The patch titled
ipwireless: fix potential tty == NULL dereference
has been added to the -mm tree. Its filename is
ipwireless-fix-potential-tty-==-null-dereference.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code ***
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/
------------------------------------------------------
Subject: ipwireless: fix potential tty == NULL dereference
From: David Sterba <dsterba@xxxxxxx>
The Coverity checker spotted the following inconsequent NULL checking in
drivers/char/pcmcia/ipwireless/network.c:ipwireless_network_packet_received()
if (tty && channel_idx == IPW_CHANNEL_RAS
&& (network->ras_control_lines &
IPW_CONTROL_LINE_DCD) != 0
&& ipwireless_tty_is_modem(tty)) {
...
else
ipwireless_tty_received(tty, data, length);
Cc: Adrian Bunk <bunk@xxxxxxxxxx>
Signed-off-by: David Sterba <dsterba@xxxxxxx>
Signed-off-by: Jiri Kosina <jkosina@xxxxxxx>
Cc: "John W. Linville" <linville@xxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
drivers/char/pcmcia/ipwireless/network.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff -puN drivers/char/pcmcia/ipwireless/network.c~ipwireless-fix-potential-tty-==-null-dereference drivers/char/pcmcia/ipwireless/network.c
--- a/drivers/char/pcmcia/ipwireless/network.c~ipwireless-fix-potential-tty-==-null-dereference
+++ a/drivers/char/pcmcia/ipwireless/network.c
@@ -377,13 +377,16 @@ void ipwireless_network_packet_received(
for (i = 0; i < MAX_ASSOCIATED_TTYS; i++) {
struct ipw_tty *tty = network->associated_ttys[channel_idx][i];
+ if (!tty)
+ continue;
+
/*
* If it's associated with a tty (other than the RAS channel
* when we're online), then send the data to that tty. The RAS
* channel's data is handled above - it always goes through
* ppp_generic.
*/
- if (tty && channel_idx == IPW_CHANNEL_RAS
+ if (channel_idx == IPW_CHANNEL_RAS
&& (network->ras_control_lines &
IPW_CONTROL_LINE_DCD) != 0
&& ipwireless_tty_is_modem(tty)) {
_
Patches currently in -mm which might be from dsterba@xxxxxxx are
ipwireless-fix-potential-tty-==-null-dereference.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
