From: Haoxiang Li <haoxiang_li2024@163.com>
Date: Fri, 21 Feb 2025 08:49:47 +0000 (+0800)
Subject: Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name()
X-Git-Tag: v6.12.19~152
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=88310caff68ae69d0574859f7926a59c1da2d60b;p=thirdparty%2Fkernel%2Fstable.git

Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name()

commit f2176a07e7b19f73e05c805cf3d130a2999154cb upstream.

Add check for the return value of mgmt_alloc_skb() in
mgmt_remote_name() to prevent null pointer dereference.

Fixes: ba17bb62ce41 ("Bluetooth: Fix skb allocation in mgmt_remote_name() & mgmt_device_connected()")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 90c21b3edcd80..8a73cf289e2d7 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -10484,6 +10484,8 @@ void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
 
 	skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND,
 			     sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0));
+	if (!skb)
+		return;
 
 	ev = skb_put(skb, sizeof(*ev));
 	bacpy(&ev->addr.bdaddr, bdaddr);