From: Jesper Juhl Date: Mon, 26 Jun 2006 07:24:33 +0000 (-0700) Subject: [PATCH] Bluetooth: fix potential NULL ptr deref in dtl1_cs.c::dtl1_hci_send_frame() X-Git-Tag: v2.6.18-rc1~826 X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=57136ca6d57359c7f21a9bbb4a5a0a61eeb53f2b;p=linux-2.6 [PATCH] Bluetooth: fix potential NULL ptr deref in dtl1_cs.c::dtl1_hci_send_frame() There's a problem in drivers/bluetooth/dtl1_cs.c::dtl1_hci_send_frame() If bt_skb_alloc() returns NULL, then skb_reserve(s, NSHL); will cause a NULL pointer deref - ouch. If we can't allocate the resources we require we need to tell the caller by returning -ENOMEM. Found by the coverity checker as bug #409 Signed-off-by: Jesper Juhl Acked-by: Marcel Holtmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- diff --git a/drivers/bluetooth/dtl1_cs.c b/drivers/bluetooth/dtl1_cs.c index a71a240611..ed8dca84ff 100644 --- a/drivers/bluetooth/dtl1_cs.c +++ b/drivers/bluetooth/dtl1_cs.c @@ -423,6 +423,9 @@ static int dtl1_hci_send_frame(struct sk_buff *skb) nsh.len = skb->len; s = bt_skb_alloc(NSHL + skb->len + 1, GFP_ATOMIC); + if (!s) + return -ENOMEM; + skb_reserve(s, NSHL); memcpy(skb_put(s, skb->len), skb->data, skb->len); if (skb->len & 0x0001)