From: Sergei Shtylyov <sshtylyov@mvista.com>
To: Jiri Slaby <jslaby@suse.cz>
Cc: gregkh@suse.de, linux-usb@vger.kernel.org,
linux-kernel@vger.kernel.org, jirislaby@gmail.com,
Amit Shah <amitshah@gmx.net>, baoyb <baoyb@avit.org.cn>
Subject: Re: [PATCH 1/1] USB: serial/usb_wwan, fix tty NULL dereference
Date: Tue, 15 Feb 2011 20:14:50 +0300 [thread overview]
Message-ID: <4D5AB48A.2040504@ru.mvista.com> (raw)
In-Reply-To: <1297781707-3985-1-git-send-email-jslaby@suse.cz>
Hello.
Jiri Slaby wrote:
> tty_port_tty_get may return without any problems NULL. Handle this
> case and do not oops in usb_wwan_indat_callback by dereferencing it.
> The oops:
> Unable to handle kernel paging request for data at address 0x000000d8
> Faulting instruction address: 0xc0175b3c
> Oops: Kernel access of bad area, sig: 11 [#1]
> PowerPC 40x Platform
> last sysfs file:
> /sys/devices/pci0000:00/0000:00:00.0/0000:01:00.0/0000:02:09.2/usb1/idVendor
> Modules linked in:
> NIP: c0175b3c LR: c0175e7c CTR: c0215c90
> REGS: c77f7d50 TRAP: 0300 Not tainted (2.6.37-rc5)
> MSR: 00021030 <ME,CE,IR,DR> CR: 88482028 XER: 2000005f
> DEAR: 000000d8, ESR: 00000000
> TASK = c7141b90[1149] 'wvdial' THREAD: c2750000
> GPR00: 00021030 c77f7e00 c7141b90 00000000 0000000e 00000000 0000000e c0410680
> GPR08: c683db00 00000000 00000001 c03c81f8 88482028 10073ef4 ffffffb9 ffffff94
> GPR16: 00000000 fde036c0 00200200 00100100 00000001 ffffff8d c34fabcc 00000000
> GPR24: c71120d4 00000000 00000000 0000000e 00021030 00000000 00000000 0000000e
> NIP [c0175b3c] tty_buffer_request_room+0x2c/0x194
> LR [c0175e7c] tty_insert_flip_string_fixed_flag+0x3c/0xb0
> Call Trace:
> [c77f7e00] [00000003] 0x3 (unreliable)
> [c77f7e30] [c0175e7c] tty_insert_flip_string_fixed_flag+0x3c/0xb0
> [c77f7e60] [c0215df4] usb_wwan_indat_callback+0x164/0x170
> ...
> References: https://bugzilla.kernel.org/show_bug.cgi?id=24582
> Cc: Amit Shah <amitshah@gmx.net>
> Cc: baoyb <baoyb@avit.org.cn>
> Cc: Greg Kroah-Hartman <gregkh@suse.de>
> Signed-off-by: Jiri Slaby <jslaby@suse.cz>
> ---
> drivers/usb/serial/usb_wwan.c | 15 +++++++++------
> 1 files changed, 9 insertions(+), 6 deletions(-)
> diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
> index b004b2a..9c014e2 100644
> --- a/drivers/usb/serial/usb_wwan.c
> +++ b/drivers/usb/serial/usb_wwan.c
> @@ -295,12 +295,15 @@ static void usb_wwan_indat_callback(struct urb *urb)
> __func__, status, endpoint);
> } else {
> tty = tty_port_tty_get(&port->port);
> - if (urb->actual_length) {
> - tty_insert_flip_string(tty, data, urb->actual_length);
> - tty_flip_buffer_push(tty);
> - } else
> - dbg("%s: empty read urb received", __func__);
> - tty_kref_put(tty);
> + if (tty) {
> + if (urb->actual_length) {
> + tty_insert_flip_string(tty, data,
> + urb->actual_length);
> + tty_flip_buffer_push(tty);
> + } else
> + dbg("%s: empty read urb received", __func__);
Should be {} on the *else* branch too, according to Documentation/CodingStyle...
WBR, Sergei
next prev parent reply other threads:[~2011-02-15 17:16 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-02-15 14:55 Jiri Slaby
2011-02-15 17:14 ` Sergei Shtylyov [this message]
2011-02-15 18:10 ` Amit Shah
2011-02-15 18:36 ` Jiri Slaby
2011-02-15 18:54 ` Amit Shah
2011-02-15 18:42 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4D5AB48A.2040504@ru.mvista.com \
--to=sshtylyov@mvista.com \
--cc=amitshah@gmx.net \
--cc=baoyb@avit.org.cn \
--cc=gregkh@suse.de \
--cc=jirislaby@gmail.com \
--cc=jslaby@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®