mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-04 01:49:36 +00:00
Code Issues Releases Wiki Activity

serial: fix NULL pointer dereference

Browse source 
If kzalloc() or alloc_tty_driver() fails, we call:
    put_tty_driver(normal = NULL).

Then:
    put_tty_driver -> tty_driver_kref_put -> kref_put(&NULL->kref, ...)

Signed-off-by: André Goddard Rosa <andre.goddard@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
André Goddard Rosa 2009-10-25 11:16:32 -02:00 committed by Greg Kroah-Hartman
parent 2a0785ea37
commit 9e845abfc8
1 changed files with 11 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
drivers/serial/serial_core.c
View file

@ -2344,7 +2344,7 @@ static const struct tty_operations uart_ops = {
*/
int uart_register_driver(struct uart_driver *drv)
{
struct tty_driver *normal = NULL;
struct tty_driver *normal;
int i, retval;
BUG_ON(drv->state);
@ -2354,13 +2354,12 @@ int uart_register_driver(struct uart_driver *drv)
* we have a large number of ports to handle.
*/
drv->state = kzalloc(sizeof(struct uart_state) * drv->nr, GFP_KERNEL);
retval = -ENOMEM;
if (!drv->state)
goto out;
normal = alloc_tty_driver(drv->nr);
normal = alloc_tty_driver(drv->nr);
if (!normal)
goto out;
goto out_kfree;
drv->tty_driver = normal;
@ -2393,12 +2392,14 @@ int uart_register_driver(struct uart_driver *drv)
}
retval = tty_register_driver(normal);
out:
if (retval < 0) {
put_tty_driver(normal);
kfree(drv->state);
}
return retval;
if (retval >= 0)
return retval;
put_tty_driver(normal);
out_kfree:
kfree(drv->state);
out:
return -ENOMEM;
}
/**