Re: [PATCH] potential NULL deref in serial/core.c

[Ben Collins]

On Wed, Oct 23, 2002 at 03:02:11PM -0400, Ben Collins wrote:
> Not sure if it's supposed to be a BUG() for tty to be NULL, but it's
> surely a bug to dereference it before checking for that.
> 

Ug. Find one more after I sent this email.

--- drivers/serial/core.c~	2002-10-23 14:59:17.000000000 -0400
+++ drivers/serial/core.c	2002-10-23 15:07:55.000000000 -0400
@@ -472,10 +472,12 @@
 
 static void uart_put_char(struct tty_struct *tty, unsigned char ch)
 {
-	struct uart_info *info = tty->driver_data;
+	struct uart_info *info;
 
-	if (tty)
+	if (tty) {
+		info = tty->driver_data;
 		__uart_put_char(info->port, &info->xmit, ch);
+	}
 }
 
 static void uart_flush_chars(struct tty_struct *tty)
@@ -487,10 +489,15 @@
 uart_write(struct tty_struct *tty, int from_user, const unsigned char * buf,
 	   int count)
 {
-	struct uart_info *info = tty->driver_data;
+	struct uart_info *info;
 	int ret;
 
-	if (!tty || !info->xmit.buf)
+	if (!tty)
+		return 0;
+
+	info = tty->driver_data;
+
+	if (!info->xmit.buf)
 		return 0;
 
 	if (from_user)

-- 
Debian     - http://www.debian.org/
Linux 1394 - http://www.linux1394.org/
Subversion - http://subversion.tigris.org/
Deqo       - http://www.deqo.com/