From: Jesper Juhl There's a problem in drivers/bluetooth/dtl1_cs.c::dtl1_hci_send_frame() If bt_skb_alloc() returns NULL, then skb_reserve(s, NSHL); will cause a NULL pointer deref - ouch. If we can't allocate the resources we require we need to tell the caller by returning -ENOMEM. Found by the coverity checker as bug #409 Signed-off-by: Jesper Juhl Acked-by: Marcel Holtmann Signed-off-by: Andrew Morton --- drivers/bluetooth/dtl1_cs.c | 3 +++ 1 file changed, 3 insertions(+) diff -puN drivers/bluetooth/dtl1_cs.c~bluetooth-fix-potential-null-ptr-deref-in-dtl1_cscdtl1_hci_send_frame drivers/bluetooth/dtl1_cs.c --- devel/drivers/bluetooth/dtl1_cs.c~bluetooth-fix-potential-null-ptr-deref-in-dtl1_cscdtl1_hci_send_frame 2006-06-09 15:17:59.000000000 -0700 +++ devel-akpm/drivers/bluetooth/dtl1_cs.c 2006-06-09 15:17:59.000000000 -0700 @@ -423,6 +423,9 @@ static int dtl1_hci_send_frame(struct sk nsh.len = skb->len; s = bt_skb_alloc(NSHL + skb->len + 1, GFP_ATOMIC); + if (!s) + return -ENOMEM; + skb_reserve(s, NSHL); memcpy(skb_put(s, skb->len), skb->data, skb->len); if (skb->len & 0x0001) _