Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 61b9a26a authored by Karsten Keil's avatar Karsten Keil Committed by Linus Torvalds
Browse files

[PATCH] Fix NULL pointer dereference in isdn_tty_at_cout 



The changes in the tty related code introduced wrong parenthesis in a if
condition in the isdn_tty_at_cout function.  This caused access to index -1
in the dev->drv[] array.  This patch change it back to the correct
condition from the previous versions.

Signed-off-by: default avatarKarsten Keil <kkeil@suse.de>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 8b09fb34

drivers/isdn/i4l/isdn_tty.c

+2 −2
Original line number Diff line number Diff line
@@ -2359,8 +2359,8 @@ isdn_tty_at_cout(char *msg, modem_info * info) 


	/* use queue instead of direct, if online and */

	/* data is in queue or buffer is full */

	if ((info->online && tty_buffer_request_room(tty, l) < l) ||

	    (!skb_queue_empty(&dev->drv[info->isdn_driver]->rpqueue[info->isdn_channel]))) {

	if (info->online && ((tty_buffer_request_room(tty, l) < l) ||

	    !skb_queue_empty(&dev->drv[info->isdn_driver]->rpqueue[info->isdn_channel]))) {

		skb = alloc_skb(l, GFP_ATOMIC);

		if (!skb) {

			spin_unlock_irqrestore(&info->readlock, flags);