diff options
| author | Sven Eckelmann <sven@narfation.org> | 2026-06-26 18:10:51 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-07-04 13:39:38 +0200 |
| commit | 8bdb6372e8085b8b23165c2d699d89135cbf9501 (patch) | |
| tree | b06d61b3d2352968727d16340692a66f3dce36fd | |
| parent | 9784b901b1e5a8fba80a0b48fc86448a2e283110 (diff) | |
| download | linux-stable-8bdb6372e8085b8b23165c2d699d89135cbf9501.tar.gz linux-stable-8bdb6372e8085b8b23165c2d699d89135cbf9501.zip | |
batman-adv: ensure bcast is writable before modifying TTL
commit 4cd6d3a4b96a8576f1fed8f9f9f17c2dc2978e0c upstream.
Before batman-adv is allowed to write to an skb, it either has to have its
own copy of the skb or used skb_cow() to ensure that the data part is not
shared.
The old implementation used a shared queue and created copies before
attempting to write to it. But with the new implementation, the broadcast
packet is already modified when it gets received. Potentially writing to
shared buffers in this process.
Adding a skb_cow() right before this operation avoids this and can at the
same time prepare it for the modifications required to rebroadcast the
packet.
Cc: stable@kernel.org
Fixes: 3f69339068f9 ("batman-adv: bcast: queue per interface, if needed")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | net/batman-adv/routing.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c index 970d0d7ccc98..503c8c9381eb 100644 --- a/net/batman-adv/routing.c +++ b/net/batman-adv/routing.c @@ -1198,6 +1198,12 @@ int batadv_recv_bcast_packet(struct sk_buff *skb, if (batadv_is_my_mac(bat_priv, bcast_packet->orig)) goto free_skb; + /* create a copy of the skb, if needed, to modify it. */ + if (skb_cow(skb, ETH_HLEN) < 0) + goto free_skb; + + bcast_packet = (struct batadv_bcast_packet *)skb->data; + if (bcast_packet->ttl-- < 2) goto free_skb; |