Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cf545093 authored by Alan Cox's avatar Alan Cox Committed by Linus Torvalds
Browse files

tty: Fix leak in ti-usb 



If the ti-usb adapter returns an zero data length frame (which happens)
then we leak a kref.  Found by Christoph Mair <christoph.mair@gmail.com>
who proposed a patch.  The patch here is different as Christoph's patch
didn't work for the case where tty = NULL and data arrived but Christoph
did all the hard work chasing it down.

Signed-off-by: default avatarAlan Cox <alan@linux.intel.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 7a9a65ce

drivers/usb/serial/ti_usb_3410_5052.c

+14 −12
Original line number Diff line number Diff line
@@ -1215,20 +1215,22 @@ static void ti_bulk_in_callback(struct urb *urb) 
	}



	tty = tty_port_tty_get(&port->port);

	if (tty && urb->actual_length) {

	if (tty) {

		if (urb->actual_length) {

			usb_serial_debug_data(debug, dev, __func__,

				urb->actual_length, urb->transfer_buffer);



			if (!tport->tp_is_open)

			dbg("%s - port closed, dropping data", __func__);

				dbg("%s - port closed, dropping data",

					__func__);

			else

				ti_recv(&urb->dev->dev, tty,

						urb->transfer_buffer,

						urb->actual_length);



			spin_lock(&tport->tp_lock);

			tport->tp_icount.rx += urb->actual_length;

			spin_unlock(&tport->tp_lock);

		}

		tty_kref_put(tty);

	}