diff options
| author | Sven Eckelmann <sven@narfation.org> | 2026-06-28 08:45:41 +0200 |
|---|---|---|
| committer | Sven Eckelmann <sven@narfation.org> | 2026-06-28 09:58:34 +0200 |
| commit | cdf3b5af2bc4431e58629e8ad2086b1e9185c761 (patch) | |
| tree | 2a2403beaf12c9992cedf8fcddec6740253aa32f /net | |
| parent | 48067b2ae4504500a7093d9e1e16b42e70330480 (diff) | |
| download | linux-cdf3b5af2bc4431e58629e8ad2086b1e9185c761.tar.gz linux-cdf3b5af2bc4431e58629e8ad2086b1e9185c761.zip | |
batman-adv: bla: reacquire gw address after skb realloc
The pskb_may_pull() called by batadv_bla_is_backbone_gw() could reallocate
the buffer behind the skb. Variables which were pointing to the old buffer
need to be reassigned to avoid an use-after-free.
Cc: stable@vger.kernel.org
Fixes: 9e794b6bf4a2 ("batman-adv: drop unicast packets from other backbone gw")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/batman-adv/routing.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c index 2cc2307a4170..bbd40fe3a8e5 100644 --- a/net/batman-adv/routing.c +++ b/net/batman-adv/routing.c @@ -1029,6 +1029,7 @@ int batadv_recv_unicast_packet(struct sk_buff *skb, hdr_size); batadv_orig_node_put(orig_node_gw); if (is_gw) { + orig_addr_gw = eth_hdr(skb)->h_source; batadv_dbg(BATADV_DBG_BLA, bat_priv, "%s(): Dropped unicast pkt received from another backbone gw %pM.\n", __func__, orig_addr_gw); |