diff options
| author | Jesper Juhl <jesper.juhl@gmail.com> | 2006-06-26 00:24:33 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2006-06-26 09:58:16 -0700 |
| commit | 57136ca6d57359c7f21a9bbb4a5a0a61eeb53f2b (patch) | |
| tree | 79c31abe40196cc1c350734a15d146d43fa3692c /drivers/bluetooth | |
| parent | 81615b624a45621b758380ec45d750483eae281d (diff) | |
| download | kernel_samsung_tuna-57136ca6d57359c7f21a9bbb4a5a0a61eeb53f2b.zip kernel_samsung_tuna-57136ca6d57359c7f21a9bbb4a5a0a61eeb53f2b.tar.gz kernel_samsung_tuna-57136ca6d57359c7f21a9bbb4a5a0a61eeb53f2b.tar.bz2 | |
[PATCH] Bluetooth: fix potential NULL ptr deref in dtl1_cs.c::dtl1_hci_send_frame()
There's a problem in drivers/bluetooth/dtl1_cs.c::dtl1_hci_send_frame()
If bt_skb_alloc() returns NULL, then skb_reserve(s, NSHL); will cause a
NULL pointer deref - ouch. If we can't allocate the resources we require
we need to tell the caller by returning -ENOMEM.
Found by the coverity checker as bug #409
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/bluetooth')
| -rw-r--r-- | drivers/bluetooth/dtl1_cs.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/bluetooth/dtl1_cs.c b/drivers/bluetooth/dtl1_cs.c index a71a240..ed8dca8 100644 --- a/drivers/bluetooth/dtl1_cs.c +++ b/drivers/bluetooth/dtl1_cs.c @@ -423,6 +423,9 @@ static int dtl1_hci_send_frame(struct sk_buff *skb) nsh.len = skb->len; s = bt_skb_alloc(NSHL + skb->len + 1, GFP_ATOMIC); + if (!s) + return -ENOMEM; + skb_reserve(s, NSHL); memcpy(skb_put(s, skb->len), skb->data, skb->len); if (skb->len & 0x0001) |