Commit 57136ca6 authored by Jesper Juhl's avatar Jesper Juhl Committed by Linus Torvalds

[PATCH] Bluetooth: fix potential NULL ptr deref in dtl1_cs.c::dtl1_hci_send_frame()

There's a problem in drivers/bluetooth/dtl1_cs.c::dtl1_hci_send_frame()

If bt_skb_alloc() returns NULL, then skb_reserve(s, NSHL); will cause a
NULL pointer deref - ouch.  If we can't allocate the resources we require
we need to tell the caller by returning -ENOMEM.

Found by the coverity checker as bug #409
Signed-off-by: default avatarJesper Juhl <>
Acked-by: default avatarMarcel Holtmann <>
Signed-off-by: default avatarAndrew Morton <>
Signed-off-by: default avatarLinus Torvalds <>
parent 81615b62
......@@ -423,6 +423,9 @@ static int dtl1_hci_send_frame(struct sk_buff *skb)
nsh.len = skb->len;
s = bt_skb_alloc(NSHL + skb->len + 1, GFP_ATOMIC);
if (!s)
return -ENOMEM;
skb_reserve(s, NSHL);
memcpy(skb_put(s, skb->len), skb->data, skb->len);
if (skb->len & 0x0001)
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment