batman-adv: fix skb deref after free (63d443ef) · Commits · 戴 / test

batadv_send_skb_to_orig() calls dev_queue_xmit() so we can't use skb->len. Fixes: ("batman-adv: network coding - buffer unicast packets before forward") Signed-off-by:

Florian Westphal <fw@strlen.de> Reviewed-by:

Sven Eckelmann <sven@narfation.org> Signed-off-by:

Marek Lindner <mareklindner@neomailbox.ch> Signed-off-by:

Antonio Quartulli <a@unstable.cc>

net/batman-adv/routing.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -601,6 +601,7 @@ static int batadv_route_unicast_packet(struct sk_buff *skb,
		struct batadv_unicast_packet *unicast_packet;
		struct ethhdr *ethhdr = eth_hdr(skb);
		int res, hdr_len, ret = NET_RX_DROP;
		unsigned int len;

		unicast_packet = (struct batadv_unicast_packet *)skb->data;

		@@ -641,6 +642,7 @@ static int batadv_route_unicast_packet(struct sk_buff *skb,
		if (hdr_len > 0)
		batadv_skb_set_priority(skb, hdr_len);

		len = skb->len;
		res = batadv_send_skb_to_orig(skb, orig_node, recv_if);

		/* translate transmit result into receive result */
		@@ -648,7 +650,7 @@ static int batadv_route_unicast_packet(struct sk_buff *skb,
		/* skb was transmitted and consumed */
		batadv_inc_counter(bat_priv, BATADV_CNT_FORWARD);
		batadv_add_counter(bat_priv, BATADV_CNT_FORWARD_BYTES,
		skb->len + ETH_HLEN);
		len + ETH_HLEN);

		ret = NET_RX_SUCCESS;
		} else if (res == NET_XMIT_POLICED) {

Admin message