From: Sergei Shtylyov <sshtylyov@mvista.com>
To: Jiri Slaby <jslaby@suse.cz>
Cc: gregkh@suse.de, linux-usb@vger.kernel.org,
linux-kernel@vger.kernel.org, jirislaby@gmail.com,
Amit Shah <amitshah@gmx.net>, baoyb <baoyb@avit.org.cn>
Subject: Re: [PATCH 1/1] USB: serial/usb_wwan, fix tty NULL dereference
Date: Tue, 15 Feb 2011 20:14:50 +0300 [thread overview]
Message-ID: <4D5AB48A.2040504@ru.mvista.com> (raw)
In-Reply-To: <1297781707-3985-1-git-send-email-jslaby@suse.cz>
Hello.
Jiri Slaby wrote:
> tty_port_tty_get may return without any problems NULL. Handle this
> case and do not oops in usb_wwan_indat_callback by dereferencing it.
> The oops:
> Unable to handle kernel paging request for data at address 0x000000d8
> Faulting instruction address: 0xc0175b3c
> Oops: Kernel access of bad area, sig: 11 [#1]
> PowerPC 40x Platform
> last sysfs file:
> /sys/devices/pci0000:00/0000:00:00.0/0000:01:00.0/0000:02:09.2/usb1/idVendor
> Modules linked in:
> NIP: c0175b3c LR: c0175e7c CTR: c0215c90
> REGS: c77f7d50 TRAP: 0300 Not tainted (2.6.37-rc5)
> MSR: 00021030 <ME,CE,IR,DR> CR: 88482028 XER: 2000005f
> DEAR: 000000d8, ESR: 00000000
> TASK = c7141b90[1149] 'wvdial' THREAD: c2750000
> GPR00: 00021030 c77f7e00 c7141b90 00000000 0000000e 00000000 0000000e c0410680
> GPR08: c683db00 00000000 00000001 c03c81f8 88482028 10073ef4 ffffffb9 ffffff94
> GPR16: 00000000 fde036c0 00200200 00100100 00000001 ffffff8d c34fabcc 00000000
> GPR24: c71120d4 00000000 00000000 0000000e 00021030 00000000 00000000 0000000e
> NIP [c0175b3c] tty_buffer_request_room+0x2c/0x194
> LR [c0175e7c] tty_insert_flip_string_fixed_flag+0x3c/0xb0
> Call Trace:
> [c77f7e00] [00000003] 0x3 (unreliable)
> [c77f7e30] [c0175e7c] tty_insert_flip_string_fixed_flag+0x3c/0xb0
> [c77f7e60] [c0215df4] usb_wwan_indat_callback+0x164/0x170
> ...
> References: https://bugzilla.kernel.org/show_bug.cgi?id=24582
> Cc: Amit Shah <amitshah@gmx.net>
> Cc: baoyb <baoyb@avit.org.cn>
> Cc: Greg Kroah-Hartman <gregkh@suse.de>
> Signed-off-by: Jiri Slaby <jslaby@suse.cz>
> ---
> drivers/usb/serial/usb_wwan.c | 15 +++++++++------
> 1 files changed, 9 insertions(+), 6 deletions(-)
> diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
> index b004b2a..9c014e2 100644
> --- a/drivers/usb/serial/usb_wwan.c
> +++ b/drivers/usb/serial/usb_wwan.c
> @@ -295,12 +295,15 @@ static void usb_wwan_indat_callback(struct urb *urb)
> __func__, status, endpoint);
> } else {
> tty = tty_port_tty_get(&port->port);
> - if (urb->actual_length) {
> - tty_insert_flip_string(tty, data, urb->actual_length);
> - tty_flip_buffer_push(tty);
> - } else
> - dbg("%s: empty read urb received", __func__);
> - tty_kref_put(tty);
> + if (tty) {
> + if (urb->actual_length) {
> + tty_insert_flip_string(tty, data,
> + urb->actual_length);
> + tty_flip_buffer_push(tty);
> + } else
> + dbg("%s: empty read urb received", __func__);
Should be {} on the *else* branch too, according to Documentation/CodingStyle...
WBR, Sergei
next prev parent reply other threads:[~2011-02-15 17:16 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-02-15 14:55 [PATCH 1/1] USB: serial/usb_wwan, fix tty NULL dereference Jiri Slaby
2011-02-15 17:14 ` Sergei Shtylyov [this message]
2011-02-15 18:10 ` Amit Shah
2011-02-15 18:36 ` Jiri Slaby
2011-02-15 18:54 ` Amit Shah
2011-02-15 18:42 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4D5AB48A.2040504@ru.mvista.com \
--to=sshtylyov@mvista.com \
--cc=amitshah@gmx.net \
--cc=baoyb@avit.org.cn \
--cc=gregkh@suse.de \
--cc=jirislaby@gmail.com \
--cc=jslaby@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.