summaryrefslogtreecommitdiff
path: root/net/caif
diff options
context:
space:
mode:
authorJesper Juhl <jj@chaosbits.net>2012-08-17 14:33:12 +0400
committerDavid S. Miller <davem@davemloft.net>2012-08-20 13:47:49 +0400
commitd92c7f8aabae913de16eb855b19cd2002c341896 (patch)
treedea18b0f4fb3e83a6ed87a8a1e23eb0cbb17aa0e /net/caif
parent6c71bec66ae65305ba5c33c93aa722f21f092737 (diff)
downloadlinux-d92c7f8aabae913de16eb855b19cd2002c341896.tar.xz
caif: Do not dereference NULL in chnl_recv_cb()
In net/caif/chnl_net.c::chnl_recv_cb() we call skb_header_pointer() which may return NULL, but we do not check for a NULL pointer before dereferencing it. This patch adds such a NULL check and properly free's allocated memory and return an error (-EINVAL) on failure - much better than crashing.. Signed-off-by: Jesper Juhl <jj@chaosbits.net> Acked-by: Sjur Brændeland <sjur.brandeland@stericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/caif')
-rw-r--r--net/caif/chnl_net.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
index 69771c04ba8f..e597733affb8 100644
--- a/net/caif/chnl_net.c
+++ b/net/caif/chnl_net.c
@@ -94,6 +94,10 @@ static int chnl_recv_cb(struct cflayer *layr, struct cfpkt *pkt)
/* check the version of IP */
ip_version = skb_header_pointer(skb, 0, 1, &buf);
+ if (!ip_version) {
+ kfree_skb(skb);
+ return -EINVAL;
+ }
switch (*ip_version >> 4) {
case 4: