diff options
| author | Sven Eckelmann <sven@narfation.org> | 2026-06-28 08:35:35 +0200 |
|---|---|---|
| committer | Sven Eckelmann <sven@narfation.org> | 2026-06-28 09:58:13 +0200 |
| commit | 7141990add3f75436f2933cb310654cad3b1e3e9 (patch) | |
| tree | bd9bdd36d237da0d00734afab25792fc82ad9530 /net | |
| parent | 035e1fed892d3d06002a73ff73668f618a514644 (diff) | |
| download | linux-7141990add3f75436f2933cb310654cad3b1e3e9.tar.gz linux-7141990add3f75436f2933cb310654cad3b1e3e9.zip | |
batman-adv: access unicast_ttvn skb->data only after skb realloc
The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.
This was done correctly for the ethernet header but missed for the
unicast_packet pointer.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: c018ad3de61a ("batman-adv: add the VLAN ID attribute to the TT entry")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/batman-adv/routing.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c index c05fcc9241ad..2cc2307a4170 100644 --- a/net/batman-adv/routing.c +++ b/net/batman-adv/routing.c @@ -855,8 +855,8 @@ static bool batadv_check_unicast_ttvn(struct batadv_priv *bat_priv, if (skb_cow(skb, sizeof(*unicast_packet)) < 0) return false; - unicast_packet = (struct batadv_unicast_packet *)skb->data; vid = batadv_get_vid(skb, hdr_len); + unicast_packet = (struct batadv_unicast_packet *)skb->data; ethhdr = (struct ethhdr *)(skb->data + hdr_len); /* do not reroute multicast frames in a unicast header */ |