4.4-stable patches

added patches:
	usb-gadget-serial-fix-oops-when-data-rx-d-after-close.patch

diff --git a/queue-4.4/series b/queue-4.4/series
index 6c2ef71c5f4ed1035e8399678077b738a7c3102c..0e4bcf0ecf8e5dd34a5203a0f3fa5fca69f9b418 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -41,3 +41,4 @@ risc-v-include-linux-ftrace.h-in-asm-prototypes.h.patch
 powerpc-tm-fix-userspace-r13-corruption.patch
 powerpc-tm-avoid-possible-userspace-r1-corruption-on-reclaim.patch
 arc-build-get-rid-of-toolchain-check.patch
+usb-gadget-serial-fix-oops-when-data-rx-d-after-close.patch

diff --git a/queue-4.4/usb-gadget-serial-fix-oops-when-data-rx-d-after-close.patch b/queue-4.4/usb-gadget-serial-fix-oops-when-data-rx-d-after-close.patch
new file mode 100644 (file)
index 0000000..67c97d4
--- /dev/null
+++ b/queue-4.4/usb-gadget-serial-fix-oops-when-data-rx-d-after-close.patch
@@ -0,0 +1,35 @@
+From daa35bd95634a2a2d72d1049c93576a02711cb1a Mon Sep 17 00:00:00 2001
+From: Stephen Warren <swarren@nvidia.com>
+Date: Wed, 16 Aug 2017 14:30:10 -0600
+Subject: usb: gadget: serial: fix oops when data rx'd after close
+
+From: Stephen Warren <swarren@nvidia.com>
+
+commit daa35bd95634a2a2d72d1049c93576a02711cb1a upstream.
+
+When the gadget serial device has no associated TTY, do not pass any
+received data into the TTY layer for processing; simply drop it instead.
+This prevents the TTY layer from calling back into the gadget serial
+driver, which will then crash in e.g. gs_write_room() due to lack of
+gadget serial device to TTY association (i.e. a NULL pointer dereference).
+
+Signed-off-by: Stephen Warren <swarren@nvidia.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/u_serial.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/u_serial.c
++++ b/drivers/usb/gadget/function/u_serial.c
+@@ -518,7 +518,7 @@ static void gs_rx_push(unsigned long _po
+               }
+ 
+               /* push data to (open) tty */
+-              if (req->actual) {
++              if (req->actual && tty) {
+                       char            *packet = req->buf;
+                       unsigned        size = req->actual;
+                       unsigned        n;