Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b1b2e7cf authored by Jesper Juhl's avatar Jesper Juhl Committed by Linus Torvalds
Browse files

fix possible NULL deref on low memory condition in capidrv.c::send_message() 



If we fail to allocate an skb in
drivers/isdn/capi/capidrv.c::send_message(), then we'll end up
dereferencing a NULL pointer.
Since out of memory conditions are not unheard of, I believe it
is better to print a error message and just return rather than
bring down the whole kernel.
Sure, doing this may upset some application, but that's still
better than crashing the whole system.

Signed-off-by: default avatarJesper Juhl <jesper.juhl@gmail.com>
Acked-by: default avatarKarsten Keil <kkeil@suse.de>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 4e3dfaca

drivers/isdn/capi/capidrv.c

+5 −0
Original line number Diff line number Diff line
@@ -506,9 +506,14 @@ static void send_message(capidrv_contr * card, _cmsg * cmsg) 
{

	struct sk_buff *skb;

	size_t len;



	capi_cmsg2message(cmsg, cmsg->buf);

	len = CAPIMSG_LEN(cmsg->buf);

	skb = alloc_skb(len, GFP_ATOMIC);

	if (!skb) {

		printk(KERN_ERR "capidrv::send_message: can't allocate mem\n");

		return;

	}

	memcpy(skb_put(skb, len), cmsg->buf, len);

	if (capi20_put_message(&global.ap, skb) != CAPI_NOERROR)

		kfree_skb(skb);