From patchwork Sat Feb 5 21:41:58 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sven Eckelmann X-Patchwork-Id: 770 Return-Path: Received: from v3-1039.vlinux.de (narfation.org [79.140.41.39]) by open-mesh.org (Postfix) with ESMTPS id C50D715415F for ; Sat, 5 Feb 2011 22:42:04 +0100 (CET) Received: from sven-desktop.home.narfation.org (i59F6AC99.versanet.de [89.246.172.153]) by v3-1039.vlinux.de (Postfix) with ESMTPSA id 1B3579408F; Sat, 5 Feb 2011 22:42:37 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=narfation.org; s=mail; t=1296942157; bh=tX5t9/095W2QUOUecxsFEIvKbHelxl7fD5jLPcWsF30=; h=From:To:Cc:Subject:Date:Message-Id; b=l/yCVY6gLLqclhTICSW+vbDSGpluiUgEduRVMjsy5eyyrRwBMA+Qa5viFyWefkSyf TrB71yRzVrqmxlPDdoTNqTXkRDLhkXm3gXKlOkRJu2jNwAoFofF7Q9GJoPLfDCBjHu mGUT5S7R9gh3GsNwBc9AtJNZnQeyyhreuuHHGMFU= From: Sven Eckelmann To: b.a.t.m.a.n@lists.open-mesh.org Date: Sat, 5 Feb 2011 22:41:58 +0100 Message-Id: <1296942118-4875-1-git-send-email-sven@narfation.org> X-Mailer: git-send-email 1.7.2.3 Subject: [B.A.T.M.A.N.] [PATCH] batman-adv: Linearize fragment packets before merge X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.11 Precedence: list Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 05 Feb 2011 21:42:04 -0000 We access the data inside the skbs of two fragments directly using memmove during the merge. The data of the skb could span over multiple skb pages. An direct access without knowledge about the pages would lead to an invalid memory access. Signed-off-by: Sven Eckelmann --- batman-adv/unicast.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/batman-adv/unicast.c b/batman-adv/unicast.c index 6a9ab61..04b152c 100644 --- a/batman-adv/unicast.c +++ b/batman-adv/unicast.c @@ -50,6 +50,11 @@ static struct sk_buff *frag_merge_packet(struct list_head *head, skb = tfp->skb; } + if (skb_linearize(skb) < 0 || skb_linearize(tmp_skb) < 0) { + kfree_skb(tfp->skb); + return NULL; + } + skb_pull(tmp_skb, sizeof(struct unicast_frag_packet)); if (pskb_expand_head(skb, 0, tmp_skb->len, GFP_ATOMIC) < 0) { /* free buffered skb, skb will be freed later */