Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 487f9c67 authored by Luiz Fernando Capitulino's avatar Luiz Fernando Capitulino Committed by Greg Kroah-Hartman
Browse files

[PATCH] USB: usbserial: Adds missing checks and bug fix. 



Checks if 'port' is NULL before using it in all tty operations, this
can avoid NULL pointer dereferences.

Signed-off-by: default avatarLuiz Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 717f736d

drivers/usb/serial/usb-serial.c

+32 −0
Original line number Original line Diff line number Diff line
@@ -188,6 +188,8 @@ static int serial_open (struct tty_struct *tty, struct file * filp) 




	portNumber = tty->index - serial->minor;

	portNumber = tty->index - serial->minor;

	port = serial->port[portNumber];

	port = serial->port[portNumber];

	if (!port)

		return -ENODEV;

	 

	 

	++port->open_count;

	++port->open_count;
@@ -258,6 +260,9 @@ static int serial_write (struct tty_struct * tty, const unsigned char *buf, int 
	struct usb_serial_port *port = tty->driver_data;

	struct usb_serial_port *port = tty->driver_data;

	int retval = -EINVAL;

	int retval = -EINVAL;





	if (!port)

		goto exit;



	dbg("%s - port %d, %d byte(s)", __FUNCTION__, port->number, count);

	dbg("%s - port %d, %d byte(s)", __FUNCTION__, port->number, count);





	if (!port->open_count) {

	if (!port->open_count) {
@@ -277,6 +282,9 @@ static int serial_write_room (struct tty_struct *tty) 
	struct usb_serial_port *port = tty->driver_data;

	struct usb_serial_port *port = tty->driver_data;

	int retval = -EINVAL;

	int retval = -EINVAL;





	if (!port)

		goto exit;



	dbg("%s - port %d", __FUNCTION__, port->number);

	dbg("%s - port %d", __FUNCTION__, port->number);





	if (!port->open_count) {

	if (!port->open_count) {
@@ -296,6 +304,9 @@ static int serial_chars_in_buffer (struct tty_struct *tty) 
	struct usb_serial_port *port = tty->driver_data;

	struct usb_serial_port *port = tty->driver_data;

	int retval = -EINVAL;

	int retval = -EINVAL;





	if (!port)

		goto exit;



	dbg("%s = port %d", __FUNCTION__, port->number);

	dbg("%s = port %d", __FUNCTION__, port->number);





	if (!port->open_count) {

	if (!port->open_count) {
@@ -314,6 +325,9 @@ static void serial_throttle (struct tty_struct * tty) 
{

{

	struct usb_serial_port *port = tty->driver_data;

	struct usb_serial_port *port = tty->driver_data;





	if (!port)

		return;



	dbg("%s - port %d", __FUNCTION__, port->number);

	dbg("%s - port %d", __FUNCTION__, port->number);





	if (!port->open_count) {

	if (!port->open_count) {
@@ -330,6 +344,9 @@ static void serial_unthrottle (struct tty_struct * tty) 
{

{

	struct usb_serial_port *port = tty->driver_data;

	struct usb_serial_port *port = tty->driver_data;





	if (!port)

		return;



	dbg("%s - port %d", __FUNCTION__, port->number);

	dbg("%s - port %d", __FUNCTION__, port->number);





	if (!port->open_count) {

	if (!port->open_count) {
@@ -347,6 +364,9 @@ static int serial_ioctl (struct tty_struct *tty, struct file * file, unsigned in 
	struct usb_serial_port *port = tty->driver_data;

	struct usb_serial_port *port = tty->driver_data;

	int retval = -ENODEV;

	int retval = -ENODEV;





	if (!port)

		goto exit;



	dbg("%s - port %d, cmd 0x%.4x", __FUNCTION__, port->number, cmd);

	dbg("%s - port %d, cmd 0x%.4x", __FUNCTION__, port->number, cmd);





	if (!port->open_count) {

	if (!port->open_count) {
@@ -368,6 +388,9 @@ static void serial_set_termios (struct tty_struct *tty, struct termios * old) 
{

{

	struct usb_serial_port *port = tty->driver_data;

	struct usb_serial_port *port = tty->driver_data;





	if (!port)

		return;



	dbg("%s - port %d", __FUNCTION__, port->number);

	dbg("%s - port %d", __FUNCTION__, port->number);





	if (!port->open_count) {

	if (!port->open_count) {
@@ -384,6 +407,9 @@ static void serial_break (struct tty_struct *tty, int break_state) 
{

{

	struct usb_serial_port *port = tty->driver_data;

	struct usb_serial_port *port = tty->driver_data;





	if (!port)

		return;



	dbg("%s - port %d", __FUNCTION__, port->number);

	dbg("%s - port %d", __FUNCTION__, port->number);





	if (!port->open_count) {

	if (!port->open_count) {
@@ -445,6 +471,9 @@ static int serial_tiocmget (struct tty_struct *tty, struct file *file) 
{

{

	struct usb_serial_port *port = tty->driver_data;

	struct usb_serial_port *port = tty->driver_data;





	if (!port)

		goto exit;



	dbg("%s - port %d", __FUNCTION__, port->number);

	dbg("%s - port %d", __FUNCTION__, port->number);





	if (!port->open_count) {

	if (!port->open_count) {
@@ -464,6 +493,9 @@ static int serial_tiocmset (struct tty_struct *tty, struct file *file, 
{

{

	struct usb_serial_port *port = tty->driver_data;

	struct usb_serial_port *port = tty->driver_data;





	if (!port)

		goto exit;



	dbg("%s - port %d", __FUNCTION__, port->number);

	dbg("%s - port %d", __FUNCTION__, port->number);





	if (!port->open_count) {

	if (!port->open_count) {