summaryrefslogtreecommitdiff
path: root/drivers/tty
diff options
context:
space:
mode:
authorGeert Uytterhoeven <geert+renesas@glider.be>2018-12-13 21:44:42 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-12-17 17:04:11 +0300
commit2e948218b7c1262a3830823d6620eb227e3d4e3a (patch)
treea26c1984023a9a516b6b8d2217c0ba80a0e2da75 /drivers/tty
parentdd1f2250da95e87cb3e612858f94b14f99445a7c (diff)
downloadlinux-2e948218b7c1262a3830823d6620eb227e3d4e3a.tar.xz
serial: sh-sci: Fix crash in rx_timer_fn() on PIO fallback
When falling back to PIO, active_rx must be set to a different value than cookie_rx[i], else sci_dma_rx_find_active() will incorrectly find a match, leading to a NULL pointer dereference in rx_timer_fn() later. Use zero instead, which is the same value as after driver initialization. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/tty')
-rw-r--r--drivers/tty/serial/sh-sci.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 2a08039f7922..e353e03ce260 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -1369,7 +1369,7 @@ fail:
dmaengine_terminate_async(chan);
for (i = 0; i < 2; i++)
s->cookie_rx[i] = -EINVAL;
- s->active_rx = -EINVAL;
+ s->active_rx = 0;
s->chan_rx = NULL;
sci_start_rx(port);
if (!port_lock_held)