batadv_send_skb_prepare_unicast(_4addr) might reallocate the skb's data. If it does then our ethhdr pointer is not valid anymore in batadv_send_skb_unicast(), resulting in a kernel paging error.
This patch fixes this issue by storing the few bytes we are interested in on the stack before modifying the skb.
Signed-off-by: Linus Lüssing linus.luessing@web.de --- unicast.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/unicast.c b/unicast.c index 4c5a1aa..c636fd5 100644 --- a/unicast.c +++ b/unicast.c @@ -395,6 +395,7 @@ int batadv_unicast_generic_send_skb(struct batadv_priv *bat_priv, struct sk_buff *skb, int packet_type, int packet_subtype) { + uint8_t dest[ETH_ALEN]; struct ethhdr *ethhdr = (struct ethhdr *)skb->data; struct batadv_unicast_packet *unicast_packet; struct batadv_orig_node *orig_node; @@ -426,6 +427,8 @@ find_router: if (!neigh_node) goto out;
+ memcpy(dest, ethhdr->h_dest, sizeof(dest)); + switch (packet_type) { case BATADV_UNICAST: if (!batadv_unicast_prepare_skb(skb, orig_node)) @@ -450,7 +453,7 @@ find_router: * try to reroute it because the ttvn contained in the header is less * than the current one */ - if (batadv_tt_global_client_is_roaming(bat_priv, ethhdr->h_dest)) + if (batadv_tt_global_client_is_roaming(bat_priv, dest)) unicast_packet->ttvn = unicast_packet->ttvn - 1;
dev_mtu = neigh_node->if_incoming->net_dev->mtu;