tty: serial: max3100: Fix error case

We don't want to free a random address if the entry is wrong, cover
this and WARN if it ever happens.

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/tty/serial/max3100.c b/drivers/tty/serial/max3100.c
index 46043c2521ce5de42cb182fdb1e342442553175c..0f24486be532a8e4c63cb441e7909983b4f7f2e1 100644 (file)
--- a/drivers/tty/serial/max3100.c
+++ b/drivers/tty/serial/max3100.c
@@ -827,14 +827,16 @@ static int __devexit max3100_remove(struct spi_device *spi)
 
        /* find out the index for the chip we are removing */
        for (i = 0; i < MAX_MAX3100; i++)
-               if (max3100s[i] == s)
+               if (max3100s[i] == s) {
+                       dev_dbg(&spi->dev, "%s: removing port %d\n", __func__, i);
+                       uart_remove_one_port(&max3100_uart_driver, &max3100s[i]->port);
+                       kfree(max3100s[i]);
+                       max3100s[i] = NULL;
                        break;
+               }
 
-       dev_dbg(&spi->dev, "%s: removing port %d\n", __func__, i);
-       uart_remove_one_port(&max3100_uart_driver, &max3100s[i]->port);
-       kfree(max3100s[i]);
-       max3100s[i] = NULL;
-
+       WARN_ON(i == MAX_MAX3100);
+       
        /* check if this is the last chip we have */
        for (i = 0; i < MAX_MAX3100; i++)
                if (max3100s[i]) {