Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-01 18:55:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

usb: cdc-acm: Fix acm_tty_hangup() vs. acm_tty_close() race

Browse Source 
[Not upstream s it was fixed differently there for 3.3 with a much more
"intrusive" rework of the driver - gregkh]

There is a race condition involving acm_tty_hangup() and acm_tty_close()
where hangup() would attempt to access tty->driver_data without proper
locking and NULL checking after close() has potentially already set it
to NULL.  One possibility to (sporadically) trigger this behavior is to
perform a suspend/resume cycle with a running WWAN data connection.

This patch addresses the issue by introducing a NULL check for
tty->driver_data in acm_tty_hangup() protected by open_mutex and exiting
gracefully when hangup() is invoked on a device that has already been
closed.

Signed-off-by: Thilo-Alexander Ginkel <thilo@ginkel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Thilo-Alexander Ginkel 2011-12-17 10:55:10 +01:00 committed by Greg Kroah-Hartman
parent cdd2a1dae5
commit 53b63616b3
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/usb/class/cdc-acm.c
View File

@ -554,10 +554,18 @@ static void acm_port_down(struct acm *acm)
static void acm_tty_hangup(struct tty_struct *tty)
{
struct acm *acm = tty->driver_data;
tty_port_hangup(&acm->port);
struct acm *acm;
mutex_lock(&open_mutex);
acm = tty->driver_data;
if (!acm)
goto out;
tty_port_hangup(&acm->port);
acm_port_down(acm);
out:
mutex_unlock(&open_mutex);
}