[PATCH] USB: cdc-acm: Prevent data loss when filling tty buffer.

From: Toby Gray
Date: Mon Mar 21 2011 - 08:41:44 EST


When sending large quantities of data through a CDC ACM channel it is possible
for data to be lost when attempting to copy the data to the tty buffer. This
occurs due to the return value from tty_insert_flip_string not being checked.

This patch adds checking for how many bytes have been inserted into the tty
buffer and returns any remaining bytes back to the filled read buffer list.

v1 - Initial patch that used memmove on remaining data.
v2 - Removed the use of memmove, using a buffer offset instead.
v3 - Adding extra throttling check to ensure wake-up after throttling.

Signed-off-by: Toby Gray <toby.gray@xxxxxxxxxxx>
---
drivers/usb/class/cdc-acm.c | 75 +++++++++++++++++++++++++++++++++++++-----
drivers/usb/class/cdc-acm.h | 4 ++-
2 files changed, 69 insertions(+), 10 deletions(-)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index f492a7f..8fe569a 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -363,6 +363,7 @@ static void acm_read_bulk(struct urb *urb)
dev_dbg(&acm->data->dev, "bulk rx status %d\n", status);

buf = rcv->buffer;
+ buf->head = buf->base;
buf->size = urb->actual_length;

if (likely(status == 0)) {
@@ -392,6 +393,7 @@ static void acm_rx_tasklet(unsigned long _acm)
struct acm_ru *rcv;
unsigned long flags;
unsigned char throttled;
+ int copied;

dbg("Entering acm_rx_tasklet");

@@ -423,12 +425,14 @@ next_buffer:

dbg("acm_rx_tasklet: procesing buf 0x%p, size = %d", buf, buf->size);

+ copied = buf->size;
if (tty) {
spin_lock_irqsave(&acm->throttle_lock, flags);
throttled = acm->throttle;
spin_unlock_irqrestore(&acm->throttle_lock, flags);
if (!throttled) {
- tty_insert_flip_string(tty, buf->base, buf->size);
+ copied = tty_insert_flip_string(tty,
+ buf->head, buf->size);
tty_flip_buffer_push(tty);
} else {
tty_kref_put(tty);
@@ -440,9 +444,24 @@ next_buffer:
}
}

- spin_lock_irqsave(&acm->read_lock, flags);
- list_add(&buf->list, &acm->spare_read_bufs);
- spin_unlock_irqrestore(&acm->read_lock, flags);
+ buf->head += copied;
+ buf->size -= copied;
+
+ if (buf->size == 0) {
+ spin_lock_irqsave(&acm->read_lock, flags);
+ list_add(&buf->list, &acm->spare_read_bufs);
+ spin_unlock_irqrestore(&acm->read_lock, flags);
+ } else {
+ tty_kref_put(tty);
+ dbg("Partial buffer fill");
+ spin_lock_irqsave(&acm->read_lock, flags);
+ list_add(&buf->list, &acm->filled_read_bufs);
+ spin_unlock_irqrestore(&acm->read_lock, flags);
+ /* Make sure that the tasklet will get run again. */
+ schedule_work(&acm->work_throttle_check);
+ return;
+ }
+
goto next_buffer;

urbs:
@@ -519,14 +538,14 @@ static void acm_write_bulk(struct urb *urb)
acm_write_done(acm, wb);
spin_unlock_irqrestore(&acm->write_lock, flags);
if (ACM_READY(acm))
- schedule_work(&acm->work);
+ schedule_work(&acm->work_wake);
else
wake_up_interruptible(&acm->drain_wait);
}

-static void acm_softint(struct work_struct *work)
+static void acm_softint_wake(struct work_struct *work)
{
- struct acm *acm = container_of(work, struct acm, work);
+ struct acm *acm = container_of(work, struct acm, work_wake);
struct tty_struct *tty;

dev_vdbg(&acm->data->dev, "tx work\n");
@@ -537,6 +556,42 @@ static void acm_softint(struct work_struct *work)
tty_kref_put(tty);
}

+static void acm_softint_throttle_check(struct work_struct *work)
+{
+ struct acm *acm = container_of(work, struct acm, work_throttle_check);
+ struct tty_struct *tty;
+ struct acm_rb *buf;
+ size_t needed = 1;
+ int available;
+
+ dev_vdbg(&acm->data->dev, "throttle check\n");
+ if (!ACM_READY(acm))
+ return;
+ tty = tty_port_tty_get(&acm->port);
+ if (!tty)
+ return;
+
+ /* See how much space is needed */
+ spin_lock(&acm->read_lock);
+ if (!list_empty(&acm->filled_read_bufs)) {
+ buf = list_entry(acm->filled_read_bufs.next,
+ struct acm_rb, list);
+ needed = buf->size;
+ }
+ spin_unlock(&acm->read_lock);
+
+ available = tty_buffer_request_room(tty, needed);
+ if (available < needed) {
+ /* Throttle so that notification occurs when there is
+ * more space available in the buffers. */
+ tty_throttle(tty);
+ } else {
+ /* Buffer has already been emptied, restart reading */
+ tasklet_schedule(&acm->urb_task);
+ }
+ tty_kref_put(tty);
+}
+
/*
* TTY handlers
*/
@@ -1159,7 +1214,8 @@ made_compressed_probe:
acm->rx_buflimit = num_rx_buf;
acm->urb_task.func = acm_rx_tasklet;
acm->urb_task.data = (unsigned long) acm;
- INIT_WORK(&acm->work, acm_softint);
+ INIT_WORK(&acm->work_wake, acm_softint_wake);
+ INIT_WORK(&acm->work_throttle_check, acm_softint_throttle_check);
init_waitqueue_head(&acm->drain_wait);
spin_lock_init(&acm->throttle_lock);
spin_lock_init(&acm->write_lock);
@@ -1316,6 +1372,7 @@ static void stop_data_traffic(struct acm *acm)
dbg("Entering stop_data_traffic");

tasklet_disable(&acm->urb_task);
+ cancel_work_sync(&acm->work_throttle_check);

usb_kill_urb(acm->ctrlurb);
for (i = 0; i < ACM_NW; i++)
@@ -1325,7 +1382,7 @@ static void stop_data_traffic(struct acm *acm)

tasklet_enable(&acm->urb_task);

- cancel_work_sync(&acm->work);
+ cancel_work_sync(&acm->work_wake);
}

static void acm_disconnect(struct usb_interface *intf)
diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
index 5eeb570..b7cf391 100644
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -75,6 +75,7 @@ struct acm_rb {
struct list_head list;
int size;
unsigned char *base;
+ unsigned char *head;
dma_addr_t dma;
};

@@ -111,7 +112,8 @@ struct acm {
spinlock_t write_lock;
struct mutex mutex;
struct usb_cdc_line_coding line; /* bits, stop, parity */
- struct work_struct work; /* work queue entry for line discipline waking up */
+ struct work_struct work_wake; /* for tty wake up */
+ struct work_struct work_throttle_check; /* for throttling */
wait_queue_head_t drain_wait; /* close processing */
struct tasklet_struct urb_task; /* rx processing */
spinlock_t throttle_lock; /* synchronize throtteling and read callback */
--
1.7.0.4


--------------090906060409000709020902--
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/