提交 61b9a26a 编写于 作者: K Karsten Keil 提交者: Linus Torvalds

[PATCH] Fix NULL pointer dereference in isdn_tty_at_cout

The changes in the tty related code introduced wrong parenthesis in a if
condition in the isdn_tty_at_cout function.  This caused access to index -1
in the dev->drv[] array.  This patch change it back to the correct
condition from the previous versions.
Signed-off-by: NKarsten Keil <kkeil@suse.de>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
上级 8b09fb34
...@@ -2359,8 +2359,8 @@ isdn_tty_at_cout(char *msg, modem_info * info) ...@@ -2359,8 +2359,8 @@ isdn_tty_at_cout(char *msg, modem_info * info)
/* use queue instead of direct, if online and */ /* use queue instead of direct, if online and */
/* data is in queue or buffer is full */ /* data is in queue or buffer is full */
if ((info->online && tty_buffer_request_room(tty, l) < l) || if (info->online && ((tty_buffer_request_room(tty, l) < l) ||
(!skb_queue_empty(&dev->drv[info->isdn_driver]->rpqueue[info->isdn_channel]))) { !skb_queue_empty(&dev->drv[info->isdn_driver]->rpqueue[info->isdn_channel]))) {
skb = alloc_skb(l, GFP_ATOMIC); skb = alloc_skb(l, GFP_ATOMIC);
if (!skb) { if (!skb) {
spin_unlock_irqrestore(&info->readlock, flags); spin_unlock_irqrestore(&info->readlock, flags);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册