diff options
| author | TINNES Julien RD-MAPS-ISS <julien.tinnes@francetelecom.com> | 2005-06-23 00:10:08 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@ppc970.osdl.org> | 2005-06-23 09:45:31 -0700 |
| commit | d9ad7ef1979d65a4200847ec91be5b9ad961eba8 (patch) | |
| tree | 058dceba2670ee229a4fdf6992760260b0f0e002 /drivers/char/amiserial.c | |
| parent | 17abee3d50685b8ef4e38d37abacf8b650a3a387 (diff) | |
| download | op-kernel-dev-d9ad7ef1979d65a4200847ec91be5b9ad961eba8.zip op-kernel-dev-d9ad7ef1979d65a4200847ec91be5b9ad961eba8.tar.gz | |
[PATCH] Potential null pointer dereference in amiga serial driver
A pointer is dereferenced before it is null-checked.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/char/amiserial.c')
| -rw-r--r-- | drivers/char/amiserial.c | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/drivers/char/amiserial.c b/drivers/char/amiserial.c index 1dc4259..777bc49 100644 --- a/drivers/char/amiserial.c +++ b/drivers/char/amiserial.c @@ -861,13 +861,18 @@ static void change_speed(struct async_struct *info, static void rs_put_char(struct tty_struct *tty, unsigned char ch) { - struct async_struct *info = (struct async_struct *)tty->driver_data; + struct async_struct *info; unsigned long flags; + if (!tty) + return; + + info = tty->driver_data; + if (serial_paranoia_check(info, tty->name, "rs_put_char")) return; - if (!tty || !info->xmit.buf) + if (!info->xmit.buf) return; local_irq_save(flags); @@ -910,13 +915,18 @@ static void rs_flush_chars(struct tty_struct *tty) static int rs_write(struct tty_struct * tty, const unsigned char *buf, int count) { int c, ret = 0; - struct async_struct *info = (struct async_struct *)tty->driver_data; + struct async_struct *info; unsigned long flags; + if (!tty) + return 0; + + info = tty->driver_data; + if (serial_paranoia_check(info, tty->name, "rs_write")) return 0; - if (!tty || !info->xmit.buf || !tmp_buf) + if (!info->xmit.buf || !tmp_buf) return 0; local_save_flags(flags); |
