From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: stable-review@kernel.org, torvalds@linux-foundation.org,
akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
Amit Shah <amitshah@gmx.net>, baoyb <baoyb@avit.org.cn>,
Jiri Slaby <jslaby@suse.cz>
Subject: [05/73] USB: serial/usb_wwan, fix tty NULL dereference
Date: Fri, 04 Mar 2011 16:55:10 -0800 [thread overview]
Message-ID: <20110305005635.088686930@clark.kroah.org> (raw)
In-Reply-To: <20110305005720.GA16162@kroah.com>
2.6.37-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jiri Slaby <jslaby@suse.cz>
commit 38237fd2be9421c104f84cc35665097bdce89013 upstream.
tty_port_tty_get may return without any problems NULL. Handle this
case and do not oops in usb_wwan_indat_callback by dereferencing it.
The oops:
Unable to handle kernel paging request for data at address 0x000000d8
Faulting instruction address: 0xc0175b3c
Oops: Kernel access of bad area, sig: 11 [#1]
PowerPC 40x Platform
last sysfs file:
/sys/devices/pci0000:00/0000:00:00.0/0000:01:00.0/0000:02:09.2/usb1/idVendor
Modules linked in:
NIP: c0175b3c LR: c0175e7c CTR: c0215c90
REGS: c77f7d50 TRAP: 0300 Not tainted (2.6.37-rc5)
MSR: 00021030 <ME,CE,IR,DR> CR: 88482028 XER: 2000005f
DEAR: 000000d8, ESR: 00000000
TASK = c7141b90[1149] 'wvdial' THREAD: c2750000
GPR00: 00021030 c77f7e00 c7141b90 00000000 0000000e 00000000 0000000e c0410680
GPR08: c683db00 00000000 00000001 c03c81f8 88482028 10073ef4 ffffffb9 ffffff94
GPR16: 00000000 fde036c0 00200200 00100100 00000001 ffffff8d c34fabcc 00000000
GPR24: c71120d4 00000000 00000000 0000000e 00021030 00000000 00000000 0000000e
NIP [c0175b3c] tty_buffer_request_room+0x2c/0x194
LR [c0175e7c] tty_insert_flip_string_fixed_flag+0x3c/0xb0
Call Trace:
[c77f7e00] [00000003] 0x3 (unreliable)
[c77f7e30] [c0175e7c] tty_insert_flip_string_fixed_flag+0x3c/0xb0
[c77f7e60] [c0215df4] usb_wwan_indat_callback+0x164/0x170
...
References: https://bugzilla.kernel.org/show_bug.cgi?id=24582
Cc: Amit Shah <amitshah@gmx.net>
Cc: baoyb <baoyb@avit.org.cn>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/usb/serial/usb_wwan.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
--- a/drivers/usb/serial/usb_wwan.c
+++ b/drivers/usb/serial/usb_wwan.c
@@ -216,12 +216,15 @@ static void usb_wwan_indat_callback(stru
__func__, status, endpoint);
} else {
tty = tty_port_tty_get(&port->port);
- if (urb->actual_length) {
- tty_insert_flip_string(tty, data, urb->actual_length);
- tty_flip_buffer_push(tty);
- } else
- dbg("%s: empty read urb received", __func__);
- tty_kref_put(tty);
+ if (tty) {
+ if (urb->actual_length) {
+ tty_insert_flip_string(tty, data,
+ urb->actual_length);
+ tty_flip_buffer_push(tty);
+ } else
+ dbg("%s: empty read urb received", __func__);
+ tty_kref_put(tty);
+ }
/* Resubmit urb so we continue receiving */
if (status != -ESHUTDOWN) {
next prev parent reply other threads:[~2011-03-05 0:59 UTC|newest]
Thread overview: 74+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-03-05 0:57 [00/73] 2.6.37.3-stable review Greg KH
2011-03-05 0:55 ` [01/73] usb: musb: omap2430: fix kernel panic on reboot Greg KH
2011-03-05 0:55 ` [02/73] USB: add quirks entry for Keytouch QWERTY Panel Greg KH
2011-03-05 0:55 ` [03/73] USB: Add Samsung SGH-I500/Android modem ID switch to visor driver Greg KH
2011-03-05 0:55 ` [04/73] USB: Add quirk for Samsung Android phone modem Greg KH
2011-03-05 0:55 ` Greg KH [this message]
2011-03-05 0:55 ` [06/73] sierra: add new ID for Airprime/Sierra USB IP modem Greg KH
2011-03-05 0:55 ` [07/73] Revert "Bluetooth: Enable USB autosuspend by default on btusb" Greg KH
2011-03-05 0:55 ` [08/73] p54pci: update receive dma buffers before and after processing Greg KH
2011-03-05 0:55 ` [09/73] Revert "drm/radeon/kms: switch back to min->max pll post divider iteration" Greg KH
2011-03-05 0:55 ` [10/73] tcp: fix inet_twsk_deschedule() Greg KH
2011-03-05 0:55 ` [11/73] mm: prevent concurrent unmap_mapping_range() on the same inode Greg KH
2011-03-05 0:55 ` [12/73] staging: brcm80211: remove assert to avoid panic since 2.6.37 kernel Greg KH
2011-03-05 0:55 ` [13/73] staging: brcm80211: bugfix for softmac crash on multi cpu configurations Greg KH
2011-03-05 0:55 ` [14/73] staging: usbip: vhci: update reference count for usb_device Greg KH
2011-03-05 0:55 ` [15/73] staging: usbip: vhci: give back URBs from in-flight unlink requests Greg KH
2011-03-05 0:55 ` [16/73] staging: usbip: vhci: refuse to enqueue for dead connections Greg KH
2011-03-05 0:55 ` [17/73] staging: usbip: vhci: use urb->dev->portnum to find port Greg KH
2011-03-05 0:55 ` [18/73] epoll: prevent creating circular epoll structures Greg KH
2011-03-05 0:55 ` [19/73] swiotlb: fix wrong panic Greg KH
2011-03-05 0:55 ` [20/73] ldm: corrupted partition table can cause kernel oops Greg KH
2011-03-05 0:55 ` [21/73] drivers/rtc/rtc-ds3232.c: fix time range difference between linux and RTC chip Greg KH
2011-03-05 0:55 ` [22/73] mm: fix dubious code in __count_immobile_pages() Greg KH
2011-03-05 0:55 ` [23/73] md: correctly handle probe of an mdp device Greg KH
2011-03-05 0:55 ` [24/73] md: avoid spinlock problem in blk_throtl_exit Greg KH
2011-03-05 0:55 ` [25/73] md: Fix - again - partition detection when array becomes active Greg KH
2011-03-05 0:55 ` [26/73] Fix over-zealous flush_disk when changing device size Greg KH
2011-03-05 0:55 ` [27/73] PM: Make ACPI wakeup from S5 work again when CONFIG_PM_SLEEP is unset Greg KH
2011-03-05 0:55 ` [28/73] x86 quirk: Fix polarity for IRQ0 pin2 override on SB800 systems Greg KH
2011-03-05 0:55 ` [29/73] xhci: Avoid BUG() in interrupt context Greg KH
2011-03-05 0:55 ` [30/73] xhci: Clarify some expressions in the TRB math Greg KH
2011-03-05 0:55 ` [31/73] xhci: Fix errors in the running total calculations " Greg KH
2011-03-05 0:55 ` [32/73] xhci: Fix an error in count_sg_trbs_needed() Greg KH
2011-03-05 0:55 ` [33/73] USB: Reset USB 3.0 devices on (re)discovery Greg KH
2011-03-05 0:55 ` [34/73] USB: prevent buggy hubs from crashing the USB stack Greg KH
2011-03-05 0:55 ` [35/73] usb: musb: core: set has_tt flag Greg KH
2011-03-05 0:55 ` [36/73] ALSA: HDA: Add a new Conexant codec 506e (20590) Greg KH
2011-03-05 0:55 ` [37/73] ALSA: usb-audio: fix oops due to cleanup race when disconnecting Greg KH
2011-03-05 0:55 ` [38/73] ALSA: HDA: Fix mic initialization in VIA auto parser Greg KH
2011-03-05 0:55 ` [39/73] ALSA: HDA: Add ideapad quirk for two Dell machines Greg KH
2011-03-05 0:55 ` [40/73] ocfs2: Check heartbeat mode for kernel stacks only Greg KH
2011-03-05 0:55 ` [41/73] Ocfs2/refcounttree: Fix a bug for refcounttree to writeback clusters in a right number Greg KH
2011-03-05 0:55 ` [42/73] drm: fix unsigned vs signed comparison issue in modeset ctl ioctl Greg KH
2011-03-05 0:55 ` [43/73] ACPI / debugfs: Fix buffer overflows, double free Greg KH
2011-03-05 0:55 ` [44/73] mfd: Avoid tps6586x burst writes Greg KH
2011-03-05 0:55 ` [45/73] mfd: Fix NULL pointer due to non-initialized ucb1x00-ts absinfo Greg KH
2011-03-05 0:55 ` [46/73] x86: Use u32 instead of long to set reset vector back to 0 Greg KH
2011-03-05 0:55 ` [47/73] Bluetooth: add Atheros BT AR9285 fw supported Greg KH
2011-03-05 0:55 ` [48/73] Bluetooth: fix crash with quirky dongles doing sound Greg KH
2011-03-05 0:55 ` [49/73] Bluetooth: Add Atheros BT AR5BBU12 fw supported Greg KH
2011-03-05 0:55 ` [50/73] eukrea-tlv320: fix platform_name Greg KH
2011-03-05 0:55 ` [51/73] ASoC: correct pxa AC97 DAI names Greg KH
2011-03-05 0:55 ` [52/73] fuse: fix hang of single threaded fuseblk filesystem Greg KH
2011-03-05 0:55 ` [53/73] clockevents: Prevent oneshot mode when broadcast device is periodic Greg KH
2011-03-05 0:55 ` [54/73] ext2: Fix link count corruption under heavy link+rename load Greg KH
2011-03-05 0:56 ` [55/73] mm: vmstat: use a single setter function and callback for adjusting percpu thresholds Greg KH
2011-03-05 0:56 ` [56/73] e1000e: 82579 PHY incorrectly identified during init Greg KH
2011-03-05 0:56 ` [57/73] Staging: comedi: Add MODULE_LICENSE and similar to NI modules Greg KH
2011-03-05 0:56 ` [58/73] fix cfg80211_wext_siwfreq lock ordering Greg KH
2011-03-05 0:56 ` [59/73] tg3: Restrict phy ioctl access Greg KH
2011-03-05 0:56 ` [60/73] drm/i915: fix memory corruption with GM965 and >4GB RAM Greg KH
2011-03-05 0:56 ` [61/73] blk-throttle: Do not use kblockd workqueue for throtl work Greg KH
2011-03-05 0:56 ` [62/73] block: add @force_kblockd to __blk_run_queue() Greg KH
2011-03-05 0:56 ` [63/73] block: blk-flush shouldnt call directly into q->request_fn() __blk_run_queue() Greg KH
2011-03-05 0:56 ` [64/73] block: kill loop_mutex Greg KH
2011-03-05 0:56 ` [65/73] ath9k_htc: Fix an endian issue Greg KH
2011-03-05 0:56 ` [66/73] p54usb: add Senao NUB-350 usbid Greg KH
2011-03-05 0:56 ` [67/73] nilfs2: fix regression that i-flag is not set on changeless checkpoints Greg KH
2011-03-05 0:56 ` [68/73] carl9170: add Airlive X.USB a/b/g/n USBID Greg KH
2011-03-05 0:56 ` [69/73] r8169: disable ASPM Greg KH
2011-03-05 0:56 ` [70/73] dccp: fix oops on Reset after close Greg KH
2011-03-05 0:56 ` [71/73] e1000e: disable broken PHY wakeup for ICH10 LOMs, use MAC wakeup instead Greg KH
2011-03-05 0:56 ` [72/73] DNS: Fix a NULL pointer deref when trying to read an error key [CVE-2011-1076] Greg KH
2011-03-05 0:56 ` [73/73] arp_notify: unconditionally send gratuitous ARP for NETDEV_NOTIFY_PEERS Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110305005635.088686930@clark.kroah.org \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=amitshah@gmx.net \
--cc=baoyb@avit.org.cn \
--cc=jslaby@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=stable-review@kernel.org \
--cc=stable@kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®