summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLuiz Fernando Capitulino <lcapitulino@mandriva.com.br>2005-11-28 22:16:05 +0100
committerGreg Kroah-Hartman <gregkh@suse.de>2006-01-04 22:48:35 +0100
commit487f9c6710e7dff338e59820f6cfaeaaa87cb532 (patch)
treecf8b5706aa97d8a9143a40658440772863320bd7
parent[PATCH] USB: isp116x-hcd: minor cleanup (diff)
downloadlinux-487f9c6710e7dff338e59820f6cfaeaaa87cb532.tar.xz
linux-487f9c6710e7dff338e59820f6cfaeaaa87cb532.zip
[PATCH] USB: usbserial: Adds missing checks and bug fix.
Checks if 'port' is NULL before using it in all tty operations, this can avoid NULL pointer dereferences. Signed-off-by: Luiz Capitulino <lcapitulino@mandriva.com.br> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--drivers/usb/serial/usb-serial.c32
1 files changed, 32 insertions, 0 deletions
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 12aaf18ff9ea..5bc023c73893 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -188,6 +188,8 @@ static int serial_open (struct tty_struct *tty, struct file * filp)
portNumber = tty->index - serial->minor;
port = serial->port[portNumber];
+ if (!port)
+ return -ENODEV;
++port->open_count;
@@ -258,6 +260,9 @@ static int serial_write (struct tty_struct * tty, const unsigned char *buf, int
struct usb_serial_port *port = tty->driver_data;
int retval = -EINVAL;
+ if (!port)
+ goto exit;
+
dbg("%s - port %d, %d byte(s)", __FUNCTION__, port->number, count);
if (!port->open_count) {
@@ -277,6 +282,9 @@ static int serial_write_room (struct tty_struct *tty)
struct usb_serial_port *port = tty->driver_data;
int retval = -EINVAL;
+ if (!port)
+ goto exit;
+
dbg("%s - port %d", __FUNCTION__, port->number);
if (!port->open_count) {
@@ -296,6 +304,9 @@ static int serial_chars_in_buffer (struct tty_struct *tty)
struct usb_serial_port *port = tty->driver_data;
int retval = -EINVAL;
+ if (!port)
+ goto exit;
+
dbg("%s = port %d", __FUNCTION__, port->number);
if (!port->open_count) {
@@ -314,6 +325,9 @@ static void serial_throttle (struct tty_struct * tty)
{
struct usb_serial_port *port = tty->driver_data;
+ if (!port)
+ return;
+
dbg("%s - port %d", __FUNCTION__, port->number);
if (!port->open_count) {
@@ -330,6 +344,9 @@ static void serial_unthrottle (struct tty_struct * tty)
{
struct usb_serial_port *port = tty->driver_data;
+ if (!port)
+ return;
+
dbg("%s - port %d", __FUNCTION__, port->number);
if (!port->open_count) {
@@ -347,6 +364,9 @@ static int serial_ioctl (struct tty_struct *tty, struct file * file, unsigned in
struct usb_serial_port *port = tty->driver_data;
int retval = -ENODEV;
+ if (!port)
+ goto exit;
+
dbg("%s - port %d, cmd 0x%.4x", __FUNCTION__, port->number, cmd);
if (!port->open_count) {
@@ -368,6 +388,9 @@ static void serial_set_termios (struct tty_struct *tty, struct termios * old)
{
struct usb_serial_port *port = tty->driver_data;
+ if (!port)
+ return;
+
dbg("%s - port %d", __FUNCTION__, port->number);
if (!port->open_count) {
@@ -384,6 +407,9 @@ static void serial_break (struct tty_struct *tty, int break_state)
{
struct usb_serial_port *port = tty->driver_data;
+ if (!port)
+ return;
+
dbg("%s - port %d", __FUNCTION__, port->number);
if (!port->open_count) {
@@ -445,6 +471,9 @@ static int serial_tiocmget (struct tty_struct *tty, struct file *file)
{
struct usb_serial_port *port = tty->driver_data;
+ if (!port)
+ goto exit;
+
dbg("%s - port %d", __FUNCTION__, port->number);
if (!port->open_count) {
@@ -464,6 +493,9 @@ static int serial_tiocmset (struct tty_struct *tty, struct file *file,
{
struct usb_serial_port *port = tty->driver_data;
+ if (!port)
+ goto exit;
+
dbg("%s - port %d", __FUNCTION__, port->number);
if (!port->open_count) {