evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

USB: ark3116: fix NULL-pointer dereference

Browse source 
Fix NULL-pointer dereference at release by replacing attach and release
with port_probe and port_remove.

Since commit 0998d06310 (device-core: Ensure drvdata = NULL when no
driver is bound) the port private data is NULL when release is called.

Compile-only tested.

Cc: <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Johan Hovold 2012-10-15 18:20:52 +02:00 • committed by Greg Kroah-Hartman
parent 8282da4789
commit 7bdce71822
1 changed files with 14 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
drivers/usb/serial/ark3116.c
View file

@ -125,9 +125,6 @@ static inline int calc_divisor(int bps)
static int ark3116_attach(struct usb_serial *serial) static int ark3116_attach(struct usb_serial *serial)
{ {
struct usb_serial_port *port = serial->port[0];
struct ark3116_private *priv;
/* make sure we have our end-points */ /* make sure we have our end-points */
if ((serial->num_bulk_in == 0) || if ((serial->num_bulk_in == 0) ||
(serial->num_bulk_out == 0) || (serial->num_bulk_out == 0) ||
@ -142,8 +139,15 @@ static int ark3116_attach(struct usb_serial *serial)
return -EINVAL; return -EINVAL;
} }
priv = kzalloc(sizeof(struct ark3116_private), return 0;
GFP_KERNEL); }
static int ark3116_port_probe(struct usb_serial_port *port)
{
struct usb_serial *serial = port->serial;
struct ark3116_private *priv;
priv = kzalloc(sizeof(*priv), GFP_KERNEL);
if (!priv) if (!priv)
return -ENOMEM; return -ENOMEM;
@ -198,18 +202,15 @@ static int ark3116_attach(struct usb_serial *serial)
return 0; return 0;
} }
static void ark3116_release(struct usb_serial *serial) static int ark3116_port_remove(struct usb_serial_port *port)
{ {
struct usb_serial_port *port = serial->port[0];
struct ark3116_private *priv = usb_get_serial_port_data(port); struct ark3116_private *priv = usb_get_serial_port_data(port);
/* device is closed, so URBs and DMA should be down */ /* device is closed, so URBs and DMA should be down */
usb_set_serial_port_data(port, NULL);
mutex_destroy(&priv->hw_lock); mutex_destroy(&priv->hw_lock);
kfree(priv); kfree(priv);
return 0;
} }
static void ark3116_init_termios(struct tty_struct *tty) static void ark3116_init_termios(struct tty_struct *tty)
@ -723,7 +724,8 @@ static struct usb_serial_driver ark3116_device = {
.id_table = id_table, .id_table = id_table,
.num_ports = 1, .num_ports = 1,
.attach = ark3116_attach, .attach = ark3116_attach,
.release = ark3116_release, .port_probe = ark3116_port_probe,
.port_remove = ark3116_port_remove,
.set_termios = ark3116_set_termios, .set_termios = ark3116_set_termios,
.init_termios = ark3116_init_termios, .init_termios = ark3116_init_termios,
.ioctl = ark3116_ioctl, .ioctl = ark3116_ioctl,