summaryrefslogtreecommitdiff
path: root/drivers/usb
diff options
context:
space:
mode:
authorStephen Warren <swarren@nvidia.com>2017-08-16 14:30:10 -0600
committerFelipe Balbi <felipe.balbi@linux.intel.com>2017-08-18 12:28:50 +0300
commitdaa35bd95634a2a2d72d1049c93576a02711cb1a (patch)
tree04d8f8adbdd1f976d3d42250b12fe4eeff1deebf /drivers/usb
parentafd7fd81f22bf90474216515dbd6088f9bd70343 (diff)
usb: gadget: serial: fix oops when data rx'd after close
When the gadget serial device has no associated TTY, do not pass any received data into the TTY layer for processing; simply drop it instead. This prevents the TTY layer from calling back into the gadget serial driver, which will then crash in e.g. gs_write_room() due to lack of gadget serial device to TTY association (i.e. a NULL pointer dereference). Signed-off-by: Stephen Warren <swarren@nvidia.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Diffstat (limited to 'drivers/usb')
-rw-r--r--drivers/usb/gadget/function/u_serial.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
index 9b0805f55ad7..4176216d54be 100644
--- a/drivers/usb/gadget/function/u_serial.c
+++ b/drivers/usb/gadget/function/u_serial.c
@@ -537,7 +537,7 @@ static void gs_rx_push(unsigned long _port)
}
/* push data to (open) tty */
- if (req->actual) {
+ if (req->actual && tty) {
char *packet = req->buf;
unsigned size = req->actual;
unsigned n;