The patch titled
Bluetooth: fix potential NULL ptr deref in dtl1_cs.c::dtl1_hci_send_frame()
has been added to the -mm tree. Its filename is
bluetooth-fix-potential-null-ptr-deref-in-dtl1_cscdtl1_hci_send_frame.patch
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
From: Jesper Juhl <jesper.juhl@xxxxxxxxx>
There's a problem in drivers/bluetooth/dtl1_cs.c::dtl1_hci_send_frame()
If bt_skb_alloc() returns NULL, then skb_reserve(s, NSHL); will cause a
NULL pointer deref - ouch. If we can't allocate the resources we require
we need to tell the caller by returning -ENOMEM.
Found by the coverity checker as bug #409
Signed-off-by: Jesper Juhl <jesper.juhl@xxxxxxxxx>
Acked-by: Marcel Holtmann <marcel@xxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
drivers/bluetooth/dtl1_cs.c | 3 +++
1 files changed, 3 insertions(+)
diff -puN drivers/bluetooth/dtl1_cs.c~bluetooth-fix-potential-null-ptr-deref-in-dtl1_cscdtl1_hci_send_frame drivers/bluetooth/dtl1_cs.c
--- devel/drivers/bluetooth/dtl1_cs.c~bluetooth-fix-potential-null-ptr-deref-in-dtl1_cscdtl1_hci_send_frame 2006-05-10 22:57:22.000000000 -0700
+++ devel-akpm/drivers/bluetooth/dtl1_cs.c 2006-05-10 22:57:22.000000000 -0700
@@ -423,6 +423,9 @@ static int dtl1_hci_send_frame(struct sk
nsh.len = skb->len;
s = bt_skb_alloc(NSHL + skb->len + 1, GFP_ATOMIC);
+ if (!s)
+ return -ENOMEM;
+
skb_reserve(s, NSHL);
memcpy(skb_put(s, skb->len), skb->data, skb->len);
if (skb->len & 0x0001)
_
Patches currently in -mm which might be from jesper.juhl@xxxxxxxxx are
origin.patch
fix-mem-leak-in-sidewinder-driver.patch
git-mtd.patch
fix-mem-leak-in-netfilter.patch
git-scsi-rc-fixes.patch
small-whitespace-cleanup-for-qlogic-driver.patch
reduce-nr-of-ptr-derefs-in-fs-jffs2-summaryc.patch
oss-cs46xx-cleanup-and-tiny-bugfix.patch
i4l-memory-leak-fix-for-sc_ioctl.patch
isdn-unsafe-interaction-between-isdn_write-and-isdn_writebuf_stub.patch
binfmt_elf-codingstyle-cleanup-and-remove-some-pointless-casts.patch
binfnt_elf-remove-more-casts.patch
ensure-null-deref-cant-possibly-happen-in-is_exported.patch
bluetooth-fix-potential-null-ptr-deref-in-dtl1_cscdtl1_hci_send_frame.patch
debug-shared-irqs.patch
remove-redundant-null-checks-before-free-in-fs.patch
remove-redundant-null-checks-before-free-in-kernel.patch
remove-redundant-null-checks-before-free-in-drivers.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
