aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDavid Sterba <dsterba@suse.cz>2008-03-04 17:28:50 -0500
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2008-03-04 19:35:13 -0500
commita51f4124e6d69afdfae34a2ff2e580e7bf224ad2 (patch)
tree5db5968bdd88e7db69847604e1efbd46f8dda14f
parent3149be50d3a31df095bcc83d752293da65a37f62 (diff)
ipwireless: fix potential tty == NULL dereference
The Coverity checker spotted the following inconsequent NULL checking in drivers/char/pcmcia/ipwireless/network.c:ipwireless_network_packet_received() if (tty && channel_idx == IPW_CHANNEL_RAS && (network->ras_control_lines & IPW_CONTROL_LINE_DCD) != 0 && ipwireless_tty_is_modem(tty)) { ... else ipwireless_tty_received(tty, data, length); Cc: Adrian Bunk <bunk@kernel.org> Signed-off-by: David Sterba <dsterba@suse.cz> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Cc: "John W. Linville" <linville@tuxdriver.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--drivers/char/pcmcia/ipwireless/network.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/char/pcmcia/ipwireless/network.c b/drivers/char/pcmcia/ipwireless/network.c
index ff35230058d3..d793e68b3e0d 100644
--- a/drivers/char/pcmcia/ipwireless/network.c
+++ b/drivers/char/pcmcia/ipwireless/network.c
@@ -377,13 +377,16 @@ void ipwireless_network_packet_received(struct ipw_network *network,
377 for (i = 0; i < MAX_ASSOCIATED_TTYS; i++) { 377 for (i = 0; i < MAX_ASSOCIATED_TTYS; i++) {
378 struct ipw_tty *tty = network->associated_ttys[channel_idx][i]; 378 struct ipw_tty *tty = network->associated_ttys[channel_idx][i];
379 379
380 if (!tty)
381 continue;
382
380 /* 383 /*
381 * If it's associated with a tty (other than the RAS channel 384 * If it's associated with a tty (other than the RAS channel
382 * when we're online), then send the data to that tty. The RAS 385 * when we're online), then send the data to that tty. The RAS
383 * channel's data is handled above - it always goes through 386 * channel's data is handled above - it always goes through
384 * ppp_generic. 387 * ppp_generic.
385 */ 388 */
386 if (tty && channel_idx == IPW_CHANNEL_RAS 389 if (channel_idx == IPW_CHANNEL_RAS
387 && (network->ras_control_lines & 390 && (network->ras_control_lines &
388 IPW_CONTROL_LINE_DCD) != 0 391 IPW_CONTROL_LINE_DCD) != 0
389 && ipwireless_tty_is_modem(tty)) { 392 && ipwireless_tty_is_modem(tty)) {