From: David Sterba <dsterba@suse.cz>
Date: Tue, 4 Mar 2008 22:28:50 +0000 (-0800)
Subject: ipwireless: fix potential tty == NULL dereference
X-Git-Tag: v2.6.25-rc4~58
X-Git-Url: http://pilppa.com/gitweb/?a=commitdiff_plain;h=a51f4124e6d69afdfae34a2ff2e580e7bf224ad2;p=linux-2.6-omap-h63xx.git

ipwireless: fix potential tty == NULL dereference

The Coverity checker spotted the following inconsequent NULL checking in
drivers/char/pcmcia/ipwireless/network.c:ipwireless_network_packet_received()

if (tty && channel_idx == IPW_CHANNEL_RAS
		&& (network->ras_control_lines &
			IPW_CONTROL_LINE_DCD) != 0
		&& ipwireless_tty_is_modem(tty)) {
...
	else
		ipwireless_tty_received(tty, data, length);

Cc: Adrian Bunk <bunk@kernel.org>
Signed-off-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Cc: "John W. Linville" <linville@tuxdriver.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---

diff --git a/drivers/char/pcmcia/ipwireless/network.c b/drivers/char/pcmcia/ipwireless/network.c
index ff35230058d..d793e68b3e0 100644
--- a/drivers/char/pcmcia/ipwireless/network.c
+++ b/drivers/char/pcmcia/ipwireless/network.c
@@ -377,13 +377,16 @@ void ipwireless_network_packet_received(struct ipw_network *network,
 	for (i = 0; i < MAX_ASSOCIATED_TTYS; i++) {
 		struct ipw_tty *tty = network->associated_ttys[channel_idx][i];
 
+		if (!tty)
+			continue;
+
 		/*
 		 * If it's associated with a tty (other than the RAS channel
 		 * when we're online), then send the data to that tty.  The RAS
 		 * channel's data is handled above - it always goes through
 		 * ppp_generic.
 		 */
-		if (tty && channel_idx == IPW_CHANNEL_RAS
+		if (channel_idx == IPW_CHANNEL_RAS
 				&& (network->ras_control_lines &
 					IPW_CONTROL_LINE_DCD) != 0
 				&& ipwireless_tty_is_modem(tty)) {