diff options
| author |   Jiri Slaby <jirislaby@gmail.com> | 2009-09-06 23:10:10 +0200 |
|---|---|---|
| committer |   Live-CD User <linux@linux.site> | 2009-09-19 13:13:37 -0700 |
| commit | 054f2346cb0e524cbb678759bfedabfdba4d0100 (patch) | |
| tree | f27ff34eb965df9437b56614689578ce5d3dffd4 /drivers | |
| parent | tty: riscom8, fix tty refcnt (diff) | |
| download | linux-dev-054f2346cb0e524cbb678759bfedabfdba4d0100.tar.xz linux-dev-054f2346cb0e524cbb678759bfedabfdba4d0100.zip | |
tty: USB: serial/mct_u232, fix tty refcnt
Stanse found a tty refcnt leak in read_int_callback. In fact
it's handled wrong altogether. tty_port_tty_get can return NULL
and it's not checked in that manner.
Fix that by checking the tty_port_tty_get retval and put tty kref
properly.
http://stanse.fi.muni.cz/
Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/usb/serial/mct_u232.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c index d501aefa2628..ad4998bbf16f 100644 --- a/drivers/usb/serial/mct_u232.c +++ b/drivers/usb/serial/mct_u232.c @@ -566,10 +566,13 @@ static void mct_u232_read_int_callback(struct urb *urb) * Work-a-round: handle the 'usual' bulk-in pipe here */ if (urb->transfer_buffer_length > 2) { - tty = tty_port_tty_get(&port->port); if (urb->actual_length) { - tty_insert_flip_string(tty, data, urb->actual_length); - tty_flip_buffer_push(tty); + tty = tty_port_tty_get(&port->port); + if (tty) { + tty_insert_flip_string(tty, data, + urb->actual_length); + tty_flip_buffer_push(tty); + } tty_kref_put(tty); } goto exit; |