Commit d92c7f8a authored Aug 17, 2012 by Jesper Juhl Committed by David S. Miller Aug 20, 2012

caif: Do not dereference NULL in chnl_recv_cb()



In net/caif/chnl_net.c::chnl_recv_cb() we call skb_header_pointer()
which may return NULL, but we do not check for a NULL pointer before
dereferencing it.
This patch adds such a NULL check and properly free's allocated memory
and return an error (-EINVAL) on failure - much better than crashing..

Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Acked-by: Sjur Brændeland <sjur.brandeland@stericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 6c71bec6

net/caif/chnl_net.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -94,6 +94,10 @@ static int chnl_recv_cb(struct cflayer layr, struct cfpkt pkt)

		/* check the version of IP */
		ip_version = skb_header_pointer(skb, 0, 1, &buf);
		if (!ip_version) {
		kfree_skb(skb);
		return -EINVAL;
		}

		switch (*ip_version >> 4) {
		case 4: