Distribution: Linux-2.6.20 Problem Description: get_serial_info function is used to return serial device information to user. Cycladess serial board's get_serial_info( ) implementation seems to forget to assign the `closing_wait' value (parameter for `time to wait before closing') 3487 static int 3488 get_serial_info(struct cyclades_port *info, 3489 struct serial_struct __user * retinfo) 3490 { ... 3496 memset(&tmp, 0, sizeof(tmp)); 3497 tmp.type = info->type; 3498 tmp.line = info->line; 3499 tmp.port = info->card * 0x100 + info->line - cinfo->first_line; 3500 tmp.irq = cinfo->irq; 3501 tmp.flags = info->flags; 3502 tmp.close_delay = info->close_delay; 3503 tmp.baud_base = info->baud; 3504 tmp.custom_divisor = info->custom_divisor; 3505 tmp.hub6 = 0; /*!!! */ 3506 return copy_to_user(retinfo, &tmp, sizeof(*retinfo)) ? -EFAULT : 0; 3507 } all parameters, except for closing_wait, is returned. Actually, closing_wait is very likely to be non-zero. Therefore, in most cases, what user gets about this type of device's 'time-to-wait-before- closing' parameter would be wrong. I have compared this code with set_serial_info in the same file and many other serial device's get_serial_info (e.g. moxa_get_serial_info(..) in driver/char/moxa.c, get_serial_info in drivers/usb/serial/io_edgeport.c, etc.). It seems that the closing_wait is very likely to be forgotten. Steps to reproduce: got by source code analysis, no test case yet.
I merged a patch, thanks.
I just find a similar problem in another device: drivers/usb/serial/ti_usb_3410_5052.c 1402 static int ti_get_serial_info(struct ti_port *tport, 1403 struct serial_struct __user *ret_arg) ... 1413 ret_serial.type = PORT_16550A; 1414 ret_serial.line = port->serial->minor; 1415 ret_serial.port = port->number - port->serial->minor; 1416 ret_serial.flags = tport->tp_flags; 1417 ret_serial.xmit_fifo_size = TI_WRITE_BUF_SIZE; 1418 ret_serial.baud_base = tport->tp_tdev->td_is_3410 ? 921600 : 460800; 1419 ret_serial.closing_wait = tport->tp_closing_wait; I guess closing_delay is similarly missed, isn't it? Also, should ret_serial.irq be set and returned in this function?
Patch was merged into Linus' tree, and will therefore be in 2.6.21.