diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2010-12-20 21:34:16 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2010-12-20 21:34:16 -0800 |
| commit | e5fcdb7ed856b714c878ad470040fe832cbe462b (patch) | |
| tree | 9a4105597bbc8ad3cc2fb8e8adca87678977a62e | |
| parent | 7bddaaca472a08bb8a80b653855a1e921b440578 (diff) | |
| parent | 093d804611b9a38fe59753b37c29f840518406a9 (diff) | |
| download | linux-e5fcdb7ed856b714c878ad470040fe832cbe462b.tar.bz2 | |
Merge branch 'tty-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6
* 'tty-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6:
n_gsm: gsm_data_alloc buffer allocation could fail and it is not being checked
n_gsm: Fix message length handling when building header
| -rw-r--r-- | drivers/tty/n_gsm.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 81b46585edf7..c5f8e5bda2b2 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -716,8 +716,8 @@ static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg) if (msg->len < 128) *--dp = (msg->len << 1) | EA; else { - *--dp = ((msg->len & 127) << 1) | EA; - *--dp = (msg->len >> 6) & 0xfe; + *--dp = (msg->len >> 7); /* bits 7 - 15 */ + *--dp = (msg->len & 127) << 1; /* bits 0 - 6 */ } } @@ -968,6 +968,8 @@ static void gsm_control_reply(struct gsm_mux *gsm, int cmd, u8 *data, { struct gsm_msg *msg; msg = gsm_data_alloc(gsm, 0, dlen + 2, gsm->ftype); + if (msg == NULL) + return; msg->data[0] = (cmd & 0xFE) << 1 | EA; /* Clear C/R */ msg->data[1] = (dlen << 1) | EA; memcpy(msg->data + 2, data, dlen); |