diff options
| author | Sven Eckelmann <sven@narfation.org> | 2026-06-28 08:45:41 +0200 |
|---|---|---|
| committer | Sven Eckelmann <sven@narfation.org> | 2026-06-28 09:58:29 +0200 |
| commit | 48067b2ae4504500a7093d9e1e16b42e70330480 (patch) | |
| tree | 2836acb5da2e44aec92478d3c69b16c870621abe /net | |
| parent | 77880a3be88d378d60cc1e8f8ec70430e2ed0518 (diff) | |
| download | linux-2.6-48067b2ae4504500a7093d9e1e16b42e70330480.tar.gz linux-2.6-48067b2ae4504500a7093d9e1e16b42e70330480.zip | |
batman-adv: dat: acquire ARP hw source only after skb realloc
The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.
Cc: stable@vger.kernel.org
Fixes: b61ec31c8575 ("batman-adv: Snoop DHCPACKs for DAT")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/batman-adv/distributed-arp-table.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c index ae39ceaa2e29..ead02c9e0848 100644 --- a/net/batman-adv/distributed-arp-table.c +++ b/net/batman-adv/distributed-arp-table.c @@ -1747,6 +1747,7 @@ void batadv_dat_snoop_incoming_dhcp_ack(struct batadv_priv *bat_priv, struct ethhdr *ethhdr; __be32 ip_src, yiaddr; unsigned short vid; + int hdr_size_tmp; __be16 proto; u8 *hw_src; @@ -1763,8 +1764,10 @@ void batadv_dat_snoop_incoming_dhcp_ack(struct batadv_priv *bat_priv, if (!batadv_dat_check_dhcp_ack(skb, proto, &ip_src, chaddr, &yiaddr)) return; + hdr_size_tmp = hdr_size; + vid = batadv_dat_get_vid(skb, &hdr_size_tmp); + ethhdr = (struct ethhdr *)(skb->data + hdr_size); hw_src = ethhdr->h_source; - vid = batadv_dat_get_vid(skb, &hdr_size); batadv_dat_entry_add(bat_priv, yiaddr, chaddr, vid); batadv_dat_entry_add(bat_priv, ip_src, hw_src, vid); |