From: Haoxiang Li Date: Fri, 21 Feb 2025 08:58:01 +0000 (+0800) Subject: Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected() X-Git-Tag: v6.12.19~151 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7841180342c9a0fd97d54f3e62c7369309b5cd84;p=thirdparty%2Fkernel%2Fstable.git Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected() commit d8df010f72b8a32aaea393e36121738bb53ed905 upstream. Add check for the return value of mgmt_alloc_skb() in mgmt_device_connected() to prevent null pointer dereference. Fixes: e96741437ef0 ("Bluetooth: mgmt: Make use of mgmt_send_event_skb in MGMT_EV_DEVICE_CONNECTED") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Greg Kroah-Hartman --- diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index 8a73cf289e2d7..c019f69c59395 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -9731,6 +9731,9 @@ void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) + eir_precalc_len(sizeof(conn->dev_class))); + if (!skb) + return; + ev = skb_put(skb, sizeof(*ev)); bacpy(&ev->addr.bdaddr, &conn->dst); ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type);