diff options
| author | Stephen Warren <swarren@nvidia.com> | 2017-08-16 23:30:10 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-10-20 10:51:32 +0300 |
| commit | 92811e27679945a0cef78288e3d45bc22f3ff86f (patch) | |
| tree | e1f6dbbfb3042529c388c251e24d0ec31bea2480 /drivers | |
| parent | f01e8fee66fd4cb10407ac68e52b579c9b65ee20 (diff) | |
| download | linux-92811e27679945a0cef78288e3d45bc22f3ff86f.tar.xz | |
usb: gadget: serial: fix oops when data rx'd after close
commit daa35bd95634a2a2d72d1049c93576a02711cb1a upstream.
When the gadget serial device has no associated TTY, do not pass any
received data into the TTY layer for processing; simply drop it instead.
This prevents the TTY layer from calling back into the gadget serial
driver, which will then crash in e.g. gs_write_room() due to lack of
gadget serial device to TTY association (i.e. a NULL pointer dereference).
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/usb/gadget/function/u_serial.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c index e0cd1e4c8892..2f151e0aa6da 100644 --- a/drivers/usb/gadget/function/u_serial.c +++ b/drivers/usb/gadget/function/u_serial.c @@ -537,7 +537,7 @@ static void gs_rx_push(unsigned long _port) } /* push data to (open) tty */ - if (req->actual) { + if (req->actual && tty) { char *packet = req->buf; unsigned size = req->actual; unsigned n; |