diff options
author | Greg Kroah-Hartman <gregkh@suse.de> | 2006-03-07 09:28:27 -0800 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@suse.de> | 2006-03-07 09:28:27 -0800 |
commit | 08a6543dcdb4237134742ec974cdb2347a04ece5 (patch) | |
tree | b8e1e024ad0b0a85f28d928824891a80ea58a83b /usb | |
parent | 98157f8073f8608d5180763c3b2123aa2a640a3d (diff) | |
download | patches-08a6543dcdb4237134742ec974cdb2347a04ece5.tar.gz |
removed applied usb patch
Diffstat (limited to 'usb')
-rw-r--r-- | usb/usb-serial-fix-use-after-free.patch | 42 |
1 files changed, 0 insertions, 42 deletions
diff --git a/usb/usb-serial-fix-use-after-free.patch b/usb/usb-serial-fix-use-after-free.patch deleted file mode 100644 index a1d7000badb0a..0000000000000 --- a/usb/usb-serial-fix-use-after-free.patch +++ /dev/null @@ -1,42 +0,0 @@ -From: Greg Kroah-Hartman <gregkh@suse.de> -Subject: USB Serial: fix use-after-free bug in usb-serial core - -This fixes a use-after-free bug in the usb-serial core. It is simple to -trigger this (open a usb-serial port, then yank the device out before -closing the port.) Thanks to Stefan Seyfried <seife@suse.de> for -reporting this, and to the slab debugging code which enabled it to be -tracked down. - -Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> - ---- - drivers/usb/serial/usb-serial.c | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - ---- gregkh-2.6.orig/drivers/usb/serial/usb-serial.c -+++ gregkh-2.6/drivers/usb/serial/usb-serial.c -@@ -242,8 +242,10 @@ static void serial_close(struct tty_stru - - down(&port->sem); - -- if (port->open_count == 0) -- goto out; -+ if (port->open_count == 0) { -+ up(&port->sem); -+ return; -+ } - - --port->open_count; - if (port->open_count == 0) { -@@ -260,10 +262,8 @@ static void serial_close(struct tty_stru - module_put(port->serial->type->driver.owner); - } - -- kref_put(&port->serial->kref, destroy_serial); -- --out: - up(&port->sem); -+ kref_put(&port->serial->kref, destroy_serial); - } - - static int serial_write (struct tty_struct * tty, const unsigned char *buf, int count) |