[linux-next] LinuxNextTracking branch, master, updated. next-20140219

batman at open-mesh.org batman at open-mesh.org
Thu Feb 20 00:22:57 CET 2014


The following commit has been merged in the master branch:
commit 70b271a78beba787155d6696aacd7c4d4a251c50
Author: Antonio Quartulli <antonio at meshcoding.com>
Date:   Sat Feb 15 21:50:37 2014 +0100

    batman-adv: fix potential kernel paging error for unicast transmissions
    
    batadv_send_skb_prepare_unicast(_4addr) might reallocate the
    skb's data. If it does then our ethhdr pointer is not valid
    anymore in batadv_send_skb_unicast(), resulting in a kernel
    paging error.
    
    Fixing this by refetching the ethhdr pointer after the
    potential reallocation.
    
    Signed-off-by: Linus Lüssing <linus.luessing at web.de>
    Signed-off-by: Antonio Quartulli <antonio at meshcoding.com>

diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index 579f5f0..843febd 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -254,9 +254,9 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
 				   struct batadv_orig_node *orig_node,
 				   unsigned short vid)
 {
-	struct ethhdr *ethhdr = (struct ethhdr *)skb->data;
+	struct ethhdr *ethhdr;
 	struct batadv_unicast_packet *unicast_packet;
-	int ret = NET_XMIT_DROP;
+	int ret = NET_XMIT_DROP, hdr_size;
 
 	if (!orig_node)
 		goto out;
@@ -265,12 +265,16 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
 	case BATADV_UNICAST:
 		if (!batadv_send_skb_prepare_unicast(skb, orig_node))
 			goto out;
+
+		hdr_size = sizeof(*unicast_packet);
 		break;
 	case BATADV_UNICAST_4ADDR:
 		if (!batadv_send_skb_prepare_unicast_4addr(bat_priv, skb,
 							   orig_node,
 							   packet_subtype))
 			goto out;
+
+		hdr_size = sizeof(struct batadv_unicast_4addr_packet);
 		break;
 	default:
 		/* this function supports UNICAST and UNICAST_4ADDR only. It
@@ -279,6 +283,7 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
 		goto out;
 	}
 
+	ethhdr = (struct ethhdr *)(skb->data + hdr_size);
 	unicast_packet = (struct batadv_unicast_packet *)skb->data;
 
 	/* inform the destination node that we are still missing a correct route

-- 
LinuxNextTracking


More information about the linux-merge mailing list