tty: Fix leak in ti-usb

upstream commit: cf5450930db0ae308584e5361f3345e0ff73e643

If the ti-usb adapter returns an zero data length frame (which happens)
then we leak a kref.  Found by Christoph Mair <christoph.mair@gmail.com>
who proposed a patch.  The patch here is different as Christoph's patch
didn't work for the case where tty = NULL and data arrived but Christoph
did all the hard work chasing it down.

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 2620bf6fe5e1bbeb3ea7e4c697a7625822d9c783..9c4c700c7cc640ec4400bf8ab00175938da18ceb 100644 (file)
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -1215,20 +1215,22 @@ static void ti_bulk_in_callback(struct urb *urb)
        }
 
        tty = tty_port_tty_get(&port->port);
-       if (tty && urb->actual_length) {
-               usb_serial_debug_data(debug, dev, __func__,
-                       urb->actual_length, urb->transfer_buffer);
-
-               if (!tport->tp_is_open)
-                       dbg("%s - port closed, dropping data", __func__);
-               else
-                       ti_recv(&urb->dev->dev, tty,
+       if (tty) {
+               if (urb->actual_length) {
+                       usb_serial_debug_data(debug, dev, __func__,
+                               urb->actual_length, urb->transfer_buffer);
+
+                       if (!tport->tp_is_open)
+                               dbg("%s - port closed, dropping data",
+                                       __func__);
+                       else
+                               ti_recv(&urb->dev->dev, tty,
                                                urb->transfer_buffer,
                                                urb->actual_length);
-
-               spin_lock(&tport->tp_lock);
-               tport->tp_icount.rx += urb->actual_length;
-               spin_unlock(&tport->tp_lock);
+                       spin_lock(&tport->tp_lock);
+                       tport->tp_icount.rx += urb->actual_length;
+                       spin_unlock(&tport->tp_lock);
+               }
                tty_kref_put(tty);
        }