Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 531c9da8 authored by Sven Eckelmann's avatar Sven Eckelmann
Browse files

batman-adv: Linearize fragment packets before merge 



We access the data inside the skbs of two fragments directly using memmove
during the merge. The data of the skb could span over multiple skb pages. An
direct access without knowledge about the pages would lead to an invalid memory
access.

Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
[lindner_marek@yahoo.de: Move return from function to the end]
Signed-off-by: default avatarMarek Lindner <lindner_marek@yahoo.de>
parent 1181e1da

net/batman-adv/unicast.c

+10 −5
Original line number Diff line number Diff line
@@ -50,12 +50,12 @@ static struct sk_buff *frag_merge_packet(struct list_head *head, 
		skb = tfp->skb;

	}



	if (skb_linearize(skb) < 0 || skb_linearize(tmp_skb) < 0)

		goto err;



	skb_pull(tmp_skb, sizeof(struct unicast_frag_packet));

	if (pskb_expand_head(skb, 0, tmp_skb->len, GFP_ATOMIC) < 0) {

		/* free buffered skb, skb will be freed later */

		kfree_skb(tfp->skb);

		return NULL;

	}

	if (pskb_expand_head(skb, 0, tmp_skb->len, GFP_ATOMIC) < 0)

		goto err;



	/* move free entry to end */

	tfp->skb = NULL;
@@ -70,6 +70,11 @@ static struct sk_buff *frag_merge_packet(struct list_head *head, 
	unicast_packet->packet_type = BAT_UNICAST;



	return skb;



err:

	/* free buffered skb, skb will be freed later */

	kfree_skb(tfp->skb);

	return NULL;

}



static void frag_create_entry(struct list_head *head, struct sk_buff *skb)