USB: cypress_cy7c63: race disconnect/sysfs read-write leading to following NULL pointer
[linux-2.6] / drivers / usb / misc / usblcd.c
1 /*****************************************************************************
2  *                          USBLCD Kernel Driver                             *
3  *                            Version 1.05                                   *
4  *             (C) 2005 Georges Toth <g.toth@e-biz.lu>                       *
5  *                                                                           *
6  *     This file is licensed under the GPL. See COPYING in the package.      *
7  * Based on usb-skeleton.c 2.0 by Greg Kroah-Hartman (greg@kroah.com)        *
8  *                                                                           *
9  *                                                                           *
10  * 28.02.05 Complete rewrite of the original usblcd.c driver,                *
11  *          based on usb_skeleton.c.                                         *
12  *          This new driver allows more than one USB-LCD to be connected     *
13  *          and controlled, at once                                          *
14  *****************************************************************************/
15 #include <linux/module.h>
16 #include <linux/kernel.h>
17 #include <linux/init.h>
18 #include <linux/slab.h>
19 #include <linux/errno.h>
20 #include <asm/uaccess.h>
21 #include <linux/usb.h>
22
23 #define DRIVER_VERSION "USBLCD Driver Version 1.05"
24
25 #define USBLCD_MINOR            144
26
27 #define IOCTL_GET_HARD_VERSION  1
28 #define IOCTL_GET_DRV_VERSION   2
29
30
31 static struct usb_device_id id_table [] = {
32         { .idVendor = 0x10D2, .match_flags = USB_DEVICE_ID_MATCH_VENDOR, },
33         { },
34 };
35 MODULE_DEVICE_TABLE (usb, id_table);
36
37
38 struct usb_lcd {
39         struct usb_device *     udev;                   /* init: probe_lcd */
40         struct usb_interface *  interface;              /* the interface for this device */
41         unsigned char *         bulk_in_buffer;         /* the buffer to receive data */
42         size_t                  bulk_in_size;           /* the size of the receive buffer */
43         __u8                    bulk_in_endpointAddr;   /* the address of the bulk in endpoint */
44         __u8                    bulk_out_endpointAddr;  /* the address of the bulk out endpoint */
45         struct kref             kref;
46 };
47 #define to_lcd_dev(d) container_of(d, struct usb_lcd, kref)
48
49 static struct usb_driver lcd_driver;
50 static DEFINE_MUTEX(usb_lcd_open_mutex);
51
52
53 static void lcd_delete(struct kref *kref)
54 {
55         struct usb_lcd *dev = to_lcd_dev(kref);
56
57         usb_put_dev(dev->udev);
58         kfree (dev->bulk_in_buffer);
59         kfree (dev);
60 }
61
62
63 static int lcd_open(struct inode *inode, struct file *file)
64 {
65         struct usb_lcd *dev;
66         struct usb_interface *interface;
67         int subminor;
68         int retval = 0;
69
70         subminor = iminor(inode);
71
72         mutex_lock(&usb_lcd_open_mutex);
73         interface = usb_find_interface(&lcd_driver, subminor);
74         if (!interface) {
75                 err ("USBLCD: %s - error, can't find device for minor %d",
76                      __FUNCTION__, subminor);
77                 retval = -ENODEV;
78                 goto exit;
79         }
80
81         dev = usb_get_intfdata(interface);
82         if (!dev) {
83                 retval = -ENODEV;
84                 goto exit;
85         }
86
87         /* increment our usage count for the device */
88         kref_get(&dev->kref);
89
90         /* save our object in the file's private structure */
91         file->private_data = dev;
92
93 exit:
94         mutex_unlock(&usb_lcd_open_mutex);
95         return retval;
96 }
97
98 static int lcd_release(struct inode *inode, struct file *file)
99 {
100         struct usb_lcd *dev;
101
102         dev = (struct usb_lcd *)file->private_data;
103         if (dev == NULL)
104                 return -ENODEV;
105
106         /* decrement the count on our device */
107         kref_put(&dev->kref, lcd_delete);
108         return 0;
109 }
110
111 static ssize_t lcd_read(struct file *file, char __user * buffer, size_t count, loff_t *ppos)
112 {
113         struct usb_lcd *dev;
114         int retval = 0;
115         int bytes_read;
116
117         dev = (struct usb_lcd *)file->private_data;
118
119         /* do a blocking bulk read to get data from the device */
120         retval = usb_bulk_msg(dev->udev, 
121                               usb_rcvbulkpipe(dev->udev, dev->bulk_in_endpointAddr),
122                               dev->bulk_in_buffer,
123                               min(dev->bulk_in_size, count),
124                               &bytes_read, 10000);
125
126         /* if the read was successful, copy the data to userspace */
127         if (!retval) {
128                 if (copy_to_user(buffer, dev->bulk_in_buffer, bytes_read))
129                         retval = -EFAULT;
130                 else
131                         retval = bytes_read;
132         }
133
134         return retval;
135 }
136
137 static int lcd_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
138 {
139         struct usb_lcd *dev;
140         u16 bcdDevice;
141         char buf[30];
142
143         dev = (struct usb_lcd *)file->private_data;
144         if (dev == NULL)
145                 return -ENODEV;
146         
147         switch (cmd) {
148         case IOCTL_GET_HARD_VERSION:
149                 bcdDevice = le16_to_cpu((dev->udev)->descriptor.bcdDevice);
150                 sprintf(buf,"%1d%1d.%1d%1d",
151                         (bcdDevice & 0xF000)>>12,
152                         (bcdDevice & 0xF00)>>8,
153                         (bcdDevice & 0xF0)>>4,
154                         (bcdDevice & 0xF));
155                 if (copy_to_user((void __user *)arg,buf,strlen(buf))!=0)
156                         return -EFAULT;
157                 break;
158         case IOCTL_GET_DRV_VERSION:
159                 sprintf(buf,DRIVER_VERSION);
160                 if (copy_to_user((void __user *)arg,buf,strlen(buf))!=0)
161                         return -EFAULT;
162                 break;
163         default:
164                 return -ENOTTY;
165                 break;
166         }
167
168         return 0;
169 }
170
171 static void lcd_write_bulk_callback(struct urb *urb)
172 {
173         struct usb_lcd *dev;
174
175         dev = (struct usb_lcd *)urb->context;
176
177         /* sync/async unlink faults aren't errors */
178         if (urb->status &&
179             !(urb->status == -ENOENT ||
180               urb->status == -ECONNRESET ||
181               urb->status == -ESHUTDOWN)) {
182                 dbg("USBLCD: %s - nonzero write bulk status received: %d",
183                     __FUNCTION__, urb->status);
184         }
185
186         /* free up our allocated buffer */
187         usb_buffer_free(urb->dev, urb->transfer_buffer_length,
188                         urb->transfer_buffer, urb->transfer_dma);
189 }
190
191 static ssize_t lcd_write(struct file *file, const char __user * user_buffer, size_t count, loff_t *ppos)
192 {
193         struct usb_lcd *dev;
194         int retval = 0;
195         struct urb *urb = NULL;
196         char *buf = NULL;
197         
198         dev = (struct usb_lcd *)file->private_data;
199         
200         /* verify that we actually have some data to write */
201         if (count == 0)
202                 goto exit;
203
204         /* create a urb, and a buffer for it, and copy the data to the urb */
205         urb = usb_alloc_urb(0, GFP_KERNEL);
206         if (!urb)
207                 return -ENOMEM;
208         
209         buf = usb_buffer_alloc(dev->udev, count, GFP_KERNEL, &urb->transfer_dma);
210         if (!buf) {
211                 retval = -ENOMEM;
212                 goto error;
213         }
214         
215         if (copy_from_user(buf, user_buffer, count)) {
216                 retval = -EFAULT;
217                 goto error;
218         }
219         
220         /* initialize the urb properly */
221         usb_fill_bulk_urb(urb, dev->udev,
222                           usb_sndbulkpipe(dev->udev, dev->bulk_out_endpointAddr),
223                           buf, count, lcd_write_bulk_callback, dev);
224         urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
225         
226         /* send the data out the bulk port */
227         retval = usb_submit_urb(urb, GFP_KERNEL);
228         if (retval) {
229                 err("USBLCD: %s - failed submitting write urb, error %d", __FUNCTION__, retval);
230                 goto error;
231         }
232         
233         /* release our reference to this urb, the USB core will eventually free it entirely */
234         usb_free_urb(urb);
235
236 exit:
237         return count;
238
239 error:
240         usb_buffer_free(dev->udev, count, buf, urb->transfer_dma);
241         usb_free_urb(urb);
242         return retval;
243 }
244
245 static const struct file_operations lcd_fops = {
246         .owner =        THIS_MODULE,
247         .read =         lcd_read,
248         .write =        lcd_write,
249         .open =         lcd_open,
250         .ioctl =        lcd_ioctl,
251         .release =      lcd_release,
252 };
253
254 /*
255  * usb class driver info in order to get a minor number from the usb core,
256  * and to have the device registered with the driver core
257  */
258 static struct usb_class_driver lcd_class = {
259         .name =         "lcd%d",
260         .fops =         &lcd_fops,
261         .minor_base =   USBLCD_MINOR,
262 };
263
264 static int lcd_probe(struct usb_interface *interface, const struct usb_device_id *id)
265 {
266         struct usb_lcd *dev = NULL;
267         struct usb_host_interface *iface_desc;
268         struct usb_endpoint_descriptor *endpoint;
269         size_t buffer_size;
270         int i;
271         int retval = -ENOMEM;
272
273         /* allocate memory for our device state and initialize it */
274         dev = kzalloc(sizeof(*dev), GFP_KERNEL);
275         if (dev == NULL) {
276                 err("Out of memory");
277                 goto error;
278         }
279         kref_init(&dev->kref);
280
281         dev->udev = usb_get_dev(interface_to_usbdev(interface));
282         dev->interface = interface;
283
284         if (le16_to_cpu(dev->udev->descriptor.idProduct) != 0x0001) {
285                 warn(KERN_INFO "USBLCD model not supported.");
286                 return -ENODEV;
287         }
288         
289         /* set up the endpoint information */
290         /* use only the first bulk-in and bulk-out endpoints */
291         iface_desc = interface->cur_altsetting;
292         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
293                 endpoint = &iface_desc->endpoint[i].desc;
294
295                 if (!dev->bulk_in_endpointAddr &&
296                     usb_endpoint_is_bulk_in(endpoint)) {
297                         /* we found a bulk in endpoint */
298                         buffer_size = le16_to_cpu(endpoint->wMaxPacketSize);
299                         dev->bulk_in_size = buffer_size;
300                         dev->bulk_in_endpointAddr = endpoint->bEndpointAddress;
301                         dev->bulk_in_buffer = kmalloc(buffer_size, GFP_KERNEL);
302                         if (!dev->bulk_in_buffer) {
303                                 err("Could not allocate bulk_in_buffer");
304                                 goto error;
305                         }
306                 }
307
308                 if (!dev->bulk_out_endpointAddr &&
309                     usb_endpoint_is_bulk_out(endpoint)) {
310                         /* we found a bulk out endpoint */
311                         dev->bulk_out_endpointAddr = endpoint->bEndpointAddress;
312                 }
313         }
314         if (!(dev->bulk_in_endpointAddr && dev->bulk_out_endpointAddr)) {
315                 err("Could not find both bulk-in and bulk-out endpoints");
316                 goto error;
317         }
318
319         /* save our data pointer in this interface device */
320         usb_set_intfdata(interface, dev);
321
322         /* we can register the device now, as it is ready */
323         retval = usb_register_dev(interface, &lcd_class);
324         if (retval) {
325                 /* something prevented us from registering this driver */
326                 err("Not able to get a minor for this device.");
327                 usb_set_intfdata(interface, NULL);
328                 goto error;
329         }
330
331         i = le16_to_cpu(dev->udev->descriptor.bcdDevice);
332
333         info("USBLCD Version %1d%1d.%1d%1d found at address %d",
334                 (i & 0xF000)>>12,(i & 0xF00)>>8,(i & 0xF0)>>4,(i & 0xF),
335                 dev->udev->devnum);
336
337         /* let the user know what node this device is now attached to */
338         info("USB LCD device now attached to USBLCD-%d", interface->minor);
339         return 0;
340
341 error:
342         if (dev)
343                 kref_put(&dev->kref, lcd_delete);
344         return retval;
345 }
346
347 static void lcd_disconnect(struct usb_interface *interface)
348 {
349         struct usb_lcd *dev;
350         int minor = interface->minor;
351
352         /* prevent skel_open() from racing skel_disconnect() */
353         mutex_lock(&usb_lcd_open_mutex);
354
355         dev = usb_get_intfdata(interface);
356         usb_set_intfdata(interface, NULL);
357
358         /* give back our minor */
359         usb_deregister_dev(interface, &lcd_class);
360  
361         mutex_unlock(&usb_lcd_open_mutex);
362
363         /* decrement our usage count */
364         kref_put(&dev->kref, lcd_delete);
365
366         info("USB LCD #%d now disconnected", minor);
367 }
368
369 static struct usb_driver lcd_driver = {
370         .name =         "usblcd",
371         .probe =        lcd_probe,
372         .disconnect =   lcd_disconnect,
373         .id_table =     id_table,
374 };
375
376 static int __init usb_lcd_init(void)
377 {
378         int result;
379         
380         result = usb_register(&lcd_driver);
381         if (result)
382                 err("usb_register failed. Error number %d", result);
383
384         return result;
385 }
386
387
388 static void __exit usb_lcd_exit(void)
389 {
390         usb_deregister(&lcd_driver);
391 }
392
393 module_init(usb_lcd_init);
394 module_exit(usb_lcd_exit);
395
396 MODULE_AUTHOR("Georges Toth <g.toth@e-biz.lu>");
397 MODULE_DESCRIPTION(DRIVER_VERSION);
398 MODULE_LICENSE("GPL");