lkml.org 
[lkml]   [2006]   [May]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] Bluetooth: fix potential NULL ptr deref in dtl1_cs.c::dtl1_hci_send_frame()
Date
There's a problem in drivers/bluetooth/dtl1_cs.c::dtl1_hci_send_frame()

If bt_skb_alloc() returns NULL, then skb_reserve(s, NSHL); will cause a
NULL pointer deref - ouch.
If we can't allocate the resources we require we need to tell the caller
by returning -ENOMEM.

Found by the coverity checker as bug #409

Patch is compile tested, but that's all, due to lack of hardware.


Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
---

drivers/bluetooth/dtl1_cs.c | 3 +++
1 files changed, 3 insertions(+)

--- linux-2.6.17-rc3-git12-orig/drivers/bluetooth/dtl1_cs.c 2006-05-07 03:25:16.000000000 +0200
+++ linux-2.6.17-rc3-git12/drivers/bluetooth/dtl1_cs.c 2006-05-07 20:43:01.000000000 +0200
@@ -423,6 +423,9 @@ static int dtl1_hci_send_frame(struct sk
nsh.len = skb->len;

s = bt_skb_alloc(NSHL + skb->len + 1, GFP_ATOMIC);
+ if (!s)
+ return -ENOMEM;
+
skb_reserve(s, NSHL);
memcpy(skb_put(s, skb->len), skb->data, skb->len);
if (skb->len & 0x0001)

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2006-05-07 20:52    [W:0.230 / U:0.192 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site