From 41fda9c4d9437846f4ca667e134c6d840f67b9c2 Mon Sep 17 00:00:00 2001 From: Alan Cox Date: Mon, 17 Sep 2012 12:00:44 +0100 Subject: tty: serial: max3100: Fix error case We don't want to free a random address if the entry is wrong, cover this and WARN if it ever happens. Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman --- drivers/tty/serial/max3100.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) (limited to 'drivers/tty/serial/max3100.c') diff --git a/drivers/tty/serial/max3100.c b/drivers/tty/serial/max3100.c index 46043c2521ce..0f24486be532 100644 --- a/drivers/tty/serial/max3100.c +++ b/drivers/tty/serial/max3100.c @@ -827,14 +827,16 @@ static int __devexit max3100_remove(struct spi_device *spi) /* find out the index for the chip we are removing */ for (i = 0; i < MAX_MAX3100; i++) - if (max3100s[i] == s) + if (max3100s[i] == s) { + dev_dbg(&spi->dev, "%s: removing port %d\n", __func__, i); + uart_remove_one_port(&max3100_uart_driver, &max3100s[i]->port); + kfree(max3100s[i]); + max3100s[i] = NULL; break; + } - dev_dbg(&spi->dev, "%s: removing port %d\n", __func__, i); - uart_remove_one_port(&max3100_uart_driver, &max3100s[i]->port); - kfree(max3100s[i]); - max3100s[i] = NULL; - + WARN_ON(i == MAX_MAX3100); + /* check if this is the last chip we have */ for (i = 0; i < MAX_MAX3100; i++) if (max3100s[i]) { -- cgit v1.2.3-59-g8ed1b