| Date | Fri, 12 Mar 2010 16:12:35 -0800 | From | Greg KH <> | Subject | [patch 057/123] USB: serial: sierra driver indat_callback fix |
| |
2.6.33-stable review patch. If anyone has any objections, please let me know.
-----------------
From: Elina Pasheva <epasheva@sierrawireless.com>
commit b87c6e86dac1bb5222279cc8ff7e09529e1c4ed9 upstream.
A crash has been reported with sierra driver on disconnect with Ubuntu/Lucid distribution based on kernel-2.6.32. The cause of the crash was determined as "NULL tty pointer was being referenced" and the NULL pointer was passed by sierra_indat_callback().
This patch modifies sierra_indat_callback() function to check for NULL tty structure pointer. This modification prevents a crash from happening when the device is disconnected.
This patch fixes the bug reported in Launchpad: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/511157
Signed-off-by: Elina Pasheva <epasheva@sierrawireless.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--- drivers/usb/serial/sierra.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
--- a/drivers/usb/serial/sierra.c +++ b/drivers/usb/serial/sierra.c @@ -604,14 +604,17 @@ static void sierra_indat_callback(struct } else { if (urb->actual_length) { tty = tty_port_tty_get(&port->port); + if (tty) { + tty_buffer_request_room(tty, + urb->actual_length); + tty_insert_flip_string(tty, data, + urb->actual_length); + tty_flip_buffer_push(tty); - tty_buffer_request_room(tty, urb->actual_length); - tty_insert_flip_string(tty, data, urb->actual_length); - tty_flip_buffer_push(tty); - - tty_kref_put(tty); - usb_serial_debug_data(debug, &port->dev, __func__, - urb->actual_length, data); + tty_kref_put(tty); + usb_serial_debug_data(debug, &port->dev, + __func__, urb->actual_length, data); + } } else { dev_dbg(&port->dev, "%s: empty read urb" " received\n", __func__);
|