* [PATCH] Bluetooth: Fix possible NULL pointer derefence in l2cap code
@ 2011-05-11 13:14 Szymon Janc
2011-05-11 17:37 ` Gustavo F. Padovan
0 siblings, 1 reply; 2+ messages in thread
From: Szymon Janc @ 2011-05-11 13:14 UTC (permalink / raw)
To: linux-bluetooth; +Cc: par-gunnar.p.hjalmdahl, Szymon Janc
Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
---
net/bluetooth/l2cap_core.c | 5 +++++
1 files changed, 5 insertions(+), 0 deletions(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index d0769a8..d9833d1 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3292,6 +3292,11 @@ static void l2cap_send_srejframe(struct l2cap_chan *chan, u8 tx_seq)
l2cap_send_sframe(chan, control);
new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
+ if (!new) {
+ BT_ERR("Memory allocation failed on tx_seq = %d",
+ chan->expected_tx_seq);
+ break;
+ }
new->tx_seq = chan->expected_tx_seq;
chan->expected_tx_seq = (chan->expected_tx_seq + 1) % 64;
list_add_tail(&new->list, &chan->srej_l);
--
on behalf of ST-Ericsson
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] Bluetooth: Fix possible NULL pointer derefence in l2cap code
2011-05-11 13:14 [PATCH] Bluetooth: Fix possible NULL pointer derefence in l2cap code Szymon Janc
@ 2011-05-11 17:37 ` Gustavo F. Padovan
0 siblings, 0 replies; 2+ messages in thread
From: Gustavo F. Padovan @ 2011-05-11 17:37 UTC (permalink / raw)
To: Szymon Janc; +Cc: linux-bluetooth, par-gunnar.p.hjalmdahl
Hi Szymon,
* Szymon Janc <szymon.janc@tieto.com> [2011-05-11 15:14:58 +0200]:
> Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
> ---
> net/bluetooth/l2cap_core.c | 5 +++++
> 1 files changed, 5 insertions(+), 0 deletions(-)
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index d0769a8..d9833d1 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -3292,6 +3292,11 @@ static void l2cap_send_srejframe(struct l2cap_chan *chan, u8 tx_seq)
> l2cap_send_sframe(chan, control);
>
> new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
> + if (!new) {
> + BT_ERR("Memory allocation failed on tx_seq = %d",
> + chan->expected_tx_seq);
> + break;
I think a proper behavior here is disconnect the channel. The Enhanced
Retransmission mode is reliable and we have to guarantee that all data is
delivered. Skip adding to the list doesn't seem to be safe here.
--
Gustavo F. Padovan
http://profusion.mobi
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-05-11 17:37 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-05-11 13:14 [PATCH] Bluetooth: Fix possible NULL pointer derefence in l2cap code Szymon Janc
2011-05-11 17:37 ` Gustavo F. Padovan
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.