ipwireless: fix potential tty == NULL dereference
authorDavid Sterba <dsterba@suse.cz>
Tue, 4 Mar 2008 22:28:50 +0000 (14:28 -0800)
committerLinus Torvalds <torvalds@woody.linux-foundation.org>
Wed, 5 Mar 2008 00:35:13 +0000 (16:35 -0800)
The Coverity checker spotted the following inconsequent NULL checking in
drivers/char/pcmcia/ipwireless/network.c:ipwireless_network_packet_received()

if (tty && channel_idx == IPW_CHANNEL_RAS
&& (network->ras_control_lines &
IPW_CONTROL_LINE_DCD) != 0
&& ipwireless_tty_is_modem(tty)) {
...
else
ipwireless_tty_received(tty, data, length);

Cc: Adrian Bunk <bunk@kernel.org>
Signed-off-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Cc: "John W. Linville" <linville@tuxdriver.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
drivers/char/pcmcia/ipwireless/network.c

index ff35230..d793e68 100644 (file)
@@ -377,13 +377,16 @@ void ipwireless_network_packet_received(struct ipw_network *network,
        for (i = 0; i < MAX_ASSOCIATED_TTYS; i++) {
                struct ipw_tty *tty = network->associated_ttys[channel_idx][i];
 
+               if (!tty)
+                       continue;
+
                /*
                 * If it's associated with a tty (other than the RAS channel
                 * when we're online), then send the data to that tty.  The RAS
                 * channel's data is handled above - it always goes through
                 * ppp_generic.
                 */
-               if (tty && channel_idx == IPW_CHANNEL_RAS
+               if (channel_idx == IPW_CHANNEL_RAS
                                && (network->ras_control_lines &
                                        IPW_CONTROL_LINE_DCD) != 0
                                && ipwireless_tty_is_modem(tty)) {