batman-adv: Linearize fragment packets before merge (531c9da8) · Commits · 戴 / test

We access the data inside the skbs of two fragments directly using memmove during the merge. The data of the skb could span over multiple skb pages. An direct access without knowledge about the pages would lead to an invalid memory access. Signed-off-by:

Sven Eckelmann <sven@narfation.org> [lindner_marek@yahoo.de: Move return from function to the end] Signed-off-by:

Marek Lindner <lindner_marek@yahoo.de>

net/batman-adv/unicast.c

+10 −5

Original line number	Diff line number	Diff line
		@@ -50,12 +50,12 @@ static struct sk_buff frag_merge_packet(struct list_head head,
		skb = tfp->skb;
		}

		if (skb_linearize(skb) < 0 \|\| skb_linearize(tmp_skb) < 0)
		goto err;

		skb_pull(tmp_skb, sizeof(struct unicast_frag_packet));
		if (pskb_expand_head(skb, 0, tmp_skb->len, GFP_ATOMIC) < 0) {
		/* free buffered skb, skb will be freed later */
		kfree_skb(tfp->skb);
		return NULL;
		}
		if (pskb_expand_head(skb, 0, tmp_skb->len, GFP_ATOMIC) < 0)
		goto err;

		/* move free entry to end */
		tfp->skb = NULL;
		@@ -70,6 +70,11 @@ static struct sk_buff frag_merge_packet(struct list_head head,
		unicast_packet->packet_type = BAT_UNICAST;

		return skb;

		err:
		/* free buffered skb, skb will be freed later */
		kfree_skb(tfp->skb);
		return NULL;
		}

		static void frag_create_entry(struct list_head head, struct sk_buff skb)

Admin message