Add the check for the return value of skb_clone since it may return NULL
pointer and cause NULL pointer dereference in send_pkt.
Fixes: 18722c247023 ("Bluetooth: Enable 6LoWPAN support for BT LE devices")
Signed-off-by: Jiasheng Jiang <[email protected]>
---
Changelog:
v1 -> v2:
1. Modify the error handling in the loop.
---
net/bluetooth/6lowpan.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 4eb1b3ced0d2..55ae2ff40efb 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -477,19 +477,25 @@ static int send_mcast_pkt(struct sk_buff *skb, struct net_device *netdev)
int ret;
local_skb = skb_clone(skb, GFP_ATOMIC);
+ if (!local_skb) {
+ err = -ENOMEM;
+ goto out;
+ }
BT_DBG("xmit %s to %pMR type %u IP %pI6c chan %p",
netdev->name,
&pentry->chan->dst, pentry->chan->dst_type,
&pentry->peer_addr, pentry->chan);
ret = send_pkt(pentry->chan, local_skb, netdev);
- if (ret < 0)
- err = ret;
-
kfree_skb(local_skb);
+ if (ret < 0) {
+ err = ret;
+ goto out;
+ }
}
}
+out:
rcu_read_unlock();
return err;
--
2.25.1
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=730201
---Test result---
Test Summary:
CheckPatch PASS 0.59 seconds
GitLint PASS 0.29 seconds
SubjectPrefix PASS 0.10 seconds
BuildKernel PASS 31.44 seconds
CheckAllWarning PASS 34.16 seconds
CheckSparse PASS 38.67 seconds
CheckSmatch PASS 107.42 seconds
BuildKernel32 PASS 30.11 seconds
TestRunnerSetup PASS 434.79 seconds
TestRunner_l2cap-tester PASS 16.46 seconds
TestRunner_iso-tester PASS 16.46 seconds
TestRunner_bnep-tester PASS 5.35 seconds
TestRunner_mgmt-tester PASS 107.71 seconds
TestRunner_rfcomm-tester PASS 8.61 seconds
TestRunner_sco-tester PASS 7.87 seconds
TestRunner_ioctl-tester PASS 9.34 seconds
TestRunner_mesh-tester PASS 6.74 seconds
TestRunner_smp-tester PASS 7.82 seconds
TestRunner_userchan-tester PASS 5.62 seconds
IncrementalBuild PASS 28.71 seconds
---
Regards,
Linux Bluetooth
On Wed, Mar 15, 2023 at 03:06:21PM +0800, Jiasheng Jiang wrote:
> Add the check for the return value of skb_clone since it may return NULL
> pointer and cause NULL pointer dereference in send_pkt.
>
> Fixes: 18722c247023 ("Bluetooth: Enable 6LoWPAN support for BT LE devices")
> Signed-off-by: Jiasheng Jiang <[email protected]>
> ---
> Changelog:
>
> v1 -> v2:
>
> 1. Modify the error handling in the loop.
I think that at a minimum this needs to be included in the patch description.
Or better, in it's own patch with it's own fixes tag.
It seems like a fundamental change to the error handling to me.
> ---
> net/bluetooth/6lowpan.c | 12 +++++++++---
> 1 file changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
> index 4eb1b3ced0d2..55ae2ff40efb 100644
> --- a/net/bluetooth/6lowpan.c
> +++ b/net/bluetooth/6lowpan.c
> @@ -477,19 +477,25 @@ static int send_mcast_pkt(struct sk_buff *skb, struct net_device *netdev)
> int ret;
>
> local_skb = skb_clone(skb, GFP_ATOMIC);
> + if (!local_skb) {
> + err = -ENOMEM;
> + goto out;
> + }
>
> BT_DBG("xmit %s to %pMR type %u IP %pI6c chan %p",
> netdev->name,
> &pentry->chan->dst, pentry->chan->dst_type,
> &pentry->peer_addr, pentry->chan);
> ret = send_pkt(pentry->chan, local_skb, netdev);
> - if (ret < 0)
> - err = ret;
> -
> kfree_skb(local_skb);
> + if (ret < 0) {
> + err = ret;
> + goto out;
> + }
> }
> }
>
> +out:
> rcu_read_unlock();
>
> return err;
> --
> 2.25.1
>
On Sat, Mar 18, 2023 at 05:03:21AM +0800, Simon Horman wrote:
> On Wed, Mar 15, 2023 at 03:06:21PM +0800, Jiasheng Jiang wrote:
>> Add the check for the return value of skb_clone since it may return NULL
>> pointer and cause NULL pointer dereference in send_pkt.
>>
>> Fixes: 18722c247023 ("Bluetooth: Enable 6LoWPAN support for BT LE devices")
>> Signed-off-by: Jiasheng Jiang <[email protected]>
>> ---
>> Changelog:
>>
>> v1 -> v2:
>>
>> 1. Modify the error handling in the loop.
>
> I think that at a minimum this needs to be included in the patch description.
> Or better, in it's own patch with it's own fixes tag.
> It seems like a fundamental change to the error handling to me.
I will submit a separate patch to modify the error handling in the loop.
You can directly review the v1.
Link:https://lore.kernel.org/all/[email protected]/
Thanks,
Jiang
On Mon, Mar 20, 2023 at 10:54:40AM +0800, Jiasheng Jiang wrote:
> On Sat, Mar 18, 2023 at 05:03:21AM +0800, Simon Horman wrote:
>> On Wed, Mar 15, 2023 at 03:06:21PM +0800, Jiasheng Jiang wrote:
>>> Add the check for the return value of skb_clone since it may return NULL
>>> pointer and cause NULL pointer dereference in send_pkt.
>>>
>>> Fixes: 18722c247023 ("Bluetooth: Enable 6LoWPAN support for BT LE devices")
>>> Signed-off-by: Jiasheng Jiang <[email protected]>
>>> ---
>>> Changelog:
>>>
>>> v1 -> v2:
>>>
>>> 1. Modify the error handling in the loop.
>>
>> I think that at a minimum this needs to be included in the patch description.
>> Or better, in it's own patch with it's own fixes tag.
>> It seems like a fundamental change to the error handling to me.
>
> I will submit a separate patch to modify the error handling in the loop.
> You can directly review the v1.
> Link:https://lore.kernel.org/all/[email protected]/
I think it would be better to send a patch series.
Thanks,
Jiang
On Mon, Mar 20, 2023 at 11:08:46AM +0800, Jiasheng Jiang wrote:
> On Mon, Mar 20, 2023 at 10:54:40AM +0800, Jiasheng Jiang wrote:
> > On Sat, Mar 18, 2023 at 05:03:21AM +0800, Simon Horman wrote:
> >> On Wed, Mar 15, 2023 at 03:06:21PM +0800, Jiasheng Jiang wrote:
> >>> Add the check for the return value of skb_clone since it may return NULL
> >>> pointer and cause NULL pointer dereference in send_pkt.
> >>>
> >>> Fixes: 18722c247023 ("Bluetooth: Enable 6LoWPAN support for BT LE devices")
> >>> Signed-off-by: Jiasheng Jiang <[email protected]>
> >>> ---
> >>> Changelog:
> >>>
> >>> v1 -> v2:
> >>>
> >>> 1. Modify the error handling in the loop.
> >>
> >> I think that at a minimum this needs to be included in the patch description.
> >> Or better, in it's own patch with it's own fixes tag.
> >> It seems like a fundamental change to the error handling to me.
> >
> > I will submit a separate patch to modify the error handling in the loop.
> > You can directly review the v1.
> > Link:https://lore.kernel.org/all/[email protected]/
>
> I think it would be better to send a patch series.
Yes, agreed.