diff options
| author | Alan Cox <alan@lxorguk.ukuu.org.uk> | 2009-04-14 14:58:11 +0100 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-04-14 08:48:50 -0700 |
| commit | cf5450930db0ae308584e5361f3345e0ff73e643 (patch) | |
| tree | 7e9b6229de416ae0ac651eb55fb6230e1ef80fc9 /drivers | |
| parent | 7a9a65ced11ece416b730d6f21040a18e62d78a8 (diff) | |
| download | linux-cf5450930db0ae308584e5361f3345e0ff73e643.tar.gz linux-cf5450930db0ae308584e5361f3345e0ff73e643.tar.bz2 linux-cf5450930db0ae308584e5361f3345e0ff73e643.zip | |
tty: Fix leak in ti-usb
If the ti-usb adapter returns an zero data length frame (which happens)
then we leak a kref. Found by Christoph Mair <christoph.mair@gmail.com>
who proposed a patch. The patch here is different as Christoph's patch
didn't work for the case where tty = NULL and data arrived but Christoph
did all the hard work chasing it down.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/usb/serial/ti_usb_3410_5052.c | 26 |
1 files changed, 14 insertions, 12 deletions
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c index 2620bf6fe5e1..9c4c700c7cc6 100644 --- a/drivers/usb/serial/ti_usb_3410_5052.c +++ b/drivers/usb/serial/ti_usb_3410_5052.c @@ -1215,20 +1215,22 @@ static void ti_bulk_in_callback(struct urb *urb) } tty = tty_port_tty_get(&port->port); - if (tty && urb->actual_length) { - usb_serial_debug_data(debug, dev, __func__, - urb->actual_length, urb->transfer_buffer); - - if (!tport->tp_is_open) - dbg("%s - port closed, dropping data", __func__); - else - ti_recv(&urb->dev->dev, tty, + if (tty) { + if (urb->actual_length) { + usb_serial_debug_data(debug, dev, __func__, + urb->actual_length, urb->transfer_buffer); + + if (!tport->tp_is_open) + dbg("%s - port closed, dropping data", + __func__); + else + ti_recv(&urb->dev->dev, tty, urb->transfer_buffer, urb->actual_length); - - spin_lock(&tport->tp_lock); - tport->tp_icount.rx += urb->actual_length; - spin_unlock(&tport->tp_lock); + spin_lock(&tport->tp_lock); + tport->tp_icount.rx += urb->actual_length; + spin_unlock(&tport->tp_lock); + } tty_kref_put(tty); } |