Date:   Tue, 14 Mar 2023 15:58:23 +0100
From:   Simon Horman <simon.horman@corigine.com>
To:     Jiasheng Jiang <jiasheng@iscas.ac.cn>
Cc:     marcel@holtmann.org, johan.hedberg@gmail.com, luiz.dentz@gmail.com,
        davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
        pabeni@redhat.com, linux-bluetooth@vger.kernel.org,
        netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] Bluetooth: 6LoWPAN: Add missing check for skb_clone
Message-ID: <ZBCLj3fIeovF27z7@corigine.com>
References: <20230313090346.48778-1-jiasheng@iscas.ac.cn>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230313090346.48778-1-jiasheng@iscas.ac.cn>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?QQ0iDpE+ZclfjMPW34WMfZCF8vZpnRz9BqfD68oC9iJiIZvpuYpUd88n7M+J?=
 =?us-ascii?Q?0DdU+D7FdyY2vy89K4BAbHrGjvys81+tGz+zYpp2VLRrNZ13awq6HDqEq5Aq?=
 =?us-ascii?Q?QUnEb3VgdFSgQeOJLpkvkXdxlFqgUHmBYieqkxpFw1qOHpGOr3NSUP91NvP6?=
 =?us-ascii?Q?yi7FvQjQ5di5QLUT6XKc45EuMVSmrVRvMAyHH4NS4V+YewPaOR4NMFDvRjK0?=
 =?us-ascii?Q?SUpgW/sfy2CVouV6fEsH7V76hmKIoN2ZRGkNlPPu1Zu6eQ5RssOUrMX8hhva?=
 =?us-ascii?Q?FiCbaQljGOaUag4d5+iSAIj4l3wXVvefoI//tFnX8XuDXapREuwqwLRZyYht?=
 =?us-ascii?Q?R+610WDuQw4EG8kBIqFFW57OmyTdrWtswqqRUP86SxxRp0HP2wo60yNKB9Z2?=
 =?us-ascii?Q?I5Kzmyzv2RUaz9AjPYV7tPOh4jK4MJF7YuLiAU87NG8//R31ZcRKlVOfyqLz?=
 =?us-ascii?Q?NzTzUlJPbAKLAHj1BZZ5VAgVdFo8n7q9wvDdlh/Yalh85b6vHAYzMEO6oR38?=
 =?us-ascii?Q?Iz899Znbh1t83+M/jCzgOhM8M9Fqu1Av1pZavuXu3+HPaVBfonu2NeU/d+wL?=
 =?us-ascii?Q?EJkODFhQGVw2j9/SEYE/8q7Isq+rpe2eMCBS1ZZ3UTLzJ6k6Bqt421X2OlJR?=
 =?us-ascii?Q?+X+b6tAMIdiFjHp1c9GIsbxaz/L2aLL/gVHlySArInZioqhWBZgv89kindbV?=
 =?us-ascii?Q?4gomjqV6G+WtJpKG6NTBhypEEqyG7C2ZkQJPU3TvyQVxCe1AU7+gc0SaporB?=
 =?us-ascii?Q?o7Hf1gy3d44rU17RbWzgpiwaa13HVtsYHJLNpnYhiSGsSawL/9IEJOvmkvz/?=
 =?us-ascii?Q?JsbXteajNW1/sKmiW3uDOkJ377QI2ZMkRhAXJwB+LJINrq36xzDHWUb0y6LS?=
 =?us-ascii?Q?TAuVx49eAWHuYjOhdKZbCiwYn2QI6TCbfMqH/YB4+7GGWjnLCQ28tqMDcC/L?=
 =?us-ascii?Q?73RHFnXohj755Uso0h12DRqs3Ad0Qubw0BFsa5lWHJMhuMWCu2IdG8wQsf3F?=
 =?us-ascii?Q?bUOzb8peoxO7mhVzxX94GiK5Lrqj8vS0GKJtMtmXIupFi+FfMt2VhoGRD1Vf?=
 =?us-ascii?Q?WWOcAHda+0hnePMeiG7K58KmBHpmre7l9HqeChl0Eujrjj5jBa2zX41w09SA?=
 =?us-ascii?Q?LXWYpUyBmQUSeyj680GZJPPhxMA4nqsA0jZIcq22jxIq7/kcbv3O6/3mJ3zS?=
 =?us-ascii?Q?iz5kHdcFxo/SlpJkeGdXbXK1tmwbASE8u0u9x5FBtU2Ny3wXRT79MuFzpplq?=
 =?us-ascii?Q?f2EM5jkpL3ADVZKMKpcuDguKD5fJvbSIYbQBDOqRE+PlPn0zYkDoR9shkOKd?=
 =?us-ascii?Q?p3xYeWrgJj6TzNTaFb+wQBxonUqsUeqjXMKjtLBkx+v88Lr5Yh3Z6w5TgWBQ?=
 =?us-ascii?Q?QycPLW2/XuQ4E50jzGyp8E0d/uv1drfiPTXXCbTi1VD/9fQ7MdFSsZZcRllw?=
 =?us-ascii?Q?2K58nHoNbIvpSMBdJYWTpKM8hdrNUUGGvkyVUL0lOj0og9C1hlOPwE1mmb0v?=
 =?us-ascii?Q?FO8A3lp5uFhUhgKwmqlaBfRBhAkR8bhhB8c57v0+csFHZvxPDoQNc7U8c3or?=
 =?us-ascii?Q?dRyZyEGo9Lrlv3DmocsHqmL5aTYnsRs2Mvtbw0dUEYDps+uLYMiBjzpY3E5S?=
 =?us-ascii?Q?KwnWkXdlxCgchGDk0BWtzrtqIKY3/iYhylbTWN7GmqSV3lVSk65PK8XEFz1l?=
 =?us-ascii?Q?XpxDKQ=3D=3D?=
X-OriginatorOrg: corigine.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 20d0ae6c-fcd7-460a-a2d5-08db249c934f
X-MS-Exchange-CrossTenant-AuthSource: PH0PR13MB4842.namprd13.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Mar 2023 14:58:31.1461
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: fe128f2c-073b-4c20-818e-7246a585940c
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: eZOCAfNwT5CaVopejtf8XJcuAhpygYyKMfdfQK4cw70AwjkB13zWcpomOuOBQ7uSTgXQJ7ysAHj+iN2pndUZcNwlDQroPypw3hPsz3jn0S4=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR13MB4086
Precedence: bulk
List-ID: <linux-bluetooth.vger.kernel.org>
X-Mailing-List: linux-bluetooth@vger.kernel.org

On Mon, Mar 13, 2023 at 05:03:46PM +0800, Jiasheng Jiang wrote:
> Add the check for the return value of skb_clone since it may return NULL
> pointer and cause NULL pointer dereference in send_pkt.
> 
> Fixes: 18722c247023 ("Bluetooth: Enable 6LoWPAN support for BT LE devices")
> Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
> ---
>  net/bluetooth/6lowpan.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
> index 4eb1b3ced0d2..bf42a0b03e20 100644
> --- a/net/bluetooth/6lowpan.c
> +++ b/net/bluetooth/6lowpan.c
> @@ -477,6 +477,10 @@ static int send_mcast_pkt(struct sk_buff *skb, struct net_device *netdev)
>  			int ret;
>  
>  			local_skb = skb_clone(skb, GFP_ATOMIC);
> +			if (!local_skb) {
> +				rcu_read_unlock();
> +				return -ENOMEM;
> +			}

Further down in this loop an error is handled as follows,
I wonder if that pattern is appropriate here too.

			ret = send_pkt(pentry->chan, local_skb, netdev);
			if (ret < 0)
				err = ret;

>  			BT_DBG("xmit %s to %pMR type %u IP %pI6c chan %p",
>  			       netdev->name,
> -- 
> 2.25.1
>