summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAlan Cox <alan@linux.intel.com>2009-06-11 13:46:41 +0200
committerLinus Torvalds <torvalds@linux-foundation.org>2009-06-11 17:51:01 +0200
commit5f0878acba7db24323f5ba4055ec9a96895bb150 (patch)
tree4e92e6a29ea537b62276d0902b499c3ee6779dd8
parentpty: Fix a comment (diff)
downloadlinux-5f0878acba7db24323f5ba4055ec9a96895bb150.tar.xz
linux-5f0878acba7db24323f5ba4055ec9a96895bb150.zip
tty: Fix oops when scanning the polling list for kgdb
Costantino Leandro found a bug in tty_find_polling_driver and provided a patch that fixed the crash but not the underlying bug. This fixes the underlying bug where the list walk corrupts the values it is using on a match but then reuses them if the open fails. Signed-off-by: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--drivers/char/tty_io.c13
1 files changed, 7 insertions, 6 deletions
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 66b99a2049e3..6c817398232e 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -295,7 +295,7 @@ struct tty_driver *tty_find_polling_driver(char *name, int *line)
struct tty_driver *p, *res = NULL;
int tty_line = 0;
int len;
- char *str;
+ char *str, *stp;
for (str = name; *str; str++)
if ((*str >= '0' && *str <= '9') || *str == ',')
@@ -311,13 +311,14 @@ struct tty_driver *tty_find_polling_driver(char *name, int *line)
list_for_each_entry(p, &tty_drivers, tty_drivers) {
if (strncmp(name, p->name, len) != 0)
continue;
- if (*str == ',')
- str++;
- if (*str == '\0')
- str = NULL;
+ stp = str;
+ if (*stp == ',')
+ stp++;
+ if (*stp == '\0')
+ stp = NULL;
if (tty_line >= 0 && tty_line <= p->num && p->ops &&
- p->ops->poll_init && !p->ops->poll_init(p, tty_line, str)) {
+ p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
res = tty_driver_kref_get(p);
*line = tty_line;
break;