Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2230e0c1 authored by David S. Miller's avatar David S. Miller
Browse files

Merge tag 'batman-adv-fix-for-davem' of git://git.open-mesh.org/linux-merge 



Included changes ares:
- fix packet parsing routine to avoid to read beyond the packet boundary

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 4660c7f4 b47506d9

net/batman-adv/bat_iv_ogm.c

+3 −3
Original line number Original line Diff line number Diff line
@@ -1288,7 +1288,8 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb, 
	batadv_ogm_packet = (struct batadv_ogm_packet *)packet_buff;

	batadv_ogm_packet = (struct batadv_ogm_packet *)packet_buff;





	/* unpack the aggregated packets and process them one by one */

	/* unpack the aggregated packets and process them one by one */

	do {

	while (batadv_iv_ogm_aggr_packet(buff_pos, packet_len,

					 batadv_ogm_packet->tt_num_changes)) {

		tt_buff = packet_buff + buff_pos + BATADV_OGM_HLEN;

		tt_buff = packet_buff + buff_pos + BATADV_OGM_HLEN;





		batadv_iv_ogm_process(ethhdr, batadv_ogm_packet, tt_buff,

		batadv_iv_ogm_process(ethhdr, batadv_ogm_packet, tt_buff,
@@ -1299,8 +1300,7 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb, 




		packet_pos = packet_buff + buff_pos;

		packet_pos = packet_buff + buff_pos;

		batadv_ogm_packet = (struct batadv_ogm_packet *)packet_pos;

		batadv_ogm_packet = (struct batadv_ogm_packet *)packet_pos;

	} while (batadv_iv_ogm_aggr_packet(buff_pos, packet_len,

	}

					   batadv_ogm_packet->tt_num_changes));





	kfree_skb(skb);

	kfree_skb(skb);

	return NET_RX_SUCCESS;

	return NET_RX_SUCCESS;