USB: omninet: fix potential tty NULL dereference

Add check for return value of tty_port_tty_get,
since it can return NULL after port hangup that may happen anytime.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
index d31f661d758cfe50aa4b9f9f56af66101ba0929f..f524cd910e2c420e78168047f354ecfa88801d15 100644 (file)
--- a/drivers/usb/serial/omninet.c
+++ b/drivers/usb/serial/omninet.c
@@ -185,10 +185,12 @@ static void omninet_read_bulk_callback(struct urb *urb)
 
        if (urb->actual_length && header->oh_len) {
                struct tty_struct *tty = tty_port_tty_get(&port->port);
-               tty_insert_flip_string(tty, data + OMNINET_DATAOFFSET,
+               if (tty) {
+                       tty_insert_flip_string(tty, data + OMNINET_DATAOFFSET,
                                                        header->oh_len);
-               tty_flip_buffer_push(tty);
-               tty_kref_put(tty);
+                       tty_flip_buffer_push(tty);
+                       tty_kref_put(tty);
+               }
        }
 
        /* Continue trying to always read  */