Commit 5ec63fdb authored by Prashanth K's avatar Prashanth K Committed by Greg Kroah-Hartman
Browse files

usb: gadget: u_serial: Add null pointer check in gserial_resume 



Consider a case where gserial_disconnect has already cleared
gser->ioport. And if a wakeup interrupt triggers afterwards,
gserial_resume gets called, which will lead to accessing of
gser->ioport and thus causing null pointer dereference.Add
a null pointer check to prevent this.

Added a static spinlock to prevent gser->ioport from becoming
null after the newly added check.

Fixes: aba3a8d0 ("usb: gadget: u_serial: add suspend resume callbacks")
Cc: stable <stable@kernel.org>
Signed-off-by: default avatarPrashanth K <quic_prashk@quicinc.com>
Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/1676309438-14922-1-git-send-email-quic_prashk@quicinc.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 7ebb605d

drivers/usb/gadget/function/u_serial.c

+19 −4
Original line number Diff line number Diff line
@@ -82,6 +82,9 @@ 
#define WRITE_BUF_SIZE		8192		/* TX only */

#define GS_CONSOLE_BUF_SIZE	8192



/* Prevents race conditions while accessing gser->ioport */

static DEFINE_SPINLOCK(serial_port_lock);



/* console info */

struct gs_console {

	struct console		console;
@@ -1375,8 +1378,10 @@ void gserial_disconnect(struct gserial *gser) 
	if (!port)

		return;



	spin_lock_irqsave(&serial_port_lock, flags);



	/* tell the TTY glue not to do I/O here any more */

	spin_lock_irqsave(&port->port_lock, flags);

	spin_lock(&port->port_lock);



	gs_console_disconnect(port);
@@ -1391,7 +1396,8 @@ void gserial_disconnect(struct gserial *gser) 
			tty_hangup(port->port.tty);

	}

	port->suspended = false;

	spin_unlock_irqrestore(&port->port_lock, flags);

	spin_unlock(&port->port_lock);

	spin_unlock_irqrestore(&serial_port_lock, flags);



	/* disable endpoints, aborting down any active I/O */

	usb_ep_disable(gser->out);
@@ -1425,10 +1431,19 @@ EXPORT_SYMBOL_GPL(gserial_suspend); 


void gserial_resume(struct gserial *gser)

{

	struct gs_port *port = gser->ioport;

	struct gs_port *port;

	unsigned long	flags;



	spin_lock_irqsave(&port->port_lock, flags);

	spin_lock_irqsave(&serial_port_lock, flags);

	port = gser->ioport;



	if (!port) {

		spin_unlock_irqrestore(&serial_port_lock, flags);

		return;

	}



	spin_lock(&port->port_lock);

	spin_unlock(&serial_port_lock);

	port->suspended = false;

	if (!port->start_delayed) {

		spin_unlock_irqrestore(&port->port_lock, flags);