The patch titled ipwireless: fix potential tty == NULL dereference has been added to the -mm tree. Its filename is ipwireless-fix-potential-tty-==-null-dereference.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find out what to do about this The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: ipwireless: fix potential tty == NULL dereference From: David Sterba <dsterba@xxxxxxx> The Coverity checker spotted the following inconsequent NULL checking in drivers/char/pcmcia/ipwireless/network.c:ipwireless_network_packet_received() if (tty && channel_idx == IPW_CHANNEL_RAS && (network->ras_control_lines & IPW_CONTROL_LINE_DCD) != 0 && ipwireless_tty_is_modem(tty)) { ... else ipwireless_tty_received(tty, data, length); Cc: Adrian Bunk <bunk@xxxxxxxxxx> Signed-off-by: David Sterba <dsterba@xxxxxxx> Signed-off-by: Jiri Kosina <jkosina@xxxxxxx> Cc: "John W. Linville" <linville@xxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- drivers/char/pcmcia/ipwireless/network.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff -puN drivers/char/pcmcia/ipwireless/network.c~ipwireless-fix-potential-tty-==-null-dereference drivers/char/pcmcia/ipwireless/network.c --- a/drivers/char/pcmcia/ipwireless/network.c~ipwireless-fix-potential-tty-==-null-dereference +++ a/drivers/char/pcmcia/ipwireless/network.c @@ -377,13 +377,16 @@ void ipwireless_network_packet_received( for (i = 0; i < MAX_ASSOCIATED_TTYS; i++) { struct ipw_tty *tty = network->associated_ttys[channel_idx][i]; + if (!tty) + continue; + /* * If it's associated with a tty (other than the RAS channel * when we're online), then send the data to that tty. The RAS * channel's data is handled above - it always goes through * ppp_generic. */ - if (tty && channel_idx == IPW_CHANNEL_RAS + if (channel_idx == IPW_CHANNEL_RAS && (network->ras_control_lines & IPW_CONTROL_LINE_DCD) != 0 && ipwireless_tty_is_modem(tty)) { _ Patches currently in -mm which might be from dsterba@xxxxxxx are ipwireless-fix-potential-tty-==-null-dereference.patch - To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html