The following commit has been merged in the master branch: commit 9d1e607c1ca1c03a7a5b68adcb08ac35160c6a04 Author: Marek Lindner lindner_marek@yahoo.de Date: Sun Nov 21 15:18:23 2010 +0000
batman-adv: ensure that eth_type_trans gets linear memory
eth_type_trans tries to pull data with the length of the ethernet header from the skb. We only ensured that enough data for the first ethernet header and the batman header is available in non-paged memory of the skb and not for the ethernet after the batman header.
eth_type_trans would fail sometimes with drivers which don't ensure that all there data is perfectly linearised.
Reported-by: Rafal Lesniak esniak@eresi-project.org Signed-off-by: Marek Lindner lindner_marek@yahoo.de Signed-off-by: Sven Eckelmann sven.eckelmann@gmx.de
diff --git a/soft-interface.c b/soft-interface.c index e93a99f..e89ede1 100644 --- a/soft-interface.c +++ b/soft-interface.c @@ -494,6 +494,8 @@ void interface_rx(struct net_device *soft_iface, }
/* skb->dev & skb->pkt_type are set here */ + if (unlikely(!pskb_may_pull(skb, ETH_HLEN))) + goto dropped; skb->protocol = eth_type_trans(skb, soft_iface);
/* should not be neccesary anymore as we use skb_pull_rcsum()