Commit 91c0bce2 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman Committed by Linus Torvalds

[PATCH] USB Serial: fix use-after-free bug in usb-serial core

This fixes a use-after-free bug in the usb-serial core.  It is simple to
trigger this (open a usb-serial port, then yank the device out before
closing the port.)  Thanks to Stefan Seyfried <seife@suse.de> for
reporting this, and to the slab debugging code which enabled it to be
tracked down.
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent b6f57864
...@@ -242,8 +242,10 @@ static void serial_close(struct tty_struct *tty, struct file * filp) ...@@ -242,8 +242,10 @@ static void serial_close(struct tty_struct *tty, struct file * filp)
down(&port->sem); down(&port->sem);
if (port->open_count == 0) if (port->open_count == 0) {
goto out; up(&port->sem);
return;
}
--port->open_count; --port->open_count;
if (port->open_count == 0) { if (port->open_count == 0) {
...@@ -260,10 +262,8 @@ static void serial_close(struct tty_struct *tty, struct file * filp) ...@@ -260,10 +262,8 @@ static void serial_close(struct tty_struct *tty, struct file * filp)
module_put(port->serial->type->driver.owner); module_put(port->serial->type->driver.owner);
} }
kref_put(&port->serial->kref, destroy_serial);
out:
up(&port->sem); up(&port->sem);
kref_put(&port->serial->kref, destroy_serial);
} }
static int serial_write (struct tty_struct * tty, const unsigned char *buf, int count) static int serial_write (struct tty_struct * tty, const unsigned char *buf, int count)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment