From patchwork Mon Feb 7 23:59:21 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sven Eckelmann X-Patchwork-Id: 774 Return-Path: Received: from v3-1039.vlinux.de (narfation.org [79.140.41.39]) by open-mesh.org (Postfix) with ESMTPS id 5979A154316 for ; Tue, 8 Feb 2011 00:59:33 +0100 (CET) Received: from sven-desktop.home.narfation.org (i59F6AA24.versanet.de [89.246.170.36]) by v3-1039.vlinux.de (Postfix) with ESMTPSA id A964D940AD; Tue, 8 Feb 2011 01:00:10 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=narfation.org; s=mail; t=1297123211; bh=QUGhVbXsyHDdtxy3Ytor/sEkurXKL/1F5e0PLRYEDH8=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References; b=FxJVwyU5JwiDYiV/Ayj+N/9z0GIjvAO/GM608ob50ZVQ/5Fk+aSVpuDR96rdeZNWt o2V4AZM/nOg8mC7EVGfyeE68rLq1QiVgDaQ3JAe7MfLsYEY7Mr1q5rBQNjlhjva4LW OfTVF6+WR/JofI0n331Wsca5XNoNO/ixMpfc1QXc= From: Sven Eckelmann To: davem@davemloft.net Date: Tue, 8 Feb 2011 00:59:21 +0100 Message-Id: <1297123161-25612-2-git-send-email-sven@narfation.org> X-Mailer: git-send-email 1.7.2.3 In-Reply-To: <1297123161-25612-1-git-send-email-sven@narfation.org> References: <1297123161-25612-1-git-send-email-sven@narfation.org> Cc: netdev@vger.kernel.org, b.a.t.m.a.n@lists.open-mesh.org, Marek Lindner Subject: [B.A.T.M.A.N.] [PATCH] batman-adv: Linearize fragment packets before merge X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Feb 2011 23:59:35 -0000 We access the data inside the skbs of two fragments directly using memmove during the merge. The data of the skb could span over multiple skb pages. An direct access without knowledge about the pages would lead to an invalid memory access. Signed-off-by: Sven Eckelmann [lindner_marek@yahoo.de: Move return from function to the end] Signed-off-by: Marek Lindner --- net/batman-adv/unicast.c | 15 ++++++++++----- 1 files changed, 10 insertions(+), 5 deletions(-) diff --git a/net/batman-adv/unicast.c b/net/batman-adv/unicast.c index ee41fef..d1a6113 100644 --- a/net/batman-adv/unicast.c +++ b/net/batman-adv/unicast.c @@ -50,12 +50,12 @@ static struct sk_buff *frag_merge_packet(struct list_head *head, skb = tfp->skb; } + if (skb_linearize(skb) < 0 || skb_linearize(tmp_skb) < 0) + goto err; + skb_pull(tmp_skb, sizeof(struct unicast_frag_packet)); - if (pskb_expand_head(skb, 0, tmp_skb->len, GFP_ATOMIC) < 0) { - /* free buffered skb, skb will be freed later */ - kfree_skb(tfp->skb); - return NULL; - } + if (pskb_expand_head(skb, 0, tmp_skb->len, GFP_ATOMIC) < 0) + goto err; /* move free entry to end */ tfp->skb = NULL; @@ -70,6 +70,11 @@ static struct sk_buff *frag_merge_packet(struct list_head *head, unicast_packet->packet_type = BAT_UNICAST; return skb; + +err: + /* free buffered skb, skb will be freed later */ + kfree_skb(tfp->skb); + return NULL; } static void frag_create_entry(struct list_head *head, struct sk_buff *skb)