Commit 3c40d381 authored by Zhao Dongdong's avatar Zhao Dongdong Committed by Luiz Augusto von Dentz
Browse files

Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() 



The skb_clone() function can return NULL if memory allocation fails.
send_mcast_pkt() calls skb_clone() without checking the return value, which
can lead to a NULL pointer dereference in send_pkt() when it dereferences
skb->data.
Add a NULL check after skb_clone() and skip the peer if the clone fails.

Fixes: 18722c24 ("Bluetooth: Enable 6LoWPAN support for BT LE devices")
Signed-off-by: default avatarZhao Dongdong <zhaodongdong@kylinos.cn>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 82855073

net/bluetooth/6lowpan.c

+2 −0
Original line number Diff line number Diff line
@@ -486,6 +486,8 @@ static int send_mcast_pkt(struct sk_buff *skb, struct net_device *netdev) 
			int ret;



			local_skb = skb_clone(skb, GFP_ATOMIC);

			if (!local_skb)

				continue;



			BT_DBG("xmit %s to %pMR type %u IP %pI6c chan %p",

			       netdev->name,