Re: [PATCH batadv v2 1/5] batman-adv: dat: handle forward allocation error

On Wed, May 13, 2026 at 12:01 AM Sven Eckelmann <[email protected]> wrote:
>
> batadv_dat_forward_data() calls pskb_copy_for_clone() to duplicate an skb
> for each DHT candidate, but does not check the return value before passing
> it to batadv_send_skb_prepare_unicast_4addr(). That function dereferences
> the skb unconditionally, so a failed allocation triggers a NULL pointer
> dereference.
>
> Skip forwarding to the current DHT candidate on allocation failure.
>
> Cc: [email protected]
> Fixes: 785ea1144182 ("batman-adv: Distributed ARP Table - create DHT helper functions")
> Reported-by: Yuan Tan <[email protected]>
> Reported-by: Yifan Wu <[email protected]>
> Reported-by: Juefei Pu <[email protected]>
> Reported-by: Xin Liu <[email protected]>
> Signed-off-by: Sven Eckelmann <[email protected]>
> ---
>  net/batman-adv/distributed-arp-table.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
> index 3efc4cf5..0a8bd95e 100644
> --- a/net/batman-adv/distributed-arp-table.c
> +++ b/net/batman-adv/distributed-arp-table.c
> @@ -696,6 +696,9 @@ static bool batadv_dat_forward_data(struct batadv_priv *bat_priv,
>                         goto free_orig;
>
>                 tmp_skb = pskb_copy_for_clone(skb, GFP_ATOMIC);
> +               if (!tmp_skb)
> +                       goto free_neigh;
> +
>                 if (!batadv_send_skb_prepare_unicast_4addr(bat_priv, tmp_skb,
>                                                            cand[i].orig_node,
>                                                            packet_subtype)) {
>
> --
> 2.47.3
>

Reviewed-by: Yuan Tan <[email protected]>