batadv_send_skb_prepare_unicast(_4addr) might reallocate the skb's data. And if it tries to do so then this can potentially fail.
We shouldn't continue working on this skb in such a case.
Signed-off-by: Linus Lüssing linus.luessing@web.de --- send.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/send.c b/send.c index d2cc507..9c9cab6 100644 --- a/send.c +++ b/send.c @@ -266,11 +266,14 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
switch (packet_type) { case BATADV_UNICAST: - batadv_send_skb_prepare_unicast(skb, orig_node); + if (!batadv_send_skb_prepare_unicast(skb, orig_node)) + goto out; break; case BATADV_UNICAST_4ADDR: - batadv_send_skb_prepare_unicast_4addr(bat_priv, skb, orig_node, - packet_subtype); + if (!batadv_send_skb_prepare_unicast_4addr(bat_priv, skb, + orig_node, + packet_subtype)) + goto out; break; default: /* this function supports UNICAST and UNICAST_4ADDR only. It
batadv_send_skb_prepare_unicast(_4addr) might reallocate the skb's data. If it does then our ethhdr pointer is not valid anymore in batadv_send_skb_unicast(), resulting in a kernel paging error.
This patch fixes this issue by storing the few bytes we are interested in on the stack before modifying the skb.
Signed-off-by: Linus Lüssing linus.luessing@web.de --- send.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/send.c b/send.c index 9c9cab6..b9a1f15 100644 --- a/send.c +++ b/send.c @@ -257,13 +257,15 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv, struct batadv_orig_node *orig_node, unsigned short vid) { - struct ethhdr *ethhdr = (struct ethhdr *)skb->data; + uint8_t dest[ETH_ALEN]; struct batadv_unicast_packet *unicast_packet; int ret = NET_XMIT_DROP;
if (!orig_node) goto out;
+ memcpy(dest, ((struct ethhdr *)skb->data)->h_dest, sizeof(dest)); + switch (packet_type) { case BATADV_UNICAST: if (!batadv_send_skb_prepare_unicast(skb, orig_node)) @@ -289,7 +291,7 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv, * try to reroute it because the ttvn contained in the header is less * than the current one */ - if (batadv_tt_global_client_is_roaming(bat_priv, ethhdr->h_dest, vid)) + if (batadv_tt_global_client_is_roaming(bat_priv, dest, vid)) unicast_packet->ttvn = unicast_packet->ttvn - 1;
if (batadv_send_skb_to_orig(skb, orig_node, NULL) != NET_XMIT_DROP)
Hi Linus,
since these are two fixes, are those based on top of next? That is where they should be applied.
Cheers,
Il 26.07.2013 20:50 Linus Lüssing ha scritto:
batadv_send_skb_prepare_unicast(_4addr) might reallocate the skb's data. And if it tries to do so then this can potentially fail.
We shouldn't continue working on this skb in such a case.
Signed-off-by: Linus Lüssing linus.luessing@web.de
send.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/send.c b/send.c index d2cc507..9c9cab6 100644 --- a/send.c +++ b/send.c @@ -266,11 +266,14 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
switch (packet_type) { case BATADV_UNICAST:
batadv_send_skb_prepare_unicast(skb, orig_node);
if (!batadv_send_skb_prepare_unicast(skb, orig_node))goto out;
batadv_send_skb_prepare_unicast_4addr(bat_priv, skb, orig_node,packet_subtype);
if (!batadv_send_skb_prepare_unicast_4addr(bat_priv, skb,orig_node,packet_subtype))goto out;
b.a.t.m.a.n@lists.open-mesh.org
-
Antonio Quartulli -
Linus Lüssing