Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752820AbcLIWav (ORCPT ); Fri, 9 Dec 2016 17:30:51 -0500 Received: from mail.ispras.ru ([83.149.199.45]:47634 "EHLO mail.ispras.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751827AbcLIWat (ORCPT ); Fri, 9 Dec 2016 17:30:49 -0500 From: Alexey Khoroshilov To: Greg Kroah-Hartman , Jiri Slaby Cc: Alexey Khoroshilov , linux-serial@vger.kernel.org, linux-kernel@vger.kernel.org, ldv-project@linuxtesting.org Subject: [PATCH] tty: serial: fsl_lpuart: potential NULL dereference Date: Sat, 10 Dec 2016 01:30:36 +0300 Message-Id: <1481322636-30847-1-git-send-email-khoroshilov@ispras.ru> X-Mailer: git-send-email 2.7.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1227 Lines: 37 tty_port_tty_get() might return a tty which is NULL if the port is not associated with a tty (e.g. due to close or hangup). But lpuart_start_rx_dma() dereferences tty without any check. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov --- drivers/tty/serial/fsl_lpuart.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c index 76103f2c4a80..9945b37c914a 100644 --- a/drivers/tty/serial/fsl_lpuart.c +++ b/drivers/tty/serial/fsl_lpuart.c @@ -833,9 +833,16 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport) struct circ_buf *ring = &sport->rx_ring; int ret, nent; int bits, baud; - struct tty_struct *tty = tty_port_tty_get(&sport->port.state->port); - struct ktermios *termios = &tty->termios; + struct tty_struct *tty; + struct ktermios *termios; + tty = tty_port_tty_get(&sport->port.state->port); + if (!tty) { + dev_err(sport->port.dev, "Port is not associated with a tty\n"); + return -ENODEV; + } + + termios = &tty->termios; baud = tty_get_baud_rate(tty); bits = (termios->c_cflag & CSIZE) == CS7 ? 9 : 10; -- 2.7.4