From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.simonwunderlich.de (mail.simonwunderlich.de [23.88.38.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 584BE44DB95 for ; Fri, 15 May 2026 09:56:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=23.88.38.48 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778838964; cv=none; b=il5Omsf/48l6K4pfsnxYFrETXT4blHkeyvai9oKYryDYgDygODmEb2INyxWm8nV2duz9xNQ1rbfbHxtA19vts61qbP/vD5BxlNXSmReW2Q+7nN7pvjgWGa4zkm6lxrCnCwSPkilrDd5/+2PZtFRBy8XKAXCoXxbAGD7al/hQL0c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778838964; c=relaxed/simple; bh=y0ToKKG3VEmgIOc0ftZz5Rc++tf6mBwrHln86WhgQ7Y=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eFACBlzgiHxxcdfIeJvfe3UDguQfD1OHXDbKescyLRQdsccqhdBvbD29VvVFCxLZS4/vPOCyM5OCOwvTYbXogUlUlJD8FP6UJaW8TQD7sQ/MjoA00ow2kNZ7CkYuJshO7mFeFIP2AMafIbcHX03hF1o1U1qoljm6iOGxUiW/irw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=simonwunderlich.de; spf=pass smtp.mailfrom=simonwunderlich.de; dkim=pass (2048-bit key) header.d=simonwunderlich.de header.i=@simonwunderlich.de header.b=e7kNwOJF; arc=none smtp.client-ip=23.88.38.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=simonwunderlich.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=simonwunderlich.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=simonwunderlich.de header.i=@simonwunderlich.de header.b="e7kNwOJF" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=simonwunderlich.de; s=09092022; t=1778838956; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=JeFU2yocd90391ZPALZwK9q60q3TKgjMlk+bp4HtH7o=; b=e7kNwOJFS6mSE1d3pyb3IM9FkmKlhNQ1XjGK1d1aJtc4F3DIWFQUd13UfQYned1DoroL5j RkjHEb+OlxkleU1xe7J1TDRB4W1cZiiJs1n8knzN70FdPrGbIE1gGc5S2TPk29Ogw4J6oI mgBNYFeCcyEHdtPPBjqBsSZlmOsvuHBAKhl0/UAEYVfPPSQ32UJdMgKfn3zumkjKtCpq49 MW9ggHk0qjaz4RLJMyaFrltQA1iE1NI5O7W/pVTSRMAxfrHHbYE/VemUM6/jKnj4K6Mgk+ hM+1pjulYKqMBKAYTU4Rzr/Q8jAuvsFP9EdkgAk3amLjUcT/I2RO5gmj0CUvzw== From: Simon Wunderlich To: netdev@vger.kernel.org Cc: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , b.a.t.m.a.n@lists.open-mesh.org, Sven Eckelmann , stable@kernel.org, Yuan Tan , Yifan Wu , Juefei Pu , Xin Liu , Simon Wunderlich Subject: [PATCH net 11/14] batman-adv: dat: handle forward allocation error Date: Fri, 15 May 2026 11:55:36 +0200 Message-ID: <20260515095540.325586-12-sw@simonwunderlich.de> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260515095540.325586-1-sw@simonwunderlich.de> References: <20260515095540.325586-1-sw@simonwunderlich.de> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Sven Eckelmann batadv_dat_forward_data() calls pskb_copy_for_clone() to duplicate an skb for each DHT candidate, but does not check the return value before passing it to batadv_send_skb_prepare_unicast_4addr(). That function dereferences the skb unconditionally, so a failed allocation triggers a NULL pointer dereference. Skip forwarding to the current DHT candidate on allocation failure. Cc: stable@kernel.org Fixes: 785ea1144182 ("batman-adv: Distributed ARP Table - create DHT helper functions") Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Reviewed-by: Yuan Tan Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich --- net/batman-adv/distributed-arp-table.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c index 3efc4cf50b469..0a8bd95e2f99e 100644 --- a/net/batman-adv/distributed-arp-table.c +++ b/net/batman-adv/distributed-arp-table.c @@ -696,6 +696,9 @@ static bool batadv_dat_forward_data(struct batadv_priv *bat_priv, goto free_orig; tmp_skb = pskb_copy_for_clone(skb, GFP_ATOMIC); + if (!tmp_skb) + goto free_neigh; + if (!batadv_send_skb_prepare_unicast_4addr(bat_priv, tmp_skb, cand[i].orig_node, packet_subtype)) { -- 2.47.3