USB: adutux: fix use-after-free on release
[platform/kernel/linux-rpi.git] / drivers / usb / misc / adutux.c
1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * adutux - driver for ADU devices from Ontrak Control Systems
4  * This is an experimental driver. Use at your own risk.
5  * This driver is not supported by Ontrak Control Systems.
6  *
7  * Copyright (c) 2003 John Homppi (SCO, leave this notice here)
8  *
9  * derived from the Lego USB Tower driver 0.56:
10  * Copyright (c) 2003 David Glance <davidgsf@sourceforge.net>
11  *               2001 Juergen Stuber <stuber@loria.fr>
12  * that was derived from USB Skeleton driver - 0.5
13  * Copyright (c) 2001 Greg Kroah-Hartman (greg@kroah.com)
14  *
15  */
16
17 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
18
19 #include <linux/kernel.h>
20 #include <linux/sched/signal.h>
21 #include <linux/errno.h>
22 #include <linux/slab.h>
23 #include <linux/module.h>
24 #include <linux/usb.h>
25 #include <linux/mutex.h>
26 #include <linux/uaccess.h>
27
28 #define DRIVER_AUTHOR "John Homppi"
29 #define DRIVER_DESC "adutux (see www.ontrak.net)"
30
31 /* Define these values to match your device */
32 #define ADU_VENDOR_ID 0x0a07
33 #define ADU_PRODUCT_ID 0x0064
34
35 /* table of devices that work with this driver */
36 static const struct usb_device_id device_table[] = {
37         { USB_DEVICE(ADU_VENDOR_ID, ADU_PRODUCT_ID) },          /* ADU100 */
38         { USB_DEVICE(ADU_VENDOR_ID, ADU_PRODUCT_ID+20) },       /* ADU120 */
39         { USB_DEVICE(ADU_VENDOR_ID, ADU_PRODUCT_ID+30) },       /* ADU130 */
40         { USB_DEVICE(ADU_VENDOR_ID, ADU_PRODUCT_ID+100) },      /* ADU200 */
41         { USB_DEVICE(ADU_VENDOR_ID, ADU_PRODUCT_ID+108) },      /* ADU208 */
42         { USB_DEVICE(ADU_VENDOR_ID, ADU_PRODUCT_ID+118) },      /* ADU218 */
43         { } /* Terminating entry */
44 };
45
46 MODULE_DEVICE_TABLE(usb, device_table);
47
48 #ifdef CONFIG_USB_DYNAMIC_MINORS
49 #define ADU_MINOR_BASE  0
50 #else
51 #define ADU_MINOR_BASE  67
52 #endif
53
54 /* we can have up to this number of device plugged in at once */
55 #define MAX_DEVICES     16
56
57 #define COMMAND_TIMEOUT (2*HZ)
58
59 /*
60  * The locking scheme is a vanilla 3-lock:
61  *   adu_device.buflock: A spinlock, covers what IRQs touch.
62  *   adutux_mutex:       A Static lock to cover open_count. It would also cover
63  *                       any globals, but we don't have them in 2.6.
64  *   adu_device.mtx:     A mutex to hold across sleepers like copy_from_user.
65  *                       It covers all of adu_device, except the open_count
66  *                       and what .buflock covers.
67  */
68
69 /* Structure to hold all of our device specific stuff */
70 struct adu_device {
71         struct mutex            mtx;
72         struct usb_device *udev; /* save off the usb device pointer */
73         struct usb_interface *interface;
74         unsigned int            minor; /* the starting minor number for this device */
75         char                    serial_number[8];
76
77         int                     open_count; /* number of times this port has been opened */
78         unsigned long           disconnected:1;
79
80         char            *read_buffer_primary;
81         int                     read_buffer_length;
82         char            *read_buffer_secondary;
83         int                     secondary_head;
84         int                     secondary_tail;
85         spinlock_t              buflock;
86
87         wait_queue_head_t       read_wait;
88         wait_queue_head_t       write_wait;
89
90         char            *interrupt_in_buffer;
91         struct usb_endpoint_descriptor *interrupt_in_endpoint;
92         struct urb      *interrupt_in_urb;
93         int                     read_urb_finished;
94
95         char            *interrupt_out_buffer;
96         struct usb_endpoint_descriptor *interrupt_out_endpoint;
97         struct urb      *interrupt_out_urb;
98         int                     out_urb_finished;
99 };
100
101 static DEFINE_MUTEX(adutux_mutex);
102
103 static struct usb_driver adu_driver;
104
105 static inline void adu_debug_data(struct device *dev, const char *function,
106                                   int size, const unsigned char *data)
107 {
108         dev_dbg(dev, "%s - length = %d, data = %*ph\n",
109                 function, size, size, data);
110 }
111
112 /**
113  * adu_abort_transfers
114  *      aborts transfers and frees associated data structures
115  */
116 static void adu_abort_transfers(struct adu_device *dev)
117 {
118         unsigned long flags;
119
120         if (dev->disconnected)
121                 return;
122
123         /* shutdown transfer */
124
125         /* XXX Anchor these instead */
126         spin_lock_irqsave(&dev->buflock, flags);
127         if (!dev->read_urb_finished) {
128                 spin_unlock_irqrestore(&dev->buflock, flags);
129                 usb_kill_urb(dev->interrupt_in_urb);
130         } else
131                 spin_unlock_irqrestore(&dev->buflock, flags);
132
133         spin_lock_irqsave(&dev->buflock, flags);
134         if (!dev->out_urb_finished) {
135                 spin_unlock_irqrestore(&dev->buflock, flags);
136                 wait_event_timeout(dev->write_wait, dev->out_urb_finished,
137                         COMMAND_TIMEOUT);
138                 usb_kill_urb(dev->interrupt_out_urb);
139         } else
140                 spin_unlock_irqrestore(&dev->buflock, flags);
141 }
142
143 static void adu_delete(struct adu_device *dev)
144 {
145         /* free data structures */
146         usb_free_urb(dev->interrupt_in_urb);
147         usb_free_urb(dev->interrupt_out_urb);
148         kfree(dev->read_buffer_primary);
149         kfree(dev->read_buffer_secondary);
150         kfree(dev->interrupt_in_buffer);
151         kfree(dev->interrupt_out_buffer);
152         usb_put_dev(dev->udev);
153         kfree(dev);
154 }
155
156 static void adu_interrupt_in_callback(struct urb *urb)
157 {
158         struct adu_device *dev = urb->context;
159         int status = urb->status;
160         unsigned long flags;
161
162         adu_debug_data(&dev->udev->dev, __func__,
163                        urb->actual_length, urb->transfer_buffer);
164
165         spin_lock_irqsave(&dev->buflock, flags);
166
167         if (status != 0) {
168                 if ((status != -ENOENT) && (status != -ECONNRESET) &&
169                         (status != -ESHUTDOWN)) {
170                         dev_dbg(&dev->udev->dev,
171                                 "%s : nonzero status received: %d\n",
172                                 __func__, status);
173                 }
174                 goto exit;
175         }
176
177         if (urb->actual_length > 0 && dev->interrupt_in_buffer[0] != 0x00) {
178                 if (dev->read_buffer_length <
179                     (4 * usb_endpoint_maxp(dev->interrupt_in_endpoint)) -
180                      (urb->actual_length)) {
181                         memcpy (dev->read_buffer_primary +
182                                 dev->read_buffer_length,
183                                 dev->interrupt_in_buffer, urb->actual_length);
184
185                         dev->read_buffer_length += urb->actual_length;
186                         dev_dbg(&dev->udev->dev,"%s reading  %d\n", __func__,
187                                 urb->actual_length);
188                 } else {
189                         dev_dbg(&dev->udev->dev,"%s : read_buffer overflow\n",
190                                 __func__);
191                 }
192         }
193
194 exit:
195         dev->read_urb_finished = 1;
196         spin_unlock_irqrestore(&dev->buflock, flags);
197         /* always wake up so we recover from errors */
198         wake_up_interruptible(&dev->read_wait);
199 }
200
201 static void adu_interrupt_out_callback(struct urb *urb)
202 {
203         struct adu_device *dev = urb->context;
204         int status = urb->status;
205         unsigned long flags;
206
207         adu_debug_data(&dev->udev->dev, __func__,
208                        urb->actual_length, urb->transfer_buffer);
209
210         if (status != 0) {
211                 if ((status != -ENOENT) &&
212                     (status != -ECONNRESET)) {
213                         dev_dbg(&dev->udev->dev,
214                                 "%s :nonzero status received: %d\n", __func__,
215                                 status);
216                 }
217                 return;
218         }
219
220         spin_lock_irqsave(&dev->buflock, flags);
221         dev->out_urb_finished = 1;
222         wake_up(&dev->write_wait);
223         spin_unlock_irqrestore(&dev->buflock, flags);
224 }
225
226 static int adu_open(struct inode *inode, struct file *file)
227 {
228         struct adu_device *dev = NULL;
229         struct usb_interface *interface;
230         int subminor;
231         int retval;
232
233         subminor = iminor(inode);
234
235         retval = mutex_lock_interruptible(&adutux_mutex);
236         if (retval)
237                 goto exit_no_lock;
238
239         interface = usb_find_interface(&adu_driver, subminor);
240         if (!interface) {
241                 pr_err("%s - error, can't find device for minor %d\n",
242                        __func__, subminor);
243                 retval = -ENODEV;
244                 goto exit_no_device;
245         }
246
247         dev = usb_get_intfdata(interface);
248         if (!dev) {
249                 retval = -ENODEV;
250                 goto exit_no_device;
251         }
252
253         /* check that nobody else is using the device */
254         if (dev->open_count) {
255                 retval = -EBUSY;
256                 goto exit_no_device;
257         }
258
259         ++dev->open_count;
260         dev_dbg(&dev->udev->dev, "%s: open count %d\n", __func__,
261                 dev->open_count);
262
263         /* save device in the file's private structure */
264         file->private_data = dev;
265
266         /* initialize in direction */
267         dev->read_buffer_length = 0;
268
269         /* fixup first read by having urb waiting for it */
270         usb_fill_int_urb(dev->interrupt_in_urb, dev->udev,
271                          usb_rcvintpipe(dev->udev,
272                                         dev->interrupt_in_endpoint->bEndpointAddress),
273                          dev->interrupt_in_buffer,
274                          usb_endpoint_maxp(dev->interrupt_in_endpoint),
275                          adu_interrupt_in_callback, dev,
276                          dev->interrupt_in_endpoint->bInterval);
277         dev->read_urb_finished = 0;
278         if (usb_submit_urb(dev->interrupt_in_urb, GFP_KERNEL))
279                 dev->read_urb_finished = 1;
280         /* we ignore failure */
281         /* end of fixup for first read */
282
283         /* initialize out direction */
284         dev->out_urb_finished = 1;
285
286         retval = 0;
287
288 exit_no_device:
289         mutex_unlock(&adutux_mutex);
290 exit_no_lock:
291         return retval;
292 }
293
294 static void adu_release_internal(struct adu_device *dev)
295 {
296         /* decrement our usage count for the device */
297         --dev->open_count;
298         dev_dbg(&dev->udev->dev, "%s : open count %d\n", __func__,
299                 dev->open_count);
300         if (dev->open_count <= 0) {
301                 adu_abort_transfers(dev);
302                 dev->open_count = 0;
303         }
304 }
305
306 static int adu_release(struct inode *inode, struct file *file)
307 {
308         struct adu_device *dev;
309         int retval = 0;
310
311         if (file == NULL) {
312                 retval = -ENODEV;
313                 goto exit;
314         }
315
316         dev = file->private_data;
317         if (dev == NULL) {
318                 retval = -ENODEV;
319                 goto exit;
320         }
321
322         mutex_lock(&adutux_mutex); /* not interruptible */
323
324         if (dev->open_count <= 0) {
325                 dev_dbg(&dev->udev->dev, "%s : device not opened\n", __func__);
326                 retval = -ENODEV;
327                 goto unlock;
328         }
329
330         adu_release_internal(dev);
331         if (dev->disconnected) {
332                 /* the device was unplugged before the file was released */
333                 if (!dev->open_count)   /* ... and we're the last user */
334                         adu_delete(dev);
335         }
336 unlock:
337         mutex_unlock(&adutux_mutex);
338 exit:
339         return retval;
340 }
341
342 static ssize_t adu_read(struct file *file, __user char *buffer, size_t count,
343                         loff_t *ppos)
344 {
345         struct adu_device *dev;
346         size_t bytes_read = 0;
347         size_t bytes_to_read = count;
348         int i;
349         int retval = 0;
350         int timeout = 0;
351         int should_submit = 0;
352         unsigned long flags;
353         DECLARE_WAITQUEUE(wait, current);
354
355         dev = file->private_data;
356         if (mutex_lock_interruptible(&dev->mtx))
357                 return -ERESTARTSYS;
358
359         /* verify that the device wasn't unplugged */
360         if (dev->disconnected) {
361                 retval = -ENODEV;
362                 pr_err("No device or device unplugged %d\n", retval);
363                 goto exit;
364         }
365
366         /* verify that some data was requested */
367         if (count == 0) {
368                 dev_dbg(&dev->udev->dev, "%s : read request of 0 bytes\n",
369                         __func__);
370                 goto exit;
371         }
372
373         timeout = COMMAND_TIMEOUT;
374         dev_dbg(&dev->udev->dev, "%s : about to start looping\n", __func__);
375         while (bytes_to_read) {
376                 int data_in_secondary = dev->secondary_tail - dev->secondary_head;
377                 dev_dbg(&dev->udev->dev,
378                         "%s : while, data_in_secondary=%d, status=%d\n",
379                         __func__, data_in_secondary,
380                         dev->interrupt_in_urb->status);
381
382                 if (data_in_secondary) {
383                         /* drain secondary buffer */
384                         int amount = bytes_to_read < data_in_secondary ? bytes_to_read : data_in_secondary;
385                         i = copy_to_user(buffer, dev->read_buffer_secondary+dev->secondary_head, amount);
386                         if (i) {
387                                 retval = -EFAULT;
388                                 goto exit;
389                         }
390                         dev->secondary_head += (amount - i);
391                         bytes_read += (amount - i);
392                         bytes_to_read -= (amount - i);
393                 } else {
394                         /* we check the primary buffer */
395                         spin_lock_irqsave (&dev->buflock, flags);
396                         if (dev->read_buffer_length) {
397                                 /* we secure access to the primary */
398                                 char *tmp;
399                                 dev_dbg(&dev->udev->dev,
400                                         "%s : swap, read_buffer_length = %d\n",
401                                         __func__, dev->read_buffer_length);
402                                 tmp = dev->read_buffer_secondary;
403                                 dev->read_buffer_secondary = dev->read_buffer_primary;
404                                 dev->read_buffer_primary = tmp;
405                                 dev->secondary_head = 0;
406                                 dev->secondary_tail = dev->read_buffer_length;
407                                 dev->read_buffer_length = 0;
408                                 spin_unlock_irqrestore(&dev->buflock, flags);
409                                 /* we have a free buffer so use it */
410                                 should_submit = 1;
411                         } else {
412                                 /* even the primary was empty - we may need to do IO */
413                                 if (!dev->read_urb_finished) {
414                                         /* somebody is doing IO */
415                                         spin_unlock_irqrestore(&dev->buflock, flags);
416                                         dev_dbg(&dev->udev->dev,
417                                                 "%s : submitted already\n",
418                                                 __func__);
419                                 } else {
420                                         /* we must initiate input */
421                                         dev_dbg(&dev->udev->dev,
422                                                 "%s : initiate input\n",
423                                                 __func__);
424                                         dev->read_urb_finished = 0;
425                                         spin_unlock_irqrestore(&dev->buflock, flags);
426
427                                         usb_fill_int_urb(dev->interrupt_in_urb, dev->udev,
428                                                         usb_rcvintpipe(dev->udev,
429                                                                 dev->interrupt_in_endpoint->bEndpointAddress),
430                                                          dev->interrupt_in_buffer,
431                                                          usb_endpoint_maxp(dev->interrupt_in_endpoint),
432                                                          adu_interrupt_in_callback,
433                                                          dev,
434                                                          dev->interrupt_in_endpoint->bInterval);
435                                         retval = usb_submit_urb(dev->interrupt_in_urb, GFP_KERNEL);
436                                         if (retval) {
437                                                 dev->read_urb_finished = 1;
438                                                 if (retval == -ENOMEM) {
439                                                         retval = bytes_read ? bytes_read : -ENOMEM;
440                                                 }
441                                                 dev_dbg(&dev->udev->dev,
442                                                         "%s : submit failed\n",
443                                                         __func__);
444                                                 goto exit;
445                                         }
446                                 }
447
448                                 /* we wait for I/O to complete */
449                                 set_current_state(TASK_INTERRUPTIBLE);
450                                 add_wait_queue(&dev->read_wait, &wait);
451                                 spin_lock_irqsave(&dev->buflock, flags);
452                                 if (!dev->read_urb_finished) {
453                                         spin_unlock_irqrestore(&dev->buflock, flags);
454                                         timeout = schedule_timeout(COMMAND_TIMEOUT);
455                                 } else {
456                                         spin_unlock_irqrestore(&dev->buflock, flags);
457                                         set_current_state(TASK_RUNNING);
458                                 }
459                                 remove_wait_queue(&dev->read_wait, &wait);
460
461                                 if (timeout <= 0) {
462                                         dev_dbg(&dev->udev->dev,
463                                                 "%s : timeout\n", __func__);
464                                         retval = bytes_read ? bytes_read : -ETIMEDOUT;
465                                         goto exit;
466                                 }
467
468                                 if (signal_pending(current)) {
469                                         dev_dbg(&dev->udev->dev,
470                                                 "%s : signal pending\n",
471                                                 __func__);
472                                         retval = bytes_read ? bytes_read : -EINTR;
473                                         goto exit;
474                                 }
475                         }
476                 }
477         }
478
479         retval = bytes_read;
480         /* if the primary buffer is empty then use it */
481         spin_lock_irqsave(&dev->buflock, flags);
482         if (should_submit && dev->read_urb_finished) {
483                 dev->read_urb_finished = 0;
484                 spin_unlock_irqrestore(&dev->buflock, flags);
485                 usb_fill_int_urb(dev->interrupt_in_urb, dev->udev,
486                                  usb_rcvintpipe(dev->udev,
487                                         dev->interrupt_in_endpoint->bEndpointAddress),
488                                 dev->interrupt_in_buffer,
489                                 usb_endpoint_maxp(dev->interrupt_in_endpoint),
490                                 adu_interrupt_in_callback,
491                                 dev,
492                                 dev->interrupt_in_endpoint->bInterval);
493                 if (usb_submit_urb(dev->interrupt_in_urb, GFP_KERNEL) != 0)
494                         dev->read_urb_finished = 1;
495                 /* we ignore failure */
496         } else {
497                 spin_unlock_irqrestore(&dev->buflock, flags);
498         }
499
500 exit:
501         /* unlock the device */
502         mutex_unlock(&dev->mtx);
503
504         return retval;
505 }
506
507 static ssize_t adu_write(struct file *file, const __user char *buffer,
508                          size_t count, loff_t *ppos)
509 {
510         DECLARE_WAITQUEUE(waita, current);
511         struct adu_device *dev;
512         size_t bytes_written = 0;
513         size_t bytes_to_write;
514         size_t buffer_size;
515         unsigned long flags;
516         int retval;
517
518         dev = file->private_data;
519
520         retval = mutex_lock_interruptible(&dev->mtx);
521         if (retval)
522                 goto exit_nolock;
523
524         /* verify that the device wasn't unplugged */
525         if (dev->disconnected) {
526                 retval = -ENODEV;
527                 pr_err("No device or device unplugged %d\n", retval);
528                 goto exit;
529         }
530
531         /* verify that we actually have some data to write */
532         if (count == 0) {
533                 dev_dbg(&dev->udev->dev, "%s : write request of 0 bytes\n",
534                         __func__);
535                 goto exit;
536         }
537
538         while (count > 0) {
539                 add_wait_queue(&dev->write_wait, &waita);
540                 set_current_state(TASK_INTERRUPTIBLE);
541                 spin_lock_irqsave(&dev->buflock, flags);
542                 if (!dev->out_urb_finished) {
543                         spin_unlock_irqrestore(&dev->buflock, flags);
544
545                         mutex_unlock(&dev->mtx);
546                         if (signal_pending(current)) {
547                                 dev_dbg(&dev->udev->dev, "%s : interrupted\n",
548                                         __func__);
549                                 set_current_state(TASK_RUNNING);
550                                 retval = -EINTR;
551                                 goto exit_onqueue;
552                         }
553                         if (schedule_timeout(COMMAND_TIMEOUT) == 0) {
554                                 dev_dbg(&dev->udev->dev,
555                                         "%s - command timed out.\n", __func__);
556                                 retval = -ETIMEDOUT;
557                                 goto exit_onqueue;
558                         }
559                         remove_wait_queue(&dev->write_wait, &waita);
560                         retval = mutex_lock_interruptible(&dev->mtx);
561                         if (retval) {
562                                 retval = bytes_written ? bytes_written : retval;
563                                 goto exit_nolock;
564                         }
565
566                         dev_dbg(&dev->udev->dev,
567                                 "%s : in progress, count = %zd\n",
568                                 __func__, count);
569                 } else {
570                         spin_unlock_irqrestore(&dev->buflock, flags);
571                         set_current_state(TASK_RUNNING);
572                         remove_wait_queue(&dev->write_wait, &waita);
573                         dev_dbg(&dev->udev->dev, "%s : sending, count = %zd\n",
574                                 __func__, count);
575
576                         /* write the data into interrupt_out_buffer from userspace */
577                         buffer_size = usb_endpoint_maxp(dev->interrupt_out_endpoint);
578                         bytes_to_write = count > buffer_size ? buffer_size : count;
579                         dev_dbg(&dev->udev->dev,
580                                 "%s : buffer_size = %zd, count = %zd, bytes_to_write = %zd\n",
581                                 __func__, buffer_size, count, bytes_to_write);
582
583                         if (copy_from_user(dev->interrupt_out_buffer, buffer, bytes_to_write) != 0) {
584                                 retval = -EFAULT;
585                                 goto exit;
586                         }
587
588                         /* send off the urb */
589                         usb_fill_int_urb(
590                                 dev->interrupt_out_urb,
591                                 dev->udev,
592                                 usb_sndintpipe(dev->udev, dev->interrupt_out_endpoint->bEndpointAddress),
593                                 dev->interrupt_out_buffer,
594                                 bytes_to_write,
595                                 adu_interrupt_out_callback,
596                                 dev,
597                                 dev->interrupt_out_endpoint->bInterval);
598                         dev->interrupt_out_urb->actual_length = bytes_to_write;
599                         dev->out_urb_finished = 0;
600                         retval = usb_submit_urb(dev->interrupt_out_urb, GFP_KERNEL);
601                         if (retval < 0) {
602                                 dev->out_urb_finished = 1;
603                                 dev_err(&dev->udev->dev, "Couldn't submit "
604                                         "interrupt_out_urb %d\n", retval);
605                                 goto exit;
606                         }
607
608                         buffer += bytes_to_write;
609                         count -= bytes_to_write;
610
611                         bytes_written += bytes_to_write;
612                 }
613         }
614         mutex_unlock(&dev->mtx);
615         return bytes_written;
616
617 exit:
618         mutex_unlock(&dev->mtx);
619 exit_nolock:
620         return retval;
621
622 exit_onqueue:
623         remove_wait_queue(&dev->write_wait, &waita);
624         return retval;
625 }
626
627 /* file operations needed when we register this driver */
628 static const struct file_operations adu_fops = {
629         .owner = THIS_MODULE,
630         .read  = adu_read,
631         .write = adu_write,
632         .open = adu_open,
633         .release = adu_release,
634         .llseek = noop_llseek,
635 };
636
637 /*
638  * usb class driver info in order to get a minor number from the usb core,
639  * and to have the device registered with devfs and the driver core
640  */
641 static struct usb_class_driver adu_class = {
642         .name = "usb/adutux%d",
643         .fops = &adu_fops,
644         .minor_base = ADU_MINOR_BASE,
645 };
646
647 /**
648  * adu_probe
649  *
650  * Called by the usb core when a new device is connected that it thinks
651  * this driver might be interested in.
652  */
653 static int adu_probe(struct usb_interface *interface,
654                      const struct usb_device_id *id)
655 {
656         struct usb_device *udev = interface_to_usbdev(interface);
657         struct adu_device *dev = NULL;
658         int retval = -ENOMEM;
659         int in_end_size;
660         int out_end_size;
661         int res;
662
663         /* allocate memory for our device state and initialize it */
664         dev = kzalloc(sizeof(struct adu_device), GFP_KERNEL);
665         if (!dev)
666                 return -ENOMEM;
667
668         mutex_init(&dev->mtx);
669         spin_lock_init(&dev->buflock);
670         dev->udev = usb_get_dev(udev);
671         init_waitqueue_head(&dev->read_wait);
672         init_waitqueue_head(&dev->write_wait);
673
674         res = usb_find_common_endpoints_reverse(&interface->altsetting[0],
675                         NULL, NULL,
676                         &dev->interrupt_in_endpoint,
677                         &dev->interrupt_out_endpoint);
678         if (res) {
679                 dev_err(&interface->dev, "interrupt endpoints not found\n");
680                 retval = res;
681                 goto error;
682         }
683
684         in_end_size = usb_endpoint_maxp(dev->interrupt_in_endpoint);
685         out_end_size = usb_endpoint_maxp(dev->interrupt_out_endpoint);
686
687         dev->read_buffer_primary = kmalloc((4 * in_end_size), GFP_KERNEL);
688         if (!dev->read_buffer_primary)
689                 goto error;
690
691         /* debug code prime the buffer */
692         memset(dev->read_buffer_primary, 'a', in_end_size);
693         memset(dev->read_buffer_primary + in_end_size, 'b', in_end_size);
694         memset(dev->read_buffer_primary + (2 * in_end_size), 'c', in_end_size);
695         memset(dev->read_buffer_primary + (3 * in_end_size), 'd', in_end_size);
696
697         dev->read_buffer_secondary = kmalloc((4 * in_end_size), GFP_KERNEL);
698         if (!dev->read_buffer_secondary)
699                 goto error;
700
701         /* debug code prime the buffer */
702         memset(dev->read_buffer_secondary, 'e', in_end_size);
703         memset(dev->read_buffer_secondary + in_end_size, 'f', in_end_size);
704         memset(dev->read_buffer_secondary + (2 * in_end_size), 'g', in_end_size);
705         memset(dev->read_buffer_secondary + (3 * in_end_size), 'h', in_end_size);
706
707         dev->interrupt_in_buffer = kmalloc(in_end_size, GFP_KERNEL);
708         if (!dev->interrupt_in_buffer)
709                 goto error;
710
711         /* debug code prime the buffer */
712         memset(dev->interrupt_in_buffer, 'i', in_end_size);
713
714         dev->interrupt_in_urb = usb_alloc_urb(0, GFP_KERNEL);
715         if (!dev->interrupt_in_urb)
716                 goto error;
717         dev->interrupt_out_buffer = kmalloc(out_end_size, GFP_KERNEL);
718         if (!dev->interrupt_out_buffer)
719                 goto error;
720         dev->interrupt_out_urb = usb_alloc_urb(0, GFP_KERNEL);
721         if (!dev->interrupt_out_urb)
722                 goto error;
723
724         if (!usb_string(udev, udev->descriptor.iSerialNumber, dev->serial_number,
725                         sizeof(dev->serial_number))) {
726                 dev_err(&interface->dev, "Could not retrieve serial number\n");
727                 retval = -EIO;
728                 goto error;
729         }
730         dev_dbg(&interface->dev,"serial_number=%s", dev->serial_number);
731
732         /* we can register the device now, as it is ready */
733         usb_set_intfdata(interface, dev);
734
735         retval = usb_register_dev(interface, &adu_class);
736
737         if (retval) {
738                 /* something prevented us from registering this driver */
739                 dev_err(&interface->dev, "Not able to get a minor for this device.\n");
740                 usb_set_intfdata(interface, NULL);
741                 goto error;
742         }
743
744         dev->minor = interface->minor;
745
746         /* let the user know what node this device is now attached to */
747         dev_info(&interface->dev, "ADU%d %s now attached to /dev/usb/adutux%d\n",
748                  le16_to_cpu(udev->descriptor.idProduct), dev->serial_number,
749                  (dev->minor - ADU_MINOR_BASE));
750
751         return 0;
752
753 error:
754         adu_delete(dev);
755         return retval;
756 }
757
758 /**
759  * adu_disconnect
760  *
761  * Called by the usb core when the device is removed from the system.
762  */
763 static void adu_disconnect(struct usb_interface *interface)
764 {
765         struct adu_device *dev;
766
767         dev = usb_get_intfdata(interface);
768
769         usb_deregister_dev(interface, &adu_class);
770
771         usb_poison_urb(dev->interrupt_in_urb);
772         usb_poison_urb(dev->interrupt_out_urb);
773
774         mutex_lock(&adutux_mutex);
775         usb_set_intfdata(interface, NULL);
776
777         mutex_lock(&dev->mtx);  /* not interruptible */
778         dev->disconnected = 1;
779         mutex_unlock(&dev->mtx);
780
781         /* if the device is not opened, then we clean up right now */
782         if (!dev->open_count)
783                 adu_delete(dev);
784
785         mutex_unlock(&adutux_mutex);
786 }
787
788 /* usb specific object needed to register this driver with the usb subsystem */
789 static struct usb_driver adu_driver = {
790         .name = "adutux",
791         .probe = adu_probe,
792         .disconnect = adu_disconnect,
793         .id_table = device_table,
794 };
795
796 module_usb_driver(adu_driver);
797
798 MODULE_AUTHOR(DRIVER_AUTHOR);
799 MODULE_DESCRIPTION(DRIVER_DESC);
800 MODULE_LICENSE("GPL");