slab.h>
 | 
						|
#include <linux/string.h>
 | 
						|
#include <linux/usb.h>
 | 
						|
 | 
						|
#include "usb.h"
 | 
						|
 | 
						|
#define MAX_USB_MINORS	256
 | 
						|
static const struct file_operations *usb_minors[MAX_USB_MINORS];
 | 
						|
static DECLARE_RWSEM(minor_rwsem);
 | 
						|
static DEFINE_MUTEX(init_usb_class_mutex);
 | 
						|
 | 
						|
static int usb_open(struct inode *inode, struct file *file)
 | 
						|
{
 | 
						|
	int err = -ENODEV;
 | 
						|
	const struct file_operations *new_fops;
 | 
						|
 | 
						|
	down_read(&minor_rwsem);
 | 
						|
	new_fops = fops_get(usb_minors[iminor(inode)]);
 | 
						|
 | 
						|
	if (!new_fops)
 | 
						|
		goto done;
 | 
						|
 | 
						|
	replace_fops(file, new_fops);
 | 
						|
	/* Curiouser and curiouser... NULL ->open() as "no device" ? */
 | 
						|
	if (file->f_op->open)
 | 
						|
		err = file->f_op->open(inode, file);
 | 
						|
 done:
 | 
						|
	up_read(&minor_rwsem);
 | 
						|
	return err;
 | 
						|
}
 | 
						|
 | 
						|
static const struct file_operations usb_fops = {
 | 
						|
	.owner =	THIS_MODULE,
 | 
						|
	.open =		usb_open,
 | 
						|
	.llseek =	noop_llseek,
 | 
						|
};
 | 
						|
 | 
						|
static struct usb_class {
 | 
						|
	struct kref kref;
 | 
						|
	struct class *class;
 | 
						|
} *usb_class;
 | 
						|
 | 
						|
static char *usb_devnode(struct device *dev, umode_t *mode)
 | 
						|
{
 | 
						|
	struct usb_class_driver *drv;
 | 
						|
 | 
						|
	drv = dev_get_drvdata(dev);
 | 
						|
	if (!drv || !drv->devnode)
 | 
						|
		return NULL;
 | 
						|
	return drv->devnode(dev, mode);
 | 
						|
}
 | 
						|
 | 
						|
static int init_usb_class(void)
 | 
						|
{
 | 
						|
	int result = 0;
 | 
						|
 | 
						|
	if (usb_class != NULL) {
 | 
						|
		kref_get(&usb_class->kref);
 | 
						|
		goto exit;
 | 
						|
	}
 | 
						|
 | 
						|
	usb_class = kmalloc(sizeof(*usb_class), GFP_KERNEL);
 | 
						|
	if (!usb_class) {
 | 
						|
		result = -ENOMEM;
 | 
						|
		goto exit;
 | 
						|
	}
 | 
						|
 | 
						|
	kref_init(&usb_class->kref);
 | 
						|
	usb_class->class = class_create(THIS_MODULE, "usbmisc");
 | 
						|
	if (IS_ERR(usb_class->class)) {
 | 
						|
		result = PTR_ERR(usb_class->class);
 | 
						|
		printk(KERN_ERR "class_create failed for usb devices\n");
 | 
						|
		kfree(usb_class);
 | 
						|
		usb_class = NULL;
 | 
						|
		goto exit;
 | 
						|
	}
 | 
						|
	usb_class->class->devnode = usb_devnode;
 | 
						|
 | 
						|
exit:
 | 
						|
	return result;
 | 
						|
}
 | 
						|
 | 
						|
static void release_usb_class(struct kref *kref)
 | 
						|
{
 | 
						|
	/* Ok, we cheat as we know we only have one usb_class */
 | 
						|
	class_destroy(usb_class->class);
 | 
						|
	kfree(usb_class);
 | 
						|
	usb_class = NULL;
 | 
						|
}
 | 
						|
 | 
						|
static void destroy_usb_class(void)
 | 
						|
{
 | 
						|
	mutex_lock(&init_usb_class_mutex);
 | 
						|
	kref_put(&usb_class->kref, release_usb_class);
 | 
						|
	mutex_unlock(&init_usb_class_mutex);
 | 
						|
}
 | 
						|
 | 
						|
int usb_major_init(void)
 | 
						|
{
 | 
						|
	int error;
 | 
						|
 | 
						|
	error = register_chrdev(USB_MAJOR, "usb", &usb_fops);
 | 
						|
	if (error)
 | 
						|
		printk(KERN_ERR "Unable to get major %d for usb devices\n",
 | 
						|
		       USB_MAJOR);
 | 
						|
 | 
						|
	return error;
 | 
						|
}
 | 
						|
 | 
						|
void usb_major_cleanup(void)
 | 
						|
{
 | 
						|
	unregister_chrdev(USB_MAJOR, "usb");
 | 
						|
}
 | 
						|
 | 
						|
/**
 | 
						|
 * usb_register_dev - register a USB device, and ask for a minor number
 | 
						|
 * @intf: pointer to the usb_interface that is being registered
 | 
						|
 * @class_driver: pointer to the usb_class_driver for this device
 | 
						|
 *
 | 
						|
 * This should be called by all USB drivers that use the USB major number.
 | 
						|
 * If CONFIG_USB_DYNAMIC_MINORS is enabled, the minor number will be
 | 
						|
 * dynamically allocated out of the list of available ones.  If it is not
 | 
						|
 * enabled, the minor number will be based on the next available free minor,
 | 
						|
 * starting at the class_driver->minor_base.
 | 
						|
 *
 | 
						|
 * This function also creates a usb class device in the sysfs tree.
 | 
						|
 *
 | 
						|
 * usb_deregister_dev() must be called when the driver is done with
 | 
						|
 * the minor numbers given out by this function.
 | 
						|
 *
 | 
						|
 * Return: -EINVAL if something bad happens with trying to register a
 | 
						|
 * device, and 0 on success.
 | 
						|
 */
 | 
						|
int usb_register_dev(struct usb_interface *intf,
 | 
						|
		     struct usb_class_driver *class_driver)
 | 
						|
{
 | 
						|
	int retval;
 | 
						|
	int minor_base = class_driver->minor_base;
 | 
						|
	int minor;
 | 
						|
	char name[20];
 | 
						|
 | 
						|
#ifdef CONFIG_USB_DYNAMIC_MINORS
 | 
						|
	/*
 | 
						|
	 * We don't care what the device tries to start at, we want to start
 | 
						|
	 * at zero to pack the devices into the smallest available space with
 | 
						|
	 * no holes in the minor range.
 | 
						|
	 */
 | 
						|
	minor_base = 0;
 | 
						|
#endif
 | 
						|
 | 
						|
	if (class_driver->fops == NULL)
 | 
						|
		return -EINVAL;
 | 
						|
	if (intf->minor >= 0)
 | 
						|
		return -EADDRINUSE;
 | 
						|
 | 
						|
	mutex_lock(&init_usb_class_mutex);
 | 
						|
	retval = init_usb_class();
 | 
						|
	mutex_unlock(&init_usb_class_mutex);
 | 
						|
 | 
						|
	if (retval)
 | 
						|
		return retval;
 | 
						|
 | 
						|
	dev_dbg(&intf->dev, "looking for a minor, starting at %d\n", minor_base);
 | 
						|
 | 
						|
	down_write(&minor_rwsem);
 | 
						|
	for (minor = minor_base; minor < MAX_USB_MINORS; ++minor) {
 | 
						|
		if (usb_minors[minor])
 | 
						|
			continue;
 | 
						|
 | 
						|
		usb_minors[minor] = class_driver->fops;
 | 
						|
		intf->minor = minor;
 | 
						|
		break;
 | 
						|
	}
 | 
						|
	if (intf->minor < 0) {
 | 
						|
		up_write(&minor_rwsem);
 | 
						|
		return -EXFULL;
 | 
						|
	}
 | 
						|
 | 
						|
	/* create a usb class device for this usb interface */
 | 
						|
	snprintf(name, sizeof(name), class_driver->name, minor - minor_base);
 | 
						|
	intf->usb_dev = device_create(usb_class->class, &intf->dev,
 | 
						|
				      MKDEV(USB_MAJOR, minor), class_driver,
 | 
						|
				      "%s", kbasename(name));
 | 
						|
	if (IS_ERR(intf->usb_dev)) {
 | 
						|
		usb_minors[minor] = NULL;
 | 
						|
		intf->minor = -1;
 | 
						|
		retval = PTR_ERR(intf->usb_dev);
 | 
						|
	}
 | 
						|
	up_write(&minor_rwsem);
 | 
						|
	return retval;
 | 
						|
}
 | 
						|
EXPORT_SYMBOL_GPL(usb_register_dev);
 | 
						|
 | 
						|
/**
 | 
						|
 * usb_deregister_dev - deregister a USB device's dynamic minor.
 | 
						|
 * @intf: pointer to the usb_interface that is being deregistered
 | 
						|
 * @class_driver: pointer to the usb_class_driver for this device
 | 
						|
 *
 | 
						|
 * Used in conjunction with usb_register_dev().  This function is called
 | 
						|
 * when the USB driver is finished with the minor numbers gotten from a
 | 
						|
 * call to usb_register_dev() (usually when the device is disconnected
 | 
						|
 * from the system.)
 | 
						|
 *
 | 
						|
 * This function also removes the usb class device from the sysfs tree.
 | 
						|
 *
 | 
						|
 * This should be called by all drivers that use the USB major number.
 | 
						|
 */
 | 
						|
void usb_deregister_dev(struct usb_interface *intf,
 | 
						|
			struct usb_class_driver *class_driver)
 | 
						|
{
 | 
						|
	if (intf->minor == -1)
 | 
						|
		return;
 | 
						|
 | 
						|
	dev_dbg(&intf->dev, "removing %d minor\n", intf->minor);
 | 
						|
	device_destroy(usb_class->class, MKDEV(USB_MAJOR, intf->minor));
 | 
						|
 | 
						|
	down_write(&minor_rwsem);
 | 
						|
	usb_minors[intf->minor] = NULL;
 | 
						|
	up_write(&minor_rwsem);
 | 
						|
 | 
						|
	intf->usb_dev = NULL;
 | 
						|
	intf->minor = -1;
 | 
						|
	destroy_usb_class();
 | 
						|
}
 | 
						|
EXPORT_SYMBOL_GPL(usb_deregister_dev);
 |