diff options
| author | Johan Hovold <[email protected]> | 2020-10-25 18:45:51 +0100 |
|---|---|---|
| committer | Johan Hovold <[email protected]> | 2020-11-04 11:01:19 +0100 |
| commit | 49fbb8e37a961396a5b6c82937c70df91de45e9d (patch) | |
| tree | f4f50630f5a2ad72979585c9dcc4553bdcadf637 | |
| parent | 37faf50615412947868c49aee62f68233307f4e4 (diff) | |
USB: serial: keyspan_pda: fix tx-unthrottle use-after-free
The driver's transmit-unthrottle work was never flushed on disconnect,
something which could lead to the driver port data being freed while the
unthrottle work is still scheduled.
Fix this by cancelling the unthrottle work when shutting down the port.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: [email protected]
Acked-by: Sebastian Andrzej Siewior <[email protected]>
Reviewed-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Johan Hovold <[email protected]>
| -rw-r--r-- | drivers/usb/serial/keyspan_pda.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c index d91180ab5f3b..781b6723379f 100644 --- a/drivers/usb/serial/keyspan_pda.c +++ b/drivers/usb/serial/keyspan_pda.c @@ -647,8 +647,12 @@ error: } static void keyspan_pda_close(struct usb_serial_port *port) { + struct keyspan_pda_private *priv = usb_get_serial_port_data(port); + usb_kill_urb(port->write_urb); usb_kill_urb(port->interrupt_in_urb); + + cancel_work_sync(&priv->unthrottle_work); } |