From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 18 Oct 2018 15:18:35 +0000 (+0200)
Subject: 4.4-stable patches
X-Git-Tag: v4.18.16~6
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f6e6cc5a69d2a8ccaeb17b83c669e2acbc129f3d;p=thirdparty%2Fkernel%2Fstable-queue.git

4.4-stable patches

added patches:
	usb-gadget-serial-fix-oops-when-data-rx-d-after-close.patch
---

diff --git a/queue-4.4/series b/queue-4.4/series
index 6c2ef71c5f4..0e4bcf0ecf8 100644
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -41,3 +41,4 @@ risc-v-include-linux-ftrace.h-in-asm-prototypes.h.patch
 powerpc-tm-fix-userspace-r13-corruption.patch
 powerpc-tm-avoid-possible-userspace-r1-corruption-on-reclaim.patch
 arc-build-get-rid-of-toolchain-check.patch
+usb-gadget-serial-fix-oops-when-data-rx-d-after-close.patch
diff --git a/queue-4.4/usb-gadget-serial-fix-oops-when-data-rx-d-after-close.patch b/queue-4.4/usb-gadget-serial-fix-oops-when-data-rx-d-after-close.patch
new file mode 100644
index 00000000000..67c97d46028
--- /dev/null
+++ b/queue-4.4/usb-gadget-serial-fix-oops-when-data-rx-d-after-close.patch
@@ -0,0 +1,35 @@
+From daa35bd95634a2a2d72d1049c93576a02711cb1a Mon Sep 17 00:00:00 2001
+From: Stephen Warren <swarren@nvidia.com>
+Date: Wed, 16 Aug 2017 14:30:10 -0600
+Subject: usb: gadget: serial: fix oops when data rx'd after close
+
+From: Stephen Warren <swarren@nvidia.com>
+
+commit daa35bd95634a2a2d72d1049c93576a02711cb1a upstream.
+
+When the gadget serial device has no associated TTY, do not pass any
+received data into the TTY layer for processing; simply drop it instead.
+This prevents the TTY layer from calling back into the gadget serial
+driver, which will then crash in e.g. gs_write_room() due to lack of
+gadget serial device to TTY association (i.e. a NULL pointer dereference).
+
+Signed-off-by: Stephen Warren <swarren@nvidia.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/u_serial.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/u_serial.c
++++ b/drivers/usb/gadget/function/u_serial.c
+@@ -518,7 +518,7 @@ static void gs_rx_push(unsigned long _po
+ 		}
+ 
+ 		/* push data to (open) tty */
+-		if (req->actual) {
++		if (req->actual && tty) {
+ 			char		*packet = req->buf;
+ 			unsigned	size = req->actual;
+ 			unsigned	n;