Skip to content

Commit a239c6e

Browse files
dpenklergregkh
dpenkler
authored and
gregkh
committed
staging: gpib: Fix Oops after disconnect in ni_usb
If the usb dongle is disconnected subsequent calls to the driver cause a NULL dereference Oops as the bus_interface is set to NULL on disconnect. This problem was introduced by setting usb_dev from the bus_interface for dev_xxx messages. Previously bus_interface was checked for NULL only in the the functions directly calling usb_fill_bulk_urb or usb_control_msg. Check for valid bus_interface on all interface entry points and return -ENODEV if it is NULL. Fixes: 4934b98 ("staging: gpib: Update messaging and usb_device refs in ni_usb") Cc: stable <stable@kernel.org> Signed-off-by: Dave Penkler <dpenkler@gmail.com> Link: https://lore.kernel.org/r/20250222165817.12856-1-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 20a351c commit a239c6e

1 file changed

Lines changed: 73 additions & 20 deletions

File tree

‎drivers/staging/gpib/ni_usb/ni_usb_gpib.c‎

Lines changed: 73 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -591,7 +591,7 @@ static int ni_usb_read(gpib_board_t *board, uint8_t *buffer, size_t length,
591591
{
592592
int retval, parse_retval;
593593
struct ni_usb_priv *ni_priv = board->private_data;
594-
struct usb_device *usb_dev = interface_to_usbdev(ni_priv->bus_interface);
594+
struct usb_device *usb_dev;
595595
u8 *out_data, *in_data;
596596
static const int out_data_length = 0x20;
597597
int in_data_length;
@@ -604,8 +604,11 @@ static int ni_usb_read(gpib_board_t *board, uint8_t *buffer, size_t length,
604604
struct ni_usb_register reg;
605605

606606
*bytes_read = 0;
607+
if (!ni_priv->bus_interface)
608+
return -ENODEV;
607609
if (length > max_read_length)
608610
return -EINVAL;
611+
usb_dev = interface_to_usbdev(ni_priv->bus_interface);
609612
out_data = kmalloc(out_data_length, GFP_KERNEL);
610613
if (!out_data)
611614
return -ENOMEM;
@@ -718,7 +721,7 @@ static int ni_usb_write(gpib_board_t *board, uint8_t *buffer, size_t length,
718721
{
719722
int retval;
720723
struct ni_usb_priv *ni_priv = board->private_data;
721-
struct usb_device *usb_dev = interface_to_usbdev(ni_priv->bus_interface);
724+
struct usb_device *usb_dev;
722725
u8 *out_data, *in_data;
723726
int out_data_length;
724727
static const int in_data_length = 0x10;
@@ -728,9 +731,11 @@ static int ni_usb_write(gpib_board_t *board, uint8_t *buffer, size_t length,
728731
struct ni_usb_status_block status;
729732
static const int max_write_length = 0xffff;
730733

731-
*bytes_written = 0;
734+
if (!ni_priv->bus_interface)
735+
return -ENODEV;
732736
if (length > max_write_length)
733737
return -EINVAL;
738+
usb_dev = interface_to_usbdev(ni_priv->bus_interface);
734739
out_data_length = length + 0x10;
735740
out_data = kmalloc(out_data_length, GFP_KERNEL);
736741
if (!out_data)
@@ -819,7 +824,7 @@ static int ni_usb_command_chunk(gpib_board_t *board, uint8_t *buffer, size_t len
819824
{
820825
int retval;
821826
struct ni_usb_priv *ni_priv = board->private_data;
822-
struct usb_device *usb_dev = interface_to_usbdev(ni_priv->bus_interface);
827+
struct usb_device *usb_dev;
823828
u8 *out_data, *in_data;
824829
int out_data_length;
825830
static const int in_data_length = 0x10;
@@ -831,8 +836,11 @@ static int ni_usb_command_chunk(gpib_board_t *board, uint8_t *buffer, size_t len
831836
static const int max_command_length = 0x10;
832837

833838
*command_bytes_written = 0;
839+
if (!ni_priv->bus_interface)
840+
return -ENODEV;
834841
if (length > max_command_length)
835842
length = max_command_length;
843+
usb_dev = interface_to_usbdev(ni_priv->bus_interface);
836844
out_data_length = length + 0x10;
837845
out_data = kmalloc(out_data_length, GFP_KERNEL);
838846
if (!out_data)
@@ -925,14 +933,17 @@ static int ni_usb_take_control(gpib_board_t *board, int synchronous)
925933
{
926934
int retval;
927935
struct ni_usb_priv *ni_priv = board->private_data;
928-
struct usb_device *usb_dev = interface_to_usbdev(ni_priv->bus_interface);
936+
struct usb_device *usb_dev;
929937
u8 *out_data, *in_data;
930938
static const int out_data_length = 0x10;
931939
static const int in_data_length = 0x10;
932940
int bytes_written = 0, bytes_read = 0;
933941
int i = 0;
934942
struct ni_usb_status_block status;
935943

944+
if (!ni_priv->bus_interface)
945+
return -ENODEV;
946+
usb_dev = interface_to_usbdev(ni_priv->bus_interface);
936947
out_data = kmalloc(out_data_length, GFP_KERNEL);
937948
if (!out_data)
938949
return -ENOMEM;
@@ -983,14 +994,17 @@ static int ni_usb_go_to_standby(gpib_board_t *board)
983994
{
984995
int retval;
985996
struct ni_usb_priv *ni_priv = board->private_data;
986-
struct usb_device *usb_dev = interface_to_usbdev(ni_priv->bus_interface);
997+
struct usb_device *usb_dev;
987998
u8 *out_data, *in_data;
988999
static const int out_data_length = 0x10;
9891000
static const int in_data_length = 0x20;
9901001
int bytes_written = 0, bytes_read = 0;
9911002
int i = 0;
9921003
struct ni_usb_status_block status;
9931004

1005+
if (!ni_priv->bus_interface)
1006+
return -ENODEV;
1007+
usb_dev = interface_to_usbdev(ni_priv->bus_interface);
9941008
out_data = kmalloc(out_data_length, GFP_KERNEL);
9951009
if (!out_data)
9961010
return -ENOMEM;
@@ -1039,11 +1053,14 @@ static void ni_usb_request_system_control(gpib_board_t *board, int request_contr
10391053
{
10401054
int retval;
10411055
struct ni_usb_priv *ni_priv = board->private_data;
1042-
struct usb_device *usb_dev = interface_to_usbdev(ni_priv->bus_interface);
1056+
struct usb_device *usb_dev;
10431057
int i = 0;
10441058
struct ni_usb_register writes[4];
10451059
unsigned int ibsta;
10461060

1061+
if (!ni_priv->bus_interface)
1062+
return; // -ENODEV;
1063+
usb_dev = interface_to_usbdev(ni_priv->bus_interface);
10471064
if (request_control) {
10481065
writes[i].device = NIUSB_SUBDEV_TNT4882;
10491066
writes[i].address = CMDR;
@@ -1087,15 +1104,18 @@ static void ni_usb_interface_clear(gpib_board_t *board, int assert)
10871104
{
10881105
int retval;
10891106
struct ni_usb_priv *ni_priv = board->private_data;
1090-
struct usb_device *usb_dev = interface_to_usbdev(ni_priv->bus_interface);
1107+
struct usb_device *usb_dev;
10911108
u8 *out_data, *in_data;
10921109
static const int out_data_length = 0x10;
10931110
static const int in_data_length = 0x10;
10941111
int bytes_written = 0, bytes_read = 0;
10951112
int i = 0;
10961113
struct ni_usb_status_block status;
10971114

1098-
// FIXME: we are going to pulse when assert is true, and ignore otherwise
1115+
if (!ni_priv->bus_interface)
1116+
return; // -ENODEV;
1117+
usb_dev = interface_to_usbdev(ni_priv->bus_interface);
1118+
// FIXME: we are going to pulse when assert is true, and ignore otherwise
10991119
if (assert == 0)
11001120
return;
11011121
out_data = kmalloc(out_data_length, GFP_KERNEL);
@@ -1133,10 +1153,13 @@ static void ni_usb_remote_enable(gpib_board_t *board, int enable)
11331153
{
11341154
int retval;
11351155
struct ni_usb_priv *ni_priv = board->private_data;
1136-
struct usb_device *usb_dev = interface_to_usbdev(ni_priv->bus_interface);
1156+
struct usb_device *usb_dev;
11371157
struct ni_usb_register reg;
11381158
unsigned int ibsta;
11391159

1160+
if (!ni_priv->bus_interface)
1161+
return; // -ENODEV;
1162+
usb_dev = interface_to_usbdev(ni_priv->bus_interface);
11401163
reg.device = NIUSB_SUBDEV_TNT4882;
11411164
reg.address = nec7210_to_tnt4882_offset(AUXMR);
11421165
if (enable)
@@ -1180,11 +1203,14 @@ static unsigned int ni_usb_update_status(gpib_board_t *board, unsigned int clear
11801203
{
11811204
int retval;
11821205
struct ni_usb_priv *ni_priv = board->private_data;
1183-
struct usb_device *usb_dev = interface_to_usbdev(ni_priv->bus_interface);
1206+
struct usb_device *usb_dev;
11841207
static const int buffer_length = 8;
11851208
u8 *buffer;
11861209
struct ni_usb_status_block status;
11871210

1211+
if (!ni_priv->bus_interface)
1212+
return -ENODEV;
1213+
usb_dev = interface_to_usbdev(ni_priv->bus_interface);
11881214
buffer = kmalloc(buffer_length, GFP_KERNEL);
11891215
if (!buffer)
11901216
return board->status;
@@ -1232,11 +1258,14 @@ static int ni_usb_primary_address(gpib_board_t *board, unsigned int address)
12321258
{
12331259
int retval;
12341260
struct ni_usb_priv *ni_priv = board->private_data;
1235-
struct usb_device *usb_dev = interface_to_usbdev(ni_priv->bus_interface);
1261+
struct usb_device *usb_dev;
12361262
int i = 0;
12371263
struct ni_usb_register writes[2];
12381264
unsigned int ibsta;
12391265

1266+
if (!ni_priv->bus_interface)
1267+
return -ENODEV;
1268+
usb_dev = interface_to_usbdev(ni_priv->bus_interface);
12401269
writes[i].device = NIUSB_SUBDEV_TNT4882;
12411270
writes[i].address = nec7210_to_tnt4882_offset(ADR);
12421271
writes[i].value = address;
@@ -1287,11 +1316,14 @@ static int ni_usb_secondary_address(gpib_board_t *board, unsigned int address, i
12871316
{
12881317
int retval;
12891318
struct ni_usb_priv *ni_priv = board->private_data;
1290-
struct usb_device *usb_dev = interface_to_usbdev(ni_priv->bus_interface);
1319+
struct usb_device *usb_dev;
12911320
int i = 0;
12921321
struct ni_usb_register writes[3];
12931322
unsigned int ibsta;
12941323

1324+
if (!ni_priv->bus_interface)
1325+
return -ENODEV;
1326+
usb_dev = interface_to_usbdev(ni_priv->bus_interface);
12951327
i += ni_usb_write_sad(writes, address, enable);
12961328
retval = ni_usb_write_registers(ni_priv, writes, i, &ibsta);
12971329
if (retval < 0) {
@@ -1306,7 +1338,7 @@ static int ni_usb_parallel_poll(gpib_board_t *board, uint8_t *result)
13061338
{
13071339
int retval;
13081340
struct ni_usb_priv *ni_priv = board->private_data;
1309-
struct usb_device *usb_dev = interface_to_usbdev(ni_priv->bus_interface);
1341+
struct usb_device *usb_dev;
13101342
u8 *out_data, *in_data;
13111343
static const int out_data_length = 0x10;
13121344
static const int in_data_length = 0x20;
@@ -1315,6 +1347,9 @@ static int ni_usb_parallel_poll(gpib_board_t *board, uint8_t *result)
13151347
int j = 0;
13161348
struct ni_usb_status_block status;
13171349

1350+
if (!ni_priv->bus_interface)
1351+
return -ENODEV;
1352+
usb_dev = interface_to_usbdev(ni_priv->bus_interface);
13181353
out_data = kmalloc(out_data_length, GFP_KERNEL);
13191354
if (!out_data)
13201355
return -ENOMEM;
@@ -1358,11 +1393,14 @@ static void ni_usb_parallel_poll_configure(gpib_board_t *board, uint8_t config)
13581393
{
13591394
int retval;
13601395
struct ni_usb_priv *ni_priv = board->private_data;
1361-
struct usb_device *usb_dev = interface_to_usbdev(ni_priv->bus_interface);
1396+
struct usb_device *usb_dev;
13621397
int i = 0;
13631398
struct ni_usb_register writes[1];
13641399
unsigned int ibsta;
13651400

1401+
if (!ni_priv->bus_interface)
1402+
return; // -ENODEV;
1403+
usb_dev = interface_to_usbdev(ni_priv->bus_interface);
13661404
writes[i].device = NIUSB_SUBDEV_TNT4882;
13671405
writes[i].address = nec7210_to_tnt4882_offset(AUXMR);
13681406
writes[i].value = PPR | config;
@@ -1380,11 +1418,14 @@ static void ni_usb_parallel_poll_response(gpib_board_t *board, int ist)
13801418
{
13811419
int retval;
13821420
struct ni_usb_priv *ni_priv = board->private_data;
1383-
struct usb_device *usb_dev = interface_to_usbdev(ni_priv->bus_interface);
1421+
struct usb_device *usb_dev;
13841422
int i = 0;
13851423
struct ni_usb_register writes[1];
13861424
unsigned int ibsta;
13871425

1426+
if (!ni_priv->bus_interface)
1427+
return; // -ENODEV;
1428+
usb_dev = interface_to_usbdev(ni_priv->bus_interface);
13881429
writes[i].device = NIUSB_SUBDEV_TNT4882;
13891430
writes[i].address = nec7210_to_tnt4882_offset(AUXMR);
13901431
if (ist)
@@ -1405,11 +1446,14 @@ static void ni_usb_serial_poll_response(gpib_board_t *board, u8 status)
14051446
{
14061447
int retval;
14071448
struct ni_usb_priv *ni_priv = board->private_data;
1408-
struct usb_device *usb_dev = interface_to_usbdev(ni_priv->bus_interface);
1449+
struct usb_device *usb_dev;
14091450
int i = 0;
14101451
struct ni_usb_register writes[1];
14111452
unsigned int ibsta;
14121453

1454+
if (!ni_priv->bus_interface)
1455+
return; // -ENODEV;
1456+
usb_dev = interface_to_usbdev(ni_priv->bus_interface);
14131457
writes[i].device = NIUSB_SUBDEV_TNT4882;
14141458
writes[i].address = nec7210_to_tnt4882_offset(SPMR);
14151459
writes[i].value = status;
@@ -1432,11 +1476,14 @@ static void ni_usb_return_to_local(gpib_board_t *board)
14321476
{
14331477
int retval;
14341478
struct ni_usb_priv *ni_priv = board->private_data;
1435-
struct usb_device *usb_dev = interface_to_usbdev(ni_priv->bus_interface);
1479+
struct usb_device *usb_dev;
14361480
int i = 0;
14371481
struct ni_usb_register writes[1];
14381482
unsigned int ibsta;
14391483

1484+
if (!ni_priv->bus_interface)
1485+
return; // -ENODEV;
1486+
usb_dev = interface_to_usbdev(ni_priv->bus_interface);
14401487
writes[i].device = NIUSB_SUBDEV_TNT4882;
14411488
writes[i].address = nec7210_to_tnt4882_offset(AUXMR);
14421489
writes[i].value = AUX_RTL;
@@ -1454,7 +1501,7 @@ static int ni_usb_line_status(const gpib_board_t *board)
14541501
{
14551502
int retval;
14561503
struct ni_usb_priv *ni_priv = board->private_data;
1457-
struct usb_device *usb_dev = interface_to_usbdev(ni_priv->bus_interface);
1504+
struct usb_device *usb_dev;
14581505
u8 *out_data, *in_data;
14591506
static const int out_data_length = 0x20;
14601507
static const int in_data_length = 0x20;
@@ -1464,6 +1511,9 @@ static int ni_usb_line_status(const gpib_board_t *board)
14641511
int line_status = ValidALL;
14651512
// NI windows driver reads 0xd(HSSEL), 0xc (ARD0), 0x1f (BSR)
14661513

1514+
if (!ni_priv->bus_interface)
1515+
return -ENODEV;
1516+
usb_dev = interface_to_usbdev(ni_priv->bus_interface);
14671517
out_data = kmalloc(out_data_length, GFP_KERNEL);
14681518
if (!out_data)
14691519
return -ENOMEM;
@@ -1570,12 +1620,15 @@ static unsigned int ni_usb_t1_delay(gpib_board_t *board, unsigned int nano_sec)
15701620
{
15711621
int retval;
15721622
struct ni_usb_priv *ni_priv = board->private_data;
1573-
struct usb_device *usb_dev = interface_to_usbdev(ni_priv->bus_interface);
1623+
struct usb_device *usb_dev;
15741624
struct ni_usb_register writes[3];
15751625
unsigned int ibsta;
15761626
unsigned int actual_ns;
15771627
int i;
15781628

1629+
if (!ni_priv->bus_interface)
1630+
return -ENODEV;
1631+
usb_dev = interface_to_usbdev(ni_priv->bus_interface);
15791632
i = ni_usb_setup_t1_delay(writes, nano_sec, &actual_ns);
15801633
retval = ni_usb_write_registers(ni_priv, writes, i, &ibsta);
15811634
if (retval < 0) {

0 commit comments

Comments
 (0)