Messages in this thread Patch in this message | | | From | Jesper Juhl <> | Subject | [PATCH] Bluetooth: fix potential NULL ptr deref in dtl1_cs.c::dtl1_hci_send_frame() | Date | Sun, 7 May 2006 20:50:57 +0200 |
| |
There's a problem in drivers/bluetooth/dtl1_cs.c::dtl1_hci_send_frame()
If bt_skb_alloc() returns NULL, then skb_reserve(s, NSHL); will cause a NULL pointer deref - ouch. If we can't allocate the resources we require we need to tell the caller by returning -ENOMEM.
Found by the coverity checker as bug #409
Patch is compile tested, but that's all, due to lack of hardware.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com> ---
drivers/bluetooth/dtl1_cs.c | 3 +++ 1 files changed, 3 insertions(+)
--- linux-2.6.17-rc3-git12-orig/drivers/bluetooth/dtl1_cs.c 2006-05-07 03:25:16.000000000 +0200 +++ linux-2.6.17-rc3-git12/drivers/bluetooth/dtl1_cs.c 2006-05-07 20:43:01.000000000 +0200 @@ -423,6 +423,9 @@ static int dtl1_hci_send_frame(struct sk nsh.len = skb->len; s = bt_skb_alloc(NSHL + skb->len + 1, GFP_ATOMIC); + if (!s) + return -ENOMEM; + skb_reserve(s, NSHL); memcpy(skb_put(s, skb->len), skb->data, skb->len); if (skb->len & 0x0001)
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |