On Wed, May 13, 2026 at 12:01 AM Sven Eckelmann <[email protected]> wrote: > > batadv_dat_forward_data() calls pskb_copy_for_clone() to duplicate an skb > for each DHT candidate, but does not check the return value before passing > it to batadv_send_skb_prepare_unicast_4addr(). That function dereferences > the skb unconditionally, so a failed allocation triggers a NULL pointer > dereference. > > Skip forwarding to the current DHT candidate on allocation failure. > > Cc: [email protected] > Fixes: 785ea1144182 ("batman-adv: Distributed ARP Table - create DHT helper > functions") > Reported-by: Yuan Tan <[email protected]> > Reported-by: Yifan Wu <[email protected]> > Reported-by: Juefei Pu <[email protected]> > Reported-by: Xin Liu <[email protected]> > Signed-off-by: Sven Eckelmann <[email protected]> > --- > net/batman-adv/distributed-arp-table.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/net/batman-adv/distributed-arp-table.c > b/net/batman-adv/distributed-arp-table.c > index 3efc4cf5..0a8bd95e 100644 > --- a/net/batman-adv/distributed-arp-table.c > +++ b/net/batman-adv/distributed-arp-table.c > @@ -696,6 +696,9 @@ static bool batadv_dat_forward_data(struct batadv_priv > *bat_priv, > goto free_orig; > > tmp_skb = pskb_copy_for_clone(skb, GFP_ATOMIC); > + if (!tmp_skb) > + goto free_neigh; > + > if (!batadv_send_skb_prepare_unicast_4addr(bat_priv, tmp_skb, > cand[i].orig_node, > packet_subtype)) { > > -- > 2.47.3 >
Reviewed-by: Yuan Tan <[email protected]>
