Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752020Ab1BCU2z (ORCPT ); Thu, 3 Feb 2011 15:28:55 -0500 Received: from swampdragon.chaosbits.net ([90.184.90.115]:11076 "EHLO swampdragon.chaosbits.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751831Ab1BCU2y (ORCPT ); Thu, 3 Feb 2011 15:28:54 -0500 Date: Thu, 3 Feb 2011 21:27:56 +0100 (CET) From: Jesper Juhl To: linux-kernel@vger.kernel.org cc: netdev@vger.kernel.org, Tejun Heo , Karsten Keil Subject: potential null pointer dereference in drivers/isdn/hisax/isdnl2.c Message-ID: User-Agent: Alpine 2.00 (LNX 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 880 Lines: 27 Hi, In drivers/isdn/hisax/isdnl2.c:l2_pull_iqueue() we have this: ... skb = alloc_skb(oskb->len + i, GFP_ATOMIC); memcpy(skb_put(skb, i), header, i); ... If alloc_skb() fails and returns NULL then the second line will cause a NULL pointer dereference - skb_put() gives the pointer to skb_tail_pointer() which dereferences it. I'm not quite sure how this should be dealt with, so I'll just report it rather than submit a patch. Happy bug fixing :-) -- Jesper Juhl http://www.chaosbits.net/ Don't top-post http://www.catb.org/~esr/jargon/html/T/top-post.html Plain text mails only, please. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/