Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()

The skb_clone() function can return NULL if memory allocation fails.
send_mcast_pkt() calls skb_clone() without checking the return value, which
can lead to a NULL pointer dereference in send_pkt() when it dereferences
skb->data.
Add a NULL check after skb_clone() and skip the peer if the clone fails.

Fixes: 18722c247023 ("Bluetooth: Enable 6LoWPAN support for BT LE devices")
Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 2f03b780b40d84aac8519503ee5ac091457e361e..960a19b3e26da1b98d66dc4bdc40197768f78bd8 100644 (file)
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -486,6 +486,8 @@ static int send_mcast_pkt(struct sk_buff *skb, struct net_device *netdev)
                        int ret;
 
                        local_skb = skb_clone(skb, GFP_ATOMIC);
+                       if (!local_skb)
+                               continue;
 
                        BT_DBG("xmit %s to %pMR type %u IP %pI6c chan %p",
                               netdev->name,