diff options
| author | Sven Eckelmann <sven@narfation.org> | 2026-06-28 06:44:13 +0200 |
|---|---|---|
| committer | Sven Eckelmann <sven@narfation.org> | 2026-06-28 07:56:46 +0200 |
| commit | 035e1fed892d3d06002a73ff73668f618a514644 (patch) | |
| tree | d57847fe0f19df0aed1638bffc5d8b4ca25a940c /net | |
| parent | 805185b7c7a1069e407b6f7b3bc98e44d415f484 (diff) | |
| download | linux-2.6-035e1fed892d3d06002a73ff73668f618a514644.tar.gz linux-2.6-035e1fed892d3d06002a73ff73668f618a514644.zip | |
batman-adv: retrieve ethhdr after potential skb realloc on RX
pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind
the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.
This was done correctly for the VLAN header but missed for the ethernet
header which is later used for the TT and AP isolation handling.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Fixes: c78296665c3d ("batman-adv: Check skb size before using encapsulated ETH+VLAN header")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/batman-adv/mesh-interface.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/batman-adv/mesh-interface.c b/net/batman-adv/mesh-interface.c index 44026810b99c..511f70e0706a 100644 --- a/net/batman-adv/mesh-interface.c +++ b/net/batman-adv/mesh-interface.c @@ -434,6 +434,7 @@ void batadv_interface_rx(struct net_device *mesh_iface, if (!pskb_may_pull(skb, VLAN_ETH_HLEN)) goto dropped; + ethhdr = eth_hdr(skb); vhdr = skb_vlan_eth_hdr(skb); /* drop batman-in-batman packets to prevent loops */ |