tty: Fix leak in ti-usb
If the ti-usb adapter returns an zero data length frame (which happens) then we leak a kref. Found by Christoph Mair <christoph.mair@gmail.com> who proposed a patch. The patch here is different as Christoph's patch didn't work for the case where tty = NULL and data arrived but Christoph did all the hard work chasing it down. Signed-off-by: Alan Cox <alan@linux.intel.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
7a9a65ced1
commit
cf5450930d
|
@ -1215,20 +1215,22 @@ static void ti_bulk_in_callback(struct urb *urb)
|
||||||
}
|
}
|
||||||
|
|
||||||
tty = tty_port_tty_get(&port->port);
|
tty = tty_port_tty_get(&port->port);
|
||||||
if (tty && urb->actual_length) {
|
if (tty) {
|
||||||
|
if (urb->actual_length) {
|
||||||
usb_serial_debug_data(debug, dev, __func__,
|
usb_serial_debug_data(debug, dev, __func__,
|
||||||
urb->actual_length, urb->transfer_buffer);
|
urb->actual_length, urb->transfer_buffer);
|
||||||
|
|
||||||
if (!tport->tp_is_open)
|
if (!tport->tp_is_open)
|
||||||
dbg("%s - port closed, dropping data", __func__);
|
dbg("%s - port closed, dropping data",
|
||||||
|
__func__);
|
||||||
else
|
else
|
||||||
ti_recv(&urb->dev->dev, tty,
|
ti_recv(&urb->dev->dev, tty,
|
||||||
urb->transfer_buffer,
|
urb->transfer_buffer,
|
||||||
urb->actual_length);
|
urb->actual_length);
|
||||||
|
|
||||||
spin_lock(&tport->tp_lock);
|
spin_lock(&tport->tp_lock);
|
||||||
tport->tp_icount.rx += urb->actual_length;
|
tport->tp_icount.rx += urb->actual_length;
|
||||||
spin_unlock(&tport->tp_lock);
|
spin_unlock(&tport->tp_lock);
|
||||||
|
}
|
||||||
tty_kref_put(tty);
|
tty_kref_put(tty);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue