diff --git a/sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c b/sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c --- a/sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c +++ b/sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c @@ -1752,27 +1752,28 @@ * should not happen) */ - if (m->m_pkthdr.len < 4) - panic("HCI frame size is too small! pktlen=%d\n", - m->m_pkthdr.len); + if (m->m_pkthdr.len < 4) { + NG_FREE_M(m); + break; + } /* Process HCI frame */ switch (*mtod(m, uint8_t *)) { /* XXX call m_pullup ? */ case NG_HCI_CMD_PKT: - if (m->m_pkthdr.len - 1 > (int)UBT_CTRL_BUFFER_SIZE) - panic("HCI command frame size is too big! " \ - "buffer size=%zd, packet len=%d\n", - UBT_CTRL_BUFFER_SIZE, m->m_pkthdr.len); + if (m->m_pkthdr.len - 1 > (int)UBT_CTRL_BUFFER_SIZE) { + NG_FREE_M(m); + break; + } q = &sc->sc_cmdq; action = UBT_FLAG_T_START_CTRL; break; case NG_HCI_ACL_DATA_PKT: - if (m->m_pkthdr.len - 1 > UBT_BULK_WRITE_BUFFER_SIZE) - panic("ACL data frame size is too big! " \ - "buffer size=%d, packet len=%d\n", - UBT_BULK_WRITE_BUFFER_SIZE, m->m_pkthdr.len); + if (m->m_pkthdr.len - 1 > UBT_BULK_WRITE_BUFFER_SIZE) { + NG_FREE_M(m); + break; + } q = &sc->sc_aclq; action = UBT_FLAG_T_START_BULK;