Messages in this thread Patch in this message |  | | From | Stephen Warren <> | Subject | [PATCH] usb: gadget: serial: fix oops when data rx'd after close | Date | Wed, 16 Aug 2017 14:30:10 -0600 |
| |
From: Stephen Warren <swarren@nvidia.com>
When the gadget serial device has no associated TTY, do not pass any received data into the TTY layer for processing; simply drop it instead. This prevents the TTY layer from calling back into the gadget serial driver, which will then crash in e.g. gs_write_room() due to lack of gadget serial device to TTY association (i.e. a NULL pointer dereference).
Signed-off-by: Stephen Warren <swarren@nvidia.com> --- drivers/usb/gadget/function/u_serial.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c index 9b0805f55ad7..16bb24a047d9 100644 --- a/drivers/usb/gadget/function/u_serial.c +++ b/drivers/usb/gadget/function/u_serial.c @@ -537,7 +537,7 @@ static void gs_rx_push(unsigned long _port) } /* push data to (open) tty */ - if (req->actual) { + if (req->actual & tty) { char *packet = req->buf; unsigned size = req->actual; unsigned n; -- 2.14.1
|  |