[PATCH v2 00/12] USB: serial: io_edgeport: fixes and sync commands

[Johan Hovold <johan@kernel.org>]

This series fixes a NULL-deref triggered by syzbot, a memory corruption
and a UAF flagged by Sashiko, and a NULL-deref and a UAF found through
inspection.

Also add the missing serialisation for MCR, drop the modem lines on
hangup and close, and switch to synchronous commands so that operations
are serialised as expected.

Johan


Changes in v2:
 - reorder fixes
 - add open check to edge_write() to handle tty_wakeup() racing with close()
 - use openPending flag to detect stray open responses and move termios
   change before fifo corruption fix to allow extending critical section
 - fix command URB UAF separately from switch to synchronous commands (new
   patch)
 - move MCR change after termios change to avoid taking mutex in atomic context
 - free command buffers also on successful submission
 - specify command timeout in milliseconds rather than jiffies


Johan Hovold (12):
  USB: serial: io_edgeport: fix NULL-deref on early status
  USB: serial: io_edgeport: fix potential close() use-after-free
  USB: serial: io_edgeport: fix potential NULL-deref at open
  USB: serial: io_edgeport: move initial termios update to open()
  USB: serial: io_edgeport: fix potential fifo corruption
  USB: serial: io_edgeport: fix potential use-after-free on disconnect
  USB: serial: io_edgeport: serialise MCR accesses
  USB: serial: io_edgeport: drop redundant sanity checks
  USB: serial: io_edgeport: drop redundant open sanity checks
  USB: serial: io_edgeport: deassert DTR/RTS on close() and B0
  USB: serial: io_edgeport: replace atomic command allocations
  USB: serial: io_edgeport: switch to synchronous commands

 drivers/usb/serial/io_edgeport.c | 302 +++++++++++--------------------
 1 file changed, 105 insertions(+), 197 deletions(-)

-- 
2.55.0