Commit 70b271a7 authored by Antonio Quartulli's avatar Antonio Quartulli
Browse files

batman-adv: fix potential kernel paging error for unicast transmissions 



batadv_send_skb_prepare_unicast(_4addr) might reallocate the
skb's data. If it does then our ethhdr pointer is not valid
anymore in batadv_send_skb_unicast(), resulting in a kernel
paging error.

Fixing this by refetching the ethhdr pointer after the
potential reallocation.

Signed-off-by: default avatarLinus Lüssing <linus.luessing@web.de>
Signed-off-by: default avatarAntonio Quartulli <antonio@meshcoding.com>
parent a5a5cb8c

net/batman-adv/send.c

+7 −2
Original line number Diff line number Diff line
@@ -254,9 +254,9 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv, 
				   struct batadv_orig_node *orig_node,

				   unsigned short vid)

{

	struct ethhdr *ethhdr = (struct ethhdr *)skb->data;

	struct ethhdr *ethhdr;

	struct batadv_unicast_packet *unicast_packet;

	int ret = NET_XMIT_DROP;

	int ret = NET_XMIT_DROP, hdr_size;



	if (!orig_node)

		goto out;
@@ -265,12 +265,16 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv, 
	case BATADV_UNICAST:

		if (!batadv_send_skb_prepare_unicast(skb, orig_node))

			goto out;



		hdr_size = sizeof(*unicast_packet);

		break;

	case BATADV_UNICAST_4ADDR:

		if (!batadv_send_skb_prepare_unicast_4addr(bat_priv, skb,

							   orig_node,

							   packet_subtype))

			goto out;



		hdr_size = sizeof(struct batadv_unicast_4addr_packet);

		break;

	default:

		/* this function supports UNICAST and UNICAST_4ADDR only. It
@@ -279,6 +283,7 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv, 
		goto out;

	}



	ethhdr = (struct ethhdr *)(skb->data + hdr_size);

	unicast_packet = (struct batadv_unicast_packet *)skb->data;



	/* inform the destination node that we are still missing a correct route

CRA Git | Maintained and supported by SUSTech CRA and CCSE