diff options
| author | Stephen Warren <swarren@nvidia.com> | 2017-08-16 23:30:10 +0300 |
|---|---|---|
| committer | Felipe Balbi <felipe.balbi@linux.intel.com> | 2017-08-18 12:28:50 +0300 |
| commit | daa35bd95634a2a2d72d1049c93576a02711cb1a (patch) | |
| tree | 04d8f8adbdd1f976d3d42250b12fe4eeff1deebf | |
| parent | afd7fd81f22bf90474216515dbd6088f9bd70343 (diff) | |
| download | linux-daa35bd95634a2a2d72d1049c93576a02711cb1a.tar.xz | |
usb: gadget: serial: fix oops when data rx'd after close
When the gadget serial device has no associated TTY, do not pass any
received data into the TTY layer for processing; simply drop it instead.
This prevents the TTY layer from calling back into the gadget serial
driver, which will then crash in e.g. gs_write_room() due to lack of
gadget serial device to TTY association (i.e. a NULL pointer dereference).
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| -rw-r--r-- | drivers/usb/gadget/function/u_serial.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c index 9b0805f55ad7..4176216d54be 100644 --- a/drivers/usb/gadget/function/u_serial.c +++ b/drivers/usb/gadget/function/u_serial.c @@ -537,7 +537,7 @@ static void gs_rx_push(unsigned long _port) } /* push data to (open) tty */ - if (req->actual) { + if (req->actual && tty) { char *packet = req->buf; unsigned size = req->actual; unsigned n; |