From e399a8832d895c40efe970509a017a24ffb49d71 Mon Sep 17 00:00:00 2001 From: Adrien Destugues Date: Sun, 30 Jun 2019 10:33:59 +0200 Subject: [PATCH] usb_serial: don't allow Service() on a closed device. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - In Service, check that the device is open. - In Close, clear dangling pointers to more easily spot problems and avoid risk of accessing freed memory. Change-Id: I970c4b8b8ec14db448388f74fc275634801c359a Reviewed-on: https://review.haiku-os.org/c/1551 Reviewed-by: Jérôme Duval --- .../kernel/drivers/ports/usb_serial/SerialDevice.cpp | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/add-ons/kernel/drivers/ports/usb_serial/SerialDevice.cpp b/src/add-ons/kernel/drivers/ports/usb_serial/SerialDevice.cpp index f5b18cf912..5c32969597 100644 --- a/src/add-ons/kernel/drivers/ports/usb_serial/SerialDevice.cpp +++ b/src/add-ons/kernel/drivers/ports/usb_serial/SerialDevice.cpp @@ -212,6 +212,9 @@ SerialDevice::SetModes(struct termios *tios) bool SerialDevice::Service(struct tty *tty, uint32 op, void *buffer, size_t length) { + if (!fDeviceOpen) + return false; + if (tty != fMasterTTY) return false; @@ -453,6 +456,7 @@ SerialDevice::Close() fStopThreads = true; fInputStopped = false; + fDeviceOpen = false; if (!fDeviceRemoved) { gUSBModule->cancel_queued_transfers(fReadPipe); @@ -473,7 +477,10 @@ SerialDevice::Close() gTTYModule->tty_destroy(fMasterTTY); gTTYModule->tty_destroy(fSlaveTTY); - fDeviceOpen = false; + fMasterTTY = NULL; + fSlaveTTY = NULL; + fSystemTTYCookie = NULL; + fDeviceTTYCookie = NULL; return B_OK; }