diff options
| author | André Goddard Rosa <andre.goddard@gmail.com> | 2009-10-25 11:16:32 -0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2009-12-11 15:18:04 -0800 |
| commit | 9e845abfc8a8973373821aa05302794fd254514b (patch) | |
| tree | 0dbd44e16a4fbe9554d25b4dcbc17fea7207a933 /drivers/serial | |
| parent | 2a0785ea375fe93cd480599bb40d0c837ff72a2e (diff) | |
| download | blackbird-op-linux-9e845abfc8a8973373821aa05302794fd254514b.tar.gz blackbird-op-linux-9e845abfc8a8973373821aa05302794fd254514b.zip | |
serial: fix NULL pointer dereference
If kzalloc() or alloc_tty_driver() fails, we call:
put_tty_driver(normal = NULL).
Then:
put_tty_driver -> tty_driver_kref_put -> kref_put(&NULL->kref, ...)
Signed-off-by: André Goddard Rosa <andre.goddard@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/serial')
| -rw-r--r-- | drivers/serial/serial_core.c | 21 |
1 files changed, 11 insertions, 10 deletions
diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c index dcc72444e8e7..885eabe552cd 100644 --- a/drivers/serial/serial_core.c +++ b/drivers/serial/serial_core.c @@ -2344,7 +2344,7 @@ static const struct tty_operations uart_ops = { */ int uart_register_driver(struct uart_driver *drv) { - struct tty_driver *normal = NULL; + struct tty_driver *normal; int i, retval; BUG_ON(drv->state); @@ -2354,13 +2354,12 @@ int uart_register_driver(struct uart_driver *drv) * we have a large number of ports to handle. */ drv->state = kzalloc(sizeof(struct uart_state) * drv->nr, GFP_KERNEL); - retval = -ENOMEM; if (!drv->state) goto out; - normal = alloc_tty_driver(drv->nr); + normal = alloc_tty_driver(drv->nr); if (!normal) - goto out; + goto out_kfree; drv->tty_driver = normal; @@ -2393,12 +2392,14 @@ int uart_register_driver(struct uart_driver *drv) } retval = tty_register_driver(normal); - out: - if (retval < 0) { - put_tty_driver(normal); - kfree(drv->state); - } - return retval; + if (retval >= 0) + return retval; + + put_tty_driver(normal); +out_kfree: + kfree(drv->state); +out: + return -ENOMEM; } /** |
