diff options
| author | Sven Eckelmann <sven@narfation.org> | 2026-06-26 18:09:42 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-07-04 13:38:39 +0200 |
| commit | 29f92da98fa8e176af5162f8e41b7064fec4c7b1 (patch) | |
| tree | 0fed5082c65e65419aea609206f147fa6773aa9c | |
| parent | f93158d86064021da134a744c6afc9703088a35b (diff) | |
| download | linux-stable-29f92da98fa8e176af5162f8e41b7064fec4c7b1.tar.gz linux-stable-29f92da98fa8e176af5162f8e41b7064fec4c7b1.zip | |
batman-adv: frag: avoid underflow of TTL
commit 493d9d2528e1a09b090e4b37f0f553def7bd5ce9 upstream.
Packets with a TTL are using it to limit the amount of time this packet can
be forwarded. But for batadv_frag_packet, the TTL was always only reduced
but it was never evaluated. It could even underflow without any effect.
Check the TTL in batadv_frag_skb_fwd() before attempting to prepare it for
forwarding. This keeps it in sync with the not fragmented unicast packet.
Cc: stable@kernel.org
Fixes: 610bfc6bc99b ("batman-adv: Receive fragmented packets and merge")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | net/batman-adv/fragmentation.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c index 95c88bbdbcbe..43dfe86f07a9 100644 --- a/net/batman-adv/fragmentation.c +++ b/net/batman-adv/fragmentation.c @@ -421,6 +421,13 @@ bool batadv_frag_skb_fwd(struct sk_buff *skb, */ total_size = ntohs(packet->total_size); if (total_size > neigh_node->if_incoming->net_dev->mtu) { + if (packet->ttl < 2) { + kfree_skb(skb); + *rx_result = NET_RX_DROP; + ret = true; + goto out; + } + if (skb_cow(skb, ETH_HLEN) < 0) { kfree_skb(skb); *rx_result = NET_RX_DROP; |