mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-01 06:33:07 +00:00
[PATCH] USB Serial: fix use-after-free bug in usb-serial core
This fixes a use-after-free bug in the usb-serial core. It is simple to trigger this (open a usb-serial port, then yank the device out before closing the port.) Thanks to Stefan Seyfried <seife@suse.de> for reporting this, and to the slab debugging code which enabled it to be tracked down. Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
parent
b6f57864ee
commit
91c0bce29e
1 changed files with 5 additions and 5 deletions
|
@ -242,8 +242,10 @@ static void serial_close(struct tty_struct *tty, struct file * filp)
|
||||||
|
|
||||||
down(&port->sem);
|
down(&port->sem);
|
||||||
|
|
||||||
if (port->open_count == 0)
|
if (port->open_count == 0) {
|
||||||
goto out;
|
up(&port->sem);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
--port->open_count;
|
--port->open_count;
|
||||||
if (port->open_count == 0) {
|
if (port->open_count == 0) {
|
||||||
|
@ -260,10 +262,8 @@ static void serial_close(struct tty_struct *tty, struct file * filp)
|
||||||
module_put(port->serial->type->driver.owner);
|
module_put(port->serial->type->driver.owner);
|
||||||
}
|
}
|
||||||
|
|
||||||
kref_put(&port->serial->kref, destroy_serial);
|
|
||||||
|
|
||||||
out:
|
|
||||||
up(&port->sem);
|
up(&port->sem);
|
||||||
|
kref_put(&port->serial->kref, destroy_serial);
|
||||||
}
|
}
|
||||||
|
|
||||||
static int serial_write (struct tty_struct * tty, const unsigned char *buf, int count)
|
static int serial_write (struct tty_struct * tty, const unsigned char *buf, int count)
|
||||||
|
|
Loading…
Reference in a new issue