Commit 70b271a7 authored by Antonio Quartulli's avatar Antonio Quartulli

batman-adv: fix potential kernel paging error for unicast transmissions

batadv_send_skb_prepare_unicast(_4addr) might reallocate the
skb's data. If it does then our ethhdr pointer is not valid
anymore in batadv_send_skb_unicast(), resulting in a kernel
paging error.

Fixing this by refetching the ethhdr pointer after the
potential reallocation.
Signed-off-by: default avatarLinus Lüssing <linus.luessing@web.de>
Signed-off-by: default avatarAntonio Quartulli <antonio@meshcoding.com>
parent a5a5cb8c
...@@ -254,9 +254,9 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv, ...@@ -254,9 +254,9 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
struct batadv_orig_node *orig_node, struct batadv_orig_node *orig_node,
unsigned short vid) unsigned short vid)
{ {
struct ethhdr *ethhdr = (struct ethhdr *)skb->data; struct ethhdr *ethhdr;
struct batadv_unicast_packet *unicast_packet; struct batadv_unicast_packet *unicast_packet;
int ret = NET_XMIT_DROP; int ret = NET_XMIT_DROP, hdr_size;
if (!orig_node) if (!orig_node)
goto out; goto out;
...@@ -265,12 +265,16 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv, ...@@ -265,12 +265,16 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
case BATADV_UNICAST: case BATADV_UNICAST:
if (!batadv_send_skb_prepare_unicast(skb, orig_node)) if (!batadv_send_skb_prepare_unicast(skb, orig_node))
goto out; goto out;
hdr_size = sizeof(*unicast_packet);
break; break;
case BATADV_UNICAST_4ADDR: case BATADV_UNICAST_4ADDR:
if (!batadv_send_skb_prepare_unicast_4addr(bat_priv, skb, if (!batadv_send_skb_prepare_unicast_4addr(bat_priv, skb,
orig_node, orig_node,
packet_subtype)) packet_subtype))
goto out; goto out;
hdr_size = sizeof(struct batadv_unicast_4addr_packet);
break; break;
default: default:
/* this function supports UNICAST and UNICAST_4ADDR only. It /* this function supports UNICAST and UNICAST_4ADDR only. It
...@@ -279,6 +283,7 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv, ...@@ -279,6 +283,7 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
goto out; goto out;
} }
ethhdr = (struct ethhdr *)(skb->data + hdr_size);
unicast_packet = (struct batadv_unicast_packet *)skb->data; unicast_packet = (struct batadv_unicast_packet *)skb->data;
/* inform the destination node that we are still missing a correct route /* inform the destination node that we are still missing a correct route
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment