From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755749Ab3FPWVF (ORCPT ); Sun, 16 Jun 2013 18:21:05 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:46367 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755677Ab3FPWI6 (ORCPT ); Sun, 16 Jun 2013 18:08:58 -0400 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Johan Hovold" , "Greg Kroah-Hartman" Date: Sun, 16 Jun 2013 23:01:38 +0100 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [79/83] USB: pl2303: fix device initialisation at open In-Reply-To: X-SA-Exim-Connect-IP: 192.168.4.101 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.2.47-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Johan Hovold commit 2d8f4447b58bba5f8cb895c07690434c02307eaf upstream. Do not use uninitialised termios data to determine when to configure the device at open. This also prevents stack data from leaking to userspace in the OOM error path. Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman [bwh: Backported to 3.2: tty_struct::termios is a pointer, not a struct] Signed-off-by: Ben Hutchings --- drivers/usb/serial/pl2303.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) --- a/drivers/usb/serial/pl2303.c +++ b/drivers/usb/serial/pl2303.c @@ -270,7 +270,7 @@ static void pl2303_set_termios(struct tt serial settings even to the same values as before. Thus we actually need to filter in this specific case */ - if (!tty_termios_hw_change(tty->termios, old_termios)) + if (old_termios && !tty_termios_hw_change(tty->termios, old_termios)) return; cflag = tty->termios->c_cflag; @@ -279,7 +279,8 @@ static void pl2303_set_termios(struct tt if (!buf) { dev_err(&port->dev, "%s - out of memory.\n", __func__); /* Report back no change occurred */ - *tty->termios = *old_termios; + if (old_termios) + *tty->termios = *old_termios; return; } @@ -419,7 +420,7 @@ static void pl2303_set_termios(struct tt control = priv->line_control; if ((cflag & CBAUD) == B0) priv->line_control &= ~(CONTROL_DTR | CONTROL_RTS); - else if ((old_termios->c_cflag & CBAUD) == B0) + else if (old_termios && (old_termios->c_cflag & CBAUD) == B0) priv->line_control |= (CONTROL_DTR | CONTROL_RTS); if (control != priv->line_control) { control = priv->line_control; @@ -480,7 +481,6 @@ static void pl2303_close(struct usb_seri static int pl2303_open(struct tty_struct *tty, struct usb_serial_port *port) { - struct ktermios tmp_termios; struct usb_serial *serial = port->serial; struct pl2303_private *priv = usb_get_serial_port_data(port); int result; @@ -498,7 +498,7 @@ static int pl2303_open(struct tty_struct /* Setup termios */ if (tty) - pl2303_set_termios(tty, port, &tmp_termios); + pl2303_set_termios(tty, port, NULL); dbg("%s - submitting read urb", __func__); result = usb_serial_generic_submit_read_urb(port, GFP_KERNEL);