The patch titled
Bluetooth: fix potential NULL ptr deref in dtl1_cs.c::dtl1_hci_send_frame()
has been removed from the -mm tree. Its filename is
bluetooth-fix-potential-null-ptr-deref-in-dtl1_cscdtl1_hci_send_frame.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
Subject: Bluetooth: fix potential NULL ptr deref in dtl1_cs.c::dtl1_hci_send_frame()
From: Jesper Juhl <jesper.juhl@xxxxxxxxx>
There's a problem in drivers/bluetooth/dtl1_cs.c::dtl1_hci_send_frame()
If bt_skb_alloc() returns NULL, then skb_reserve(s, NSHL); will cause a
NULL pointer deref - ouch. If we can't allocate the resources we require
we need to tell the caller by returning -ENOMEM.
Found by the coverity checker as bug #409
Signed-off-by: Jesper Juhl <jesper.juhl@xxxxxxxxx>
Acked-by: Marcel Holtmann <marcel@xxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
drivers/bluetooth/dtl1_cs.c | 3 +++
1 file changed, 3 insertions(+)
diff -puN drivers/bluetooth/dtl1_cs.c~bluetooth-fix-potential-null-ptr-deref-in-dtl1_cscdtl1_hci_send_frame drivers/bluetooth/dtl1_cs.c
--- a/drivers/bluetooth/dtl1_cs.c~bluetooth-fix-potential-null-ptr-deref-in-dtl1_cscdtl1_hci_send_frame
+++ a/drivers/bluetooth/dtl1_cs.c
@@ -423,6 +423,9 @@ static int dtl1_hci_send_frame(struct sk
nsh.len = skb->len;
s = bt_skb_alloc(NSHL + skb->len + 1, GFP_ATOMIC);
+ if (!s)
+ return -ENOMEM;
+
skb_reserve(s, NSHL);
memcpy(skb_put(s, skb->len), skb->data, skb->len);
if (skb->len & 0x0001)
_
Patches currently in -mm which might be from jesper.juhl@xxxxxxxxx are
origin.patch
git-scsi-misc.patch
small-whitespace-cleanup-for-qlogic-driver.patch
remove-redundant-null-checks-before-free-in-fs.patch
remove-redundant-null-checks-before-free-in-kernel.patch
remove-redundant-null-checks-before-free-in-drivers.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
