[PATCH] Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()

[PATCH] Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()

[Zhao Dongdong]

From: Zhao Dongdong <zhaodongdong@kylinos.cn>

The skb_clone() function can return NULL if memory allocation fails.
send_mcast_pkt() calls skb_clone() without checking the return value, which
can lead to a NULL pointer dereference in send_pkt() when it dereferences
skb->data.
Add a NULL check after skb_clone() and skip the peer if the clone fails.

Fixes: 18722c247023 ("Bluetooth: Enable 6LoWPAN support for BT LE devices")
Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
---
 net/bluetooth/6lowpan.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 2f03b780b40d..960a19b3e26d 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -486,6 +486,8 @@ static int send_mcast_pkt(struct sk_buff *skb, struct net_device *netdev)
 			int ret;
 
 			local_skb = skb_clone(skb, GFP_ATOMIC);
+			if (!local_skb)
+				continue;
 
 			BT_DBG("xmit %s to %pMR type %u IP %pI6c chan %p",
 			       netdev->name,
-- 
2.25.1

RE: Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1042 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1100686

---Test result---

Test Summary:
CheckPatch                    PASS      0.68 seconds
VerifyFixes                   PASS      0.12 seconds
VerifySignedoff               PASS      0.12 seconds
GitLint                       PASS      0.30 seconds
SubjectPrefix                 PASS      0.11 seconds
BuildKernel                   PASS      27.63 seconds
CheckAllWarning               PASS      30.35 seconds
CheckSparse                   PASS      28.49 seconds
BuildKernel32                 PASS      26.83 seconds
TestRunnerSetup               PASS      584.38 seconds
TestRunner_6lowpan-tester     PASS      22.86 seconds
IncrementalBuild              PASS      27.60 seconds



https://github.com/bluez/bluetooth-next/pull/241

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue, 26 May 2026 11:21:39 +0800 you wrote:
> From: Zhao Dongdong <zhaodongdong@kylinos.cn>
> 
> The skb_clone() function can return NULL if memory allocation fails.
> send_mcast_pkt() calls skb_clone() without checking the return value, which
> can lead to a NULL pointer dereference in send_pkt() when it dereferences
> skb->data.
> Add a NULL check after skb_clone() and skip the peer if the clone fails.
> 
> [...]

Here is the summary with links:
  - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()
    https://git.kernel.org/bluetooth/bluetooth-next/c/ba550f4bd304

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html