summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJesper Juhl <jesper.juhl@gmail.com>2006-06-26 09:24:33 +0200
committerLinus Torvalds <torvalds@g5.osdl.org>2006-06-26 18:58:16 +0200
commit57136ca6d57359c7f21a9bbb4a5a0a61eeb53f2b (patch)
tree79c31abe40196cc1c350734a15d146d43fa3692c
parent[PATCH] Convert kernel/cpu.c to mutexes (diff)
downloadlinux-57136ca6d57359c7f21a9bbb4a5a0a61eeb53f2b.tar.xz
linux-57136ca6d57359c7f21a9bbb4a5a0a61eeb53f2b.zip
[PATCH] Bluetooth: fix potential NULL ptr deref in dtl1_cs.c::dtl1_hci_send_frame()
There's a problem in drivers/bluetooth/dtl1_cs.c::dtl1_hci_send_frame() If bt_skb_alloc() returns NULL, then skb_reserve(s, NSHL); will cause a NULL pointer deref - ouch. If we can't allocate the resources we require we need to tell the caller by returning -ENOMEM. Found by the coverity checker as bug #409 Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
-rw-r--r--drivers/bluetooth/dtl1_cs.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/bluetooth/dtl1_cs.c b/drivers/bluetooth/dtl1_cs.c
index a71a240611e0..ed8dca84ff69 100644
--- a/drivers/bluetooth/dtl1_cs.c
+++ b/drivers/bluetooth/dtl1_cs.c
@@ -423,6 +423,9 @@ static int dtl1_hci_send_frame(struct sk_buff *skb)
nsh.len = skb->len;
s = bt_skb_alloc(NSHL + skb->len + 1, GFP_ATOMIC);
+ if (!s)
+ return -ENOMEM;
+
skb_reserve(s, NSHL);
memcpy(skb_put(s, skb->len), skb->data, skb->len);
if (skb->len & 0x0001)