Merge "usb: u_serial: Fix NULL pointer dereference in u_serial tty callbacks" (458bbce8) · Commits · e / devices / android_kernel_sony_msm8994

drivers/usb/gadget/u_serial.c

+18 −2

Original line number	Diff line number	Diff line
		@@ -4,7 +4,7 @@
		* Copyright (C) 2003 Al Borchers (alborchers@steinerpoint.com)
		* Copyright (C) 2008 David Brownell
		* Copyright (C) 2008 by Nokia Corporation
		* Copyright (c) 2013, The Linux Foundation. All rights reserved.
		* Copyright (c) 2013-2014 The Linux Foundation. All rights reserved.
		*
		* This code also borrows from usbserial.c, which is
		* Copyright (C) 1999 - 2002 Greg Kroah-Hartman (greg@kroah.com)
		@@ -975,6 +975,8 @@ static int gs_write(struct tty_struct tty, const unsigned char buf, int count)
		unsigned long flags;
		int status;

		if (!port)
		return 0;
		pr_vdebug("gs_write: ttyGS%d (%p) writing %d bytes\n",
		port->port_num, tty, count);

		@@ -995,6 +997,8 @@ static int gs_put_char(struct tty_struct *tty, unsigned char ch)
		unsigned long flags;
		int status;

		if (!port)
		return 0;
		pr_vdebug("gs_put_char: (%d,%p) char=0x%x, called from %pf\n",
		port->port_num, tty, ch, __builtin_return_address(0));

		@@ -1010,6 +1014,8 @@ static void gs_flush_chars(struct tty_struct *tty)
		struct gs_port *port = tty->driver_data;
		unsigned long flags;

		if (!port)
		return;
		pr_vdebug("gs_flush_chars: (%d,%p)\n", port->port_num, tty);

		spin_lock_irqsave(&port->port_lock, flags);
		@@ -1024,6 +1030,8 @@ static int gs_write_room(struct tty_struct *tty)
		unsigned long flags;
		int room = 0;

		if (!port)
		return 0;
		spin_lock_irqsave(&port->port_lock, flags);
		if (port->port_usb)
		room = gs_buf_space_avail(&port->port_write_buf);
		@@ -1041,6 +1049,8 @@ static int gs_chars_in_buffer(struct tty_struct *tty)
		unsigned long flags;
		int chars = 0;

		if (!port)
		return 0;
		spin_lock_irqsave(&port->port_lock, flags);
		chars = gs_buf_data_avail(&port->port_write_buf);
		spin_unlock_irqrestore(&port->port_lock, flags);
		@@ -1082,6 +1092,8 @@ static int gs_break_ctl(struct tty_struct *tty, int duration)
		int status = 0;
		struct gserial *gser;

		if (!port)
		return 0;
		pr_vdebug("gs_break_ctl: ttyGS%d, send break (%d)\n",
		port->port_num, duration);

		@@ -1100,6 +1112,8 @@ static int gs_tiocmget(struct tty_struct *tty)
		struct gserial *gser;
		unsigned int result = 0;

		if (!port)
		return -ENODEV;
		spin_lock_irq(&port->port_lock);
		gser = port->port_usb;
		if (!gser) {
		@@ -1130,6 +1144,8 @@ static int gs_tiocmset(struct tty_struct *tty,
		struct gserial *gser;
		int status = 0;

		if (!port)
		return -ENODEV;
		spin_lock_irq(&port->port_lock);
		gser = port->port_usb;
		if (!gser) {