evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

usb: gadget: serial: fix oops when data rx'd after close

Browse source 
commit daa35bd95634a2a2d72d1049c93576a02711cb1a upstream.

When the gadget serial device has no associated TTY, do not pass any
received data into the TTY layer for processing; simply drop it instead.
This prevents the TTY layer from calling back into the gadget serial
driver, which will then crash in e.g. gs_write_room() due to lack of
gadget serial device to TTY association (i.e. a NULL pointer dereference).

Signed-off-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Stephen Warren 2017-08-16 14:30:10 -06:00 • committed by Greg Kroah-Hartman
parent 466dda64e4
commit 68a318670c
1 changed files with 1 additions and 1 deletions

2
drivers/usb/gadget/function/u_serial.c
View file

@ -518,7 +518,7 @@ static void gs_rx_push(unsigned long _port)
}
/* push data to (open) tty */
if (req->actual) {
if (req->actual && tty) {
char *packet = req->buf;
unsigned size = req->actual;
unsigned n;