| Message ID | 20230313090346.48778-1-jiasheng@iscas.ac.cn (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | Bluetooth: 6LoWPAN: Add missing check for skb_clone | expand |
| Context | Check | Description |
|---|---|---|
| tedd_an/pre-ci_am | success | Success |
| tedd_an/CheckPatch | success | CheckPatch PASS |
| tedd_an/GitLint | success | Gitlint PASS |
| tedd_an/SubjectPrefix | success | Gitlint PASS |
| tedd_an/BuildKernel | success | BuildKernel PASS |
| tedd_an/CheckAllWarning | success | CheckAllWarning PASS |
| tedd_an/CheckSparse | success | CheckSparse PASS |
| tedd_an/CheckSmatch | success | CheckSparse PASS |
| tedd_an/BuildKernel32 | success | BuildKernel32 PASS |
| tedd_an/TestRunnerSetup | success | TestRunnerSetup PASS |
| tedd_an/TestRunner_l2cap-tester | success | TestRunner PASS |
| tedd_an/TestRunner_iso-tester | success | TestRunner PASS |
| tedd_an/TestRunner_bnep-tester | success | TestRunner PASS |
| tedd_an/TestRunner_mgmt-tester | success | TestRunner PASS |
| tedd_an/TestRunner_rfcomm-tester | success | TestRunner PASS |
| tedd_an/TestRunner_sco-tester | success | TestRunner PASS |
| tedd_an/TestRunner_ioctl-tester | success | TestRunner PASS |
| tedd_an/TestRunner_mesh-tester | success | TestRunner PASS |
| tedd_an/TestRunner_smp-tester | success | TestRunner PASS |
| tedd_an/TestRunner_userchan-tester | success | TestRunner PASS |
| tedd_an/IncrementalBuild | success | Incremental Build PASS |
This is automated email and please do not reply to this email! Dear submitter, Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series: PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=729360 ---Test result--- Test Summary: CheckPatch PASS 0.61 seconds GitLint PASS 0.29 seconds SubjectPrefix PASS 0.10 seconds BuildKernel PASS 31.73 seconds CheckAllWarning PASS 35.05 seconds CheckSparse PASS 39.86 seconds CheckSmatch PASS 107.69 seconds BuildKernel32 PASS 31.26 seconds TestRunnerSetup PASS 444.70 seconds TestRunner_l2cap-tester PASS 17.17 seconds TestRunner_iso-tester PASS 17.53 seconds TestRunner_bnep-tester PASS 5.62 seconds TestRunner_mgmt-tester PASS 114.29 seconds TestRunner_rfcomm-tester PASS 9.09 seconds TestRunner_sco-tester PASS 8.41 seconds TestRunner_ioctl-tester PASS 9.86 seconds TestRunner_mesh-tester PASS 7.27 seconds TestRunner_smp-tester PASS 8.31 seconds TestRunner_userchan-tester PASS 5.97 seconds IncrementalBuild PASS 28.66 seconds --- Regards, Linux Bluetooth
On Mon, Mar 13, 2023 at 05:03:46PM +0800, Jiasheng Jiang wrote: > Add the check for the return value of skb_clone since it may return NULL > pointer and cause NULL pointer dereference in send_pkt. > > Fixes: 18722c247023 ("Bluetooth: Enable 6LoWPAN support for BT LE devices") > Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> > --- > net/bluetooth/6lowpan.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c > index 4eb1b3ced0d2..bf42a0b03e20 100644 > --- a/net/bluetooth/6lowpan.c > +++ b/net/bluetooth/6lowpan.c > @@ -477,6 +477,10 @@ static int send_mcast_pkt(struct sk_buff *skb, struct net_device *netdev) > int ret; > > local_skb = skb_clone(skb, GFP_ATOMIC); > + if (!local_skb) { > + rcu_read_unlock(); > + return -ENOMEM; > + } Further down in this loop an error is handled as follows, I wonder if that pattern is appropriate here too. ret = send_pkt(pentry->chan, local_skb, netdev); if (ret < 0) err = ret; > BT_DBG("xmit %s to %pMR type %u IP %pI6c chan %p", > netdev->name, > -- > 2.25.1 >
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c index 4eb1b3ced0d2..bf42a0b03e20 100644 --- a/net/bluetooth/6lowpan.c +++ b/net/bluetooth/6lowpan.c @@ -477,6 +477,10 @@ static int send_mcast_pkt(struct sk_buff *skb, struct net_device *netdev) int ret; local_skb = skb_clone(skb, GFP_ATOMIC); + if (!local_skb) { + rcu_read_unlock(); + return -ENOMEM; + } BT_DBG("xmit %s to %pMR type %u IP %pI6c chan %p", netdev->name,
Add the check for the return value of skb_clone since it may return NULL pointer and cause NULL pointer dereference in send_pkt. Fixes: 18722c247023 ("Bluetooth: Enable 6LoWPAN support for BT LE devices") Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> --- net/bluetooth/6lowpan.c | 4 ++++ 1 file changed, 4 insertions(+)