Dan,

I had a question about the code in frag_can_reassemble().

net/batman-adv/unicast.h 51 52 merged_size = (skb->len - sizeof(*unicast_packet)) * 2; ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 53 merged_size += sizeof(struct unicast_packet) + uneven_correction; 54 55 return merged_size <= mtu; 56 }

Can the skb->len be less than sizeof(*unicast_packet) (ie 20 bytes)? If "len" is less than 10 then we would return false but if it's over 10 then we would return true. Roughly.

the calling function checks for an existing unicast header. The call tree looks like this: recv_ucast_frag_packet() -> route_unicast_packet() -> frag_can_reassemble() The first function does a unicast length check by calling check_unicast_packet(). As a result we ensure that we at least have the length of the unicast header in our packet unless we overlooked something ?

Regards, Marek