diff options
| author | Sven Eckelmann <sven@narfation.org> | 2026-06-26 18:11:29 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-07-04 13:42:24 +0200 |
| commit | 3af7f10d5fe44c420ceb4821e6d2bebb6e17162d (patch) | |
| tree | 2c35a25bcbc12a29d4d9bcf99ddbada27b8a8f48 | |
| parent | cb96aa173720012ff6c3e1be2685380cff65adb7 (diff) | |
| download | linux-3af7f10d5fe44c420ceb4821e6d2bebb6e17162d.tar.gz linux-3af7f10d5fe44c420ceb4821e6d2bebb6e17162d.zip | |
batman-adv: frag: avoid underflow of TTL
commit 493d9d2528e1a09b090e4b37f0f553def7bd5ce9 upstream.
Packets with a TTL are using it to limit the amount of time this packet can
be forwarded. But for batadv_frag_packet, the TTL was always only reduced
but it was never evaluated. It could even underflow without any effect.
Check the TTL in batadv_frag_skb_fwd() before attempting to prepare it for
forwarding. This keeps it in sync with the not fragmented unicast packet.
Cc: stable@kernel.org
Fixes: 610bfc6bc99b ("batman-adv: Receive fragmented packets and merge")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | net/batman-adv/fragmentation.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c index fbf030c57ac0..0138b0953e10 100644 --- a/net/batman-adv/fragmentation.c +++ b/net/batman-adv/fragmentation.c @@ -420,6 +420,13 @@ bool batadv_frag_skb_fwd(struct sk_buff *skb, */ total_size = ntohs(packet->total_size); if (total_size > neigh_node->if_incoming->net_dev->mtu) { + if (packet->ttl < 2) { + kfree_skb(skb); + *rx_result = NET_RX_DROP; + ret = true; + goto out; + } + if (skb_cow(skb, ETH_HLEN) < 0) { kfree_skb(skb); *rx_result = NET_RX_DROP; |