diff mbox

batman-adv: Linearize fragment packets before merge

Message ID 1296942118-4875-1-git-send-email-sven@narfation.org (mailing list archive)
State Accepted, archived
Headers

Commit Message

Sven Eckelmann Feb. 5, 2011, 9:41 p.m. UTC 
  We access the data inside the skbs of two fragments directly using memmove
during the merge. The data of the skb could span over multiple skb pages. An
direct access without knowledge about the pages would lead to an invalid memory
access.

Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
 batman-adv/unicast.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

Comments

Marek Lindner Feb. 6, 2011, 11:24 p.m. UTC | #1 
On Saturday 05 February 2011 22:41:58 Sven Eckelmann wrote:
> We access the data inside the skbs of two fragments directly using memmove
> during the merge. The data of the skb could span over multiple skb pages.
> An direct access without knowledge about the pages would lead to an
> invalid memory access.

Applied in revision 1933.

Thanks,
Marek
diff mbox

Patch

diff --git a/batman-adv/unicast.c b/batman-adv/unicast.c
index 6a9ab61..04b152c 100644
--- a/batman-adv/unicast.c
+++ b/batman-adv/unicast.c
@@ -50,6 +50,11 @@  static struct sk_buff *frag_merge_packet(struct list_head *head,
 		skb = tfp->skb;
 	}
 
+	if (skb_linearize(skb) < 0 || skb_linearize(tmp_skb) < 0) {
+		kfree_skb(tfp->skb);
+		return NULL;
+	}
+
 	skb_pull(tmp_skb, sizeof(struct unicast_frag_packet));
 	if (pskb_expand_head(skb, 0, tmp_skb->len, GFP_ATOMIC) < 0) {
 		/* free buffered skb, skb will be freed later */