Merge branch 'tty-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6

e5fcdb7e · Linus Torvalds <[email protected]> · 2010-12-20 21:34:16 -08:00

* 'tty-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6:
  n_gsm: gsm_data_alloc buffer allocation could fail and it is not being checked
  n_gsm: Fix message length handling when building header

Commit: e5fcdb7ed856b714c878ad470040fe832cbe462b
Parents: 7bddaaca · 093d8046

Merge commit. Changes below are compared with the first parent: 7bddaaca.

Changes

1 files changed · +4 −2

File	Status	Add	Del	Content
drivers/tty/n_gsm.c	modified	+4	−2	View file

drivers/tty/n_gsm.c

View file

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 81b4658..c5f8e5b 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -716,8 +716,8 @@ static void __gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg)
 		if (msg->len < 128)
 			*--dp = (msg->len << 1) | EA;
 		else {
-			*--dp = ((msg->len & 127) << 1) | EA;
-			*--dp = (msg->len >> 6) & 0xfe;
+			*--dp = (msg->len >> 7);	/* bits 7 - 15 */
+			*--dp = (msg->len & 127) << 1;	/* bits 0 - 6 */
 		}
 	}
 
@@ -968,6 +968,8 @@ static void gsm_control_reply(struct gsm_mux *gsm, int cmd, u8 *data,
 {
 	struct gsm_msg *msg;
 	msg = gsm_data_alloc(gsm, 0, dlen + 2, gsm->ftype);
+	if (msg == NULL)
+		return;
 	msg->data[0] = (cmd & 0xFE) << 1 | EA;	/* Clear C/R */
 	msg->data[1] = (dlen << 1) | EA;
 	memcpy(msg->data + 2, data, dlen);