leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[PATCH] usbserial: Fixes leak in serial_open() error path.

Browse Source 
If serial_open() fails at the port assignment or mutex_lock_interruptible()
is interrupted, the 'serial' object will never be freed.

We should call kref_put() when those errors happens.

Signed-off-by: Luiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Luiz Fernando Capitulino 2006-05-11 22:34:24 -03:00 committed by Greg Kroah-Hartman
parent 704936a25b
commit 71a84163ca
1 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
drivers/usb/serial/usb-serial.c
View File

@ -189,11 +189,15 @@ static int serial_open (struct tty_struct *tty, struct file * filp)
portNumber = tty->index - serial->minor;
port = serial->port[portNumber];
if (!port)
return -ENODEV;
if (!port) {
retval = -ENODEV;
goto bailout_kref_put;
}
if (mutex_lock_interruptible(&port->mutex))
return -ERESTARTSYS;
if (mutex_lock_interruptible(&port->mutex)) {
retval = -ERESTARTSYS;
goto bailout_kref_put;
}
++port->open_count;
@ -209,7 +213,7 @@ static int serial_open (struct tty_struct *tty, struct file * filp)
* safe because we are called with BKL held */
if (!try_module_get(serial->type->driver.owner)) {
retval = -ENODEV;
goto bailout_kref_put;
goto bailout_mutex_unlock;
}
/* only call the device specific open if this
@ -224,9 +228,10 @@ static int serial_open (struct tty_struct *tty, struct file * filp)
bailout_module_put:
module_put(serial->type->driver.owner);
bailout_kref_put:
bailout_mutex_unlock:
port->open_count = 0;
mutex_unlock(&port->mutex);
bailout_kref_put:
kref_put(&serial->kref, destroy_serial);
return retval;
}