Re: [PATCH] Bluetooth: Fix possible NULL pointer derefence in l2cap code

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Szymon,

* Szymon Janc <szymon.janc@xxxxxxxxx> [2011-05-11 15:14:58 +0200]:

> Signed-off-by: Szymon Janc <szymon.janc@xxxxxxxxx>
> ---
>  net/bluetooth/l2cap_core.c |    5 +++++
>  1 files changed, 5 insertions(+), 0 deletions(-)
> 
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index d0769a8..d9833d1 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -3292,6 +3292,11 @@ static void l2cap_send_srejframe(struct l2cap_chan *chan, u8 tx_seq)
>  		l2cap_send_sframe(chan, control);
>  
>  		new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
> +		if (!new) {
> +			BT_ERR("Memory allocation failed on tx_seq = %d",
> +							chan->expected_tx_seq);
> +			break;

I think a proper behavior here is disconnect the channel. The Enhanced
Retransmission mode is reliable and we have to guarantee that all data is
delivered. Skip adding to the list doesn't seem to be safe here. 

-- 
Gustavo F. Padovan
http://profusion.mobi
--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Bluez Devel]     [Linux Wireless Networking]     [Linux Wireless Personal Area Networking]     [Linux ATH6KL]     [Linux USB Devel]     [Linux Media Drivers]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Big List of Linux Books]

  Powered by Linux