The following commit has been merged in the master branch: commit 7da19971a9da9c5e63d259c9a8a566f071dc95d0 Author: Marek Lindner lindner_marek@yahoo.de Date: Tue May 7 19:25:02 2013 +0800

batman-adv: check return value of pskb_trim_rcsum()

Reported-by: Sven Eckelmann sven@narfation.org Signed-off-by: Marek Lindner lindner_marek@yahoo.de Acked-by: Martin Hundebøll martin@hundeboll.net Signed-off-by: Antonio Quartulli ordex@autistici.org

diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c index f7c5430..e84629e 100644 --- a/net/batman-adv/network-coding.c +++ b/net/batman-adv/network-coding.c @@ -1514,6 +1514,7 @@ batadv_nc_skb_decode_packet(struct batadv_priv *bat_priv, struct sk_buff *skb, struct ethhdr *ethhdr, ethhdr_tmp; uint8_t *orig_dest, ttl, ttvn; unsigned int coding_len; + int err;

/* Save headers temporarily */ memcpy(&coded_packet_tmp, skb->data, sizeof(coded_packet_tmp)); @@ -1568,8 +1569,11 @@ batadv_nc_skb_decode_packet(struct batadv_priv *bat_priv, struct sk_buff *skb, coding_len);

/* Resize decoded skb if decoded with larger packet */ - if (nc_packet->skb->len > coding_len + h_size) - pskb_trim_rcsum(skb, coding_len + h_size); + if (nc_packet->skb->len > coding_len + h_size) { + err = pskb_trim_rcsum(skb, coding_len + h_size); + if (err) + return NULL; + }

/* Create decoded unicast packet */ unicast_packet = (struct batadv_unicast_packet *)skb->data;