Commit 78cf0a67 authored by Thomas Osterried's avatar Thomas Osterried Committed by David S. Miller

[AX25]: AX.25 bug fixes.

- Flxnet CRC handling fix for mkiss.c
- Use after free bug in ax25_ip.c
parent 6badba35
...@@ -329,6 +329,12 @@ static void ax_bump(struct ax_disp *ax) ...@@ -329,6 +329,12 @@ static void ax_bump(struct ax_disp *ax)
return; return;
} }
ax->rcount -= 2; ax->rcount -= 2;
/* dl9sau bugfix: the trailling two bytes flexnet crc
* will not be passed to the kernel. thus we have
* to correct the kissparm signature, because it
* indicates a crc but there's none
*/
*ax->rbuff &= ~0x20;
} }
} }
......
...@@ -154,9 +154,15 @@ int ax25_rebuild_header(struct sk_buff *skb) ...@@ -154,9 +154,15 @@ int ax25_rebuild_header(struct sk_buff *skb)
skb_set_owner_w(ourskb, skb->sk); skb_set_owner_w(ourskb, skb->sk);
kfree_skb(skb); kfree_skb(skb);
/* dl9sau: bugfix
src_c = *src; * after kfree_skb(), dst and src which were pointer
dst_c = *dst; * to bp which is part of skb->data would not be valid
* anymore hope that after skb_pull(ourskb, ..) our
* dsc_c and src_c will not become invalid
*/
bp = ourskb->data;
dst_c = *(ax25_address *)(bp + 1);
src_c = *(ax25_address *)(bp + 8);
skb_pull(ourskb, AX25_HEADER_LEN - 1); /* Keep PID */ skb_pull(ourskb, AX25_HEADER_LEN - 1); /* Keep PID */
ourskb->nh.raw = ourskb->data; ourskb->nh.raw = ourskb->data;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment