From: Karsten Keil The changes in the tty related code introduced wrong parenthesis in a if condition in the isdn_tty_at_cout function. This caused access to index -1 in the dev->drv[] array. This patch change it back to the correct condition from the previous versions. Signed-off-by: Karsten Keil Signed-off-by: Andrew Morton --- drivers/isdn/i4l/isdn_tty.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff -puN drivers/isdn/i4l/isdn_tty.c~fix-null-pointer-dereference-in-isdn_tty_at_cout drivers/isdn/i4l/isdn_tty.c --- devel/drivers/isdn/i4l/isdn_tty.c~fix-null-pointer-dereference-in-isdn_tty_at_cout 2006-02-13 16:09:27.000000000 -0800 +++ devel-akpm/drivers/isdn/i4l/isdn_tty.c 2006-02-13 16:09:27.000000000 -0800 @@ -2359,8 +2359,8 @@ isdn_tty_at_cout(char *msg, modem_info * /* use queue instead of direct, if online and */ /* data is in queue or buffer is full */ - if ((info->online && tty_buffer_request_room(tty, l) < l) || - (!skb_queue_empty(&dev->drv[info->isdn_driver]->rpqueue[info->isdn_channel]))) { + if (info->online && ((tty_buffer_request_room(tty, l) < l) || + !skb_queue_empty(&dev->drv[info->isdn_driver]->rpqueue[info->isdn_channel]))) { skb = alloc_skb(l, GFP_ATOMIC); if (!skb) { spin_unlock_irqrestore(&info->readlock, flags); _