diff options
| author | Jesper Juhl <jesper.juhl@gmail.com> | 2007-10-16 01:27:51 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-10-16 09:43:10 -0700 |
| commit | b1b2e7cf4a9742f61d76fcb419b1fd13159876a5 (patch) | |
| tree | da6855dbf5d1216e53d7ab27b7a2b1cce6a36a1b /drivers | |
| parent | 4e3dfacaa0b8e469f412ae776f222102042d7e24 (diff) | |
| download | op-kernel-dev-b1b2e7cf4a9742f61d76fcb419b1fd13159876a5.zip op-kernel-dev-b1b2e7cf4a9742f61d76fcb419b1fd13159876a5.tar.gz | |
fix possible NULL deref on low memory condition in capidrv.c::send_message()
If we fail to allocate an skb in
drivers/isdn/capi/capidrv.c::send_message(), then we'll end up
dereferencing a NULL pointer.
Since out of memory conditions are not unheard of, I believe it
is better to print a error message and just return rather than
bring down the whole kernel.
Sure, doing this may upset some application, but that's still
better than crashing the whole system.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Acked-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/isdn/capi/capidrv.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/isdn/capi/capidrv.c b/drivers/isdn/capi/capidrv.c index 23b6f7b..476012b 100644 --- a/drivers/isdn/capi/capidrv.c +++ b/drivers/isdn/capi/capidrv.c @@ -506,9 +506,14 @@ static void send_message(capidrv_contr * card, _cmsg * cmsg) { struct sk_buff *skb; size_t len; + capi_cmsg2message(cmsg, cmsg->buf); len = CAPIMSG_LEN(cmsg->buf); skb = alloc_skb(len, GFP_ATOMIC); + if (!skb) { + printk(KERN_ERR "capidrv::send_message: can't allocate mem\n"); + return; + } memcpy(skb_put(skb, len), cmsg->buf, len); if (capi20_put_message(&global.ap, skb) != CAPI_NOERROR) kfree_skb(skb); |
