[lkml]   [2012]   [Jan]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[48/49] usb: cdc-acm: Fix acm_tty_hangup() vs. acm_tty_close() race
    3.2-stable review patch.  If anyone has any objections, please let me know.


    From: Thilo-Alexander Ginkel <>

    [Not upstream as it was fixed differently for 3.3 with a much more
    "intrusive" rework of the driver - gregkh]

    There is a race condition involving acm_tty_hangup() and acm_tty_close()
    where hangup() would attempt to access tty->driver_data without proper
    locking and NULL checking after close() has potentially already set it
    to NULL. One possibility to (sporadically) trigger this behavior is to
    perform a suspend/resume cycle with a running WWAN data connection.

    This patch addresses the issue by introducing a NULL check for
    tty->driver_data in acm_tty_hangup() protected by open_mutex and exiting
    gracefully when hangup() is invoked on a device that has already been

    Signed-off-by: Thilo-Alexander Ginkel <>
    Signed-off-by: Greg Kroah-Hartman <>
    drivers/usb/class/cdc-acm.c | 12 ++++++++++--
    1 files changed, 10 insertions(+), 2 deletions(-)

    diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
    index a8078d0..97f2e58 100644
    --- a/drivers/usb/class/cdc-acm.c
    +++ b/drivers/usb/class/cdc-acm.c
    @@ -554,10 +554,18 @@ static void acm_port_down(struct acm *acm)

    static void acm_tty_hangup(struct tty_struct *tty)
    - struct acm *acm = tty->driver_data;
    - tty_port_hangup(&acm->port);
    + struct acm *acm;
    + acm = tty->driver_data;
    + if (!acm)
    + goto out;
    + tty_port_hangup(&acm->port);

    To unsubscribe from this list: send the line "unsubscribe linux-usb" in
    the body of a message to
    More majordomo info at

     \ /
      Last update: 2012-01-11 00:09    [W:0.020 / U:82.880 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site