Eric Lee / smarc-ti-linux-kernel

Download as
Browse Code ยป

Commit a696260650e4f4f2e95d8520519550586766b458

Authored by Johan Hovold
Committed by Greg Kroah-Hartman
1 parent a1fec58704
Exists in smarc-ti-linux-3.14.y and in 1 other branch processor-sdk-linux-01.00.00

USB: keyspan: fix null-deref at probe 

commit b5122236bba8d7ef62153da5b55cc65d0944c61e upstream.

Fix null-pointer dereference during probe if the interface-status
completion handler is called before the individual ports have been set
up.

Fixes: f79b2d0fe81e ("USB: keyspan: fix NULL-pointer dereferences and
memory leaks")
Reported-by: Richard <richjunk@pacbell.net>
Tested-by: Richard <richjunk@pacbell.net>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Showing 1 changed file with 15 additions and 5 deletions Side-by-side Diff

drivers/usb/serial/keyspan.c
Diff comments   View file @ a696260
... ... @@ -421,6 +421,8 @@
421 421 }
422 422 port = serial->port[msg->port];
423 423 p_priv = usb_get_serial_port_data(port);
  424 + if (!p_priv)
  425 + goto resubmit;
424 426  
425 427 /* Update handshaking pin state information */
426 428 old_dcd_state = p_priv->dcd_state;
... ... @@ -431,7 +433,7 @@
431 433  
432 434 if (old_dcd_state != p_priv->dcd_state)
433 435 tty_port_tty_hangup(&port->port, true);
434   -
  436 +resubmit:
435 437 /* Resubmit urb so we continue receiving */
436 438 err = usb_submit_urb(urb, GFP_ATOMIC);
437 439 if (err != 0)
... ... @@ -541,6 +543,8 @@
541 543 }
542 544 port = serial->port[msg->port];
543 545 p_priv = usb_get_serial_port_data(port);
  546 + if (!p_priv)
  547 + goto resubmit;
544 548  
545 549 /* Update handshaking pin state information */
546 550 old_dcd_state = p_priv->dcd_state;
... ... @@ -551,7 +555,7 @@
551 555  
552 556 if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
553 557 tty_port_tty_hangup(&port->port, true);
554   -
  558 +resubmit:
555 559 /* Resubmit urb so we continue receiving */
556 560 err = usb_submit_urb(urb, GFP_ATOMIC);
557 561 if (err != 0)
... ... @@ -624,6 +628,8 @@
624 628 }
625 629 port = serial->port[msg->portNumber];
626 630 p_priv = usb_get_serial_port_data(port);
  631 + if (!p_priv)
  632 + goto resubmit;
627 633  
628 634 /* Update handshaking pin state information */
629 635 old_dcd_state = p_priv->dcd_state;
... ... @@ -634,7 +640,7 @@
634 640  
635 641 if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
636 642 tty_port_tty_hangup(&port->port, true);
637   -
  643 +resubmit:
638 644 /* Resubmit urb so we continue receiving */
639 645 err = usb_submit_urb(urb, GFP_ATOMIC);
640 646 if (err != 0)
... ... @@ -872,6 +878,8 @@
872 878  
873 879 port = serial->port[0];
874 880 p_priv = usb_get_serial_port_data(port);
  881 + if (!p_priv)
  882 + goto resubmit;
875 883  
876 884 /* Update handshaking pin state information */
877 885 old_dcd_state = p_priv->dcd_state;
... ... @@ -882,7 +890,7 @@
882 890  
883 891 if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
884 892 tty_port_tty_hangup(&port->port, true);
885   -
  893 +resubmit:
886 894 /* Resubmit urb so we continue receiving */
887 895 err = usb_submit_urb(urb, GFP_ATOMIC);
888 896 if (err != 0)
... ... @@ -943,6 +951,8 @@
943 951  
944 952 port = serial->port[msg->port];
945 953 p_priv = usb_get_serial_port_data(port);
  954 + if (!p_priv)
  955 + goto resubmit;
946 956  
947 957 /* Update handshaking pin state information */
948 958 old_dcd_state = p_priv->dcd_state;
... ... @@ -951,7 +961,7 @@
951 961  
952 962 if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
953 963 tty_port_tty_hangup(&port->port, true);
954   -
  964 +resubmit:
955 965 /* Resubmit urb so we continue receiving */
956 966 err = usb_submit_urb(urb, GFP_ATOMIC);
957 967 if (err != 0)