USB: serial: sierra driver indat_callback fix

commit b87c6e86dac1bb5222279cc8ff7e09529e1c4ed9 upstream.

A crash has been reported with sierra driver on disconnect with
Ubuntu/Lucid distribution based on kernel-2.6.32.
The cause of the crash was determined as "NULL tty pointer was being
referenced" and the NULL pointer was passed by sierra_indat_callback().

This patch modifies sierra_indat_callback() function to check for NULL
tty structure pointer. This modification prevents a crash from happening
when the device is disconnected.

This patch fixes the bug reported in Launchpad:
  https://bugs.launchpad.net/ubuntu/+source/linux/+bug/511157

Signed-off-by: Elina Pasheva <epasheva@sierrawireless.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 11 insertions, 8 deletions

diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index 3eb6143bb646..0cfd62127424 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -604,14 +604,17 @@ static void sierra_indat_callback(struct urb *urb)
         } else {
                 if (urb->actual_length) {
                         tty = tty_port_tty_get(&port->port);
-
-                        tty_buffer_request_room(tty, urb->actual_length);
-                        tty_insert_flip_string(tty, data, urb->actual_length);
-                        tty_flip_buffer_push(tty);
-
-                        tty_kref_put(tty);
-                        usb_serial_debug_data(debug, &port->dev, __func__,
-                                urb->actual_length, data);
+                        if (tty) {
+                                tty_buffer_request_room(tty,
+                                        urb->actual_length);
+                                tty_insert_flip_string(tty, data,
+                                        urb->actual_length);
+                                tty_flip_buffer_push(tty);
+
+                                tty_kref_put(tty);
+                                usb_serial_debug_data(debug, &port->dev,
+                                        __func__, urb->actual_length, data);
+                        }
                 } else {
                         dev_dbg(&port->dev, "%s: empty read urb"
                                 " received\n", __func__);