aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorAlan Cox <alan@lxorguk.ukuu.org.uk>2009-04-14 09:58:11 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2009-04-14 11:48:50 -0400
commitcf5450930db0ae308584e5361f3345e0ff73e643 (patch)
tree7e9b6229de416ae0ac651eb55fb6230e1ef80fc9 /drivers
parent7a9a65ced11ece416b730d6f21040a18e62d78a8 (diff)
tty: Fix leak in ti-usb
If the ti-usb adapter returns an zero data length frame (which happens) then we leak a kref. Found by Christoph Mair <christoph.mair@gmail.com> who proposed a patch. The patch here is different as Christoph's patch didn't work for the case where tty = NULL and data arrived but Christoph did all the hard work chasing it down. Signed-off-by: Alan Cox <alan@linux.intel.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/usb/serial/ti_usb_3410_5052.c26
1 files changed, 14 insertions, 12 deletions
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 2620bf6fe5e1..9c4c700c7cc6 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -1215,20 +1215,22 @@ static void ti_bulk_in_callback(struct urb *urb)
1215 } 1215 }
1216 1216
1217 tty = tty_port_tty_get(&port->port); 1217 tty = tty_port_tty_get(&port->port);
1218 if (tty && urb->actual_length) { 1218 if (tty) {
1219 usb_serial_debug_data(debug, dev, __func__, 1219 if (urb->actual_length) {
1220 urb->actual_length, urb->transfer_buffer); 1220 usb_serial_debug_data(debug, dev, __func__,
1221 1221 urb->actual_length, urb->transfer_buffer);
1222 if (!tport->tp_is_open) 1222
1223 dbg("%s - port closed, dropping data", __func__); 1223 if (!tport->tp_is_open)
1224 else 1224 dbg("%s - port closed, dropping data",
1225 ti_recv(&urb->dev->dev, tty, 1225 __func__);
1226 else
1227 ti_recv(&urb->dev->dev, tty,
1226 urb->transfer_buffer, 1228 urb->transfer_buffer,
1227 urb->actual_length); 1229 urb->actual_length);
1228 1230 spin_lock(&tport->tp_lock);
1229 spin_lock(&tport->tp_lock); 1231 tport->tp_icount.rx += urb->actual_length;
1230 tport->tp_icount.rx += urb->actual_length; 1232 spin_unlock(&tport->tp_lock);
1231 spin_unlock(&tport->tp_lock); 1233 }
1232 tty_kref_put(tty); 1234 tty_kref_put(tty);
1233 } 1235 }
1234 1236