* [PATCH] Bluetooth: Fix possible NULL pointer derefence in l2cap code
@ 2011-05-11 13:14 Szymon Janc
2011-05-11 17:37 ` Gustavo F. Padovan
0 siblings, 1 reply; 2+ messages in thread
From: Szymon Janc @ 2011-05-11 13:14 UTC (permalink / raw)
To: linux-bluetooth; +Cc: par-gunnar.p.hjalmdahl, Szymon Janc
Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
---
net/bluetooth/l2cap_core.c | 5 +++++
1 files changed, 5 insertions(+), 0 deletions(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index d0769a8..d9833d1 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3292,6 +3292,11 @@ static void l2cap_send_srejframe(struct l2cap_chan *chan, u8 tx_seq)
l2cap_send_sframe(chan, control);
new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
+ if (!new) {
+ BT_ERR("Memory allocation failed on tx_seq = %d",
+ chan->expected_tx_seq);
+ break;
+ }
new->tx_seq = chan->expected_tx_seq;
chan->expected_tx_seq = (chan->expected_tx_seq + 1) % 64;
list_add_tail(&new->list, &chan->srej_l);
--
on behalf of ST-Ericsson
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] Bluetooth: Fix possible NULL pointer derefence in l2cap code
2011-05-11 13:14 [PATCH] Bluetooth: Fix possible NULL pointer derefence in l2cap code Szymon Janc
@ 2011-05-11 17:37 ` Gustavo F. Padovan
0 siblings, 0 replies; 2+ messages in thread
From: Gustavo F. Padovan @ 2011-05-11 17:37 UTC (permalink / raw)
To: Szymon Janc; +Cc: linux-bluetooth, par-gunnar.p.hjalmdahl
Hi Szymon,
* Szymon Janc <szymon.janc@tieto.com> [2011-05-11 15:14:58 +0200]:
> Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
> ---
> net/bluetooth/l2cap_core.c | 5 +++++
> 1 files changed, 5 insertions(+), 0 deletions(-)
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index d0769a8..d9833d1 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -3292,6 +3292,11 @@ static void l2cap_send_srejframe(struct l2cap_chan *chan, u8 tx_seq)
> l2cap_send_sframe(chan, control);
>
> new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
> + if (!new) {
> + BT_ERR("Memory allocation failed on tx_seq = %d",
> + chan->expected_tx_seq);
> + break;
I think a proper behavior here is disconnect the channel. The Enhanced
Retransmission mode is reliable and we have to guarantee that all data is
delivered. Skip adding to the list doesn't seem to be safe here.
--
Gustavo F. Padovan
http://profusion.mobi
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-05-11 17:37 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-05-11 13:14 [PATCH] Bluetooth: Fix possible NULL pointer derefence in l2cap code Szymon Janc
2011-05-11 17:37 ` Gustavo F. Padovan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).