From patchwork Fri Jul 26 18:50:46 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Linus_L=C3=BCssing?= X-Patchwork-Id: 3238 Return-Path: Received: from mout.web.de (mout.web.de [212.227.17.12]) by open-mesh.org (Postfix) with ESMTP id ABB086006D9 for ; Fri, 26 Jul 2013 20:51:20 +0200 (CEST) Received: from localhost ([46.246.33.183]) by smtp.web.de (mrweb103) with ESMTPSA (Nemesis) id 0M57Vi-1UAA9p1DuY-00zJq4 for ; Fri, 26 Jul 2013 20:51:20 +0200 From: =?UTF-8?q?Linus=20L=C3=BCssing?= To: b.a.t.m.a.n@lists.open-mesh.org Date: Fri, 26 Jul 2013 20:50:46 +0200 Message-Id: <1374864646-19268-2-git-send-email-linus.luessing@web.de> X-Mailer: git-send-email 1.8.3.2 In-Reply-To: <1374864646-19268-1-git-send-email-linus.luessing@web.de> References: <1374864646-19268-1-git-send-email-linus.luessing@web.de> MIME-Version: 1.0 X-Provags-ID: V03:K0:IplWHUcf8vIlWXOT4BXOgn3jvojsYEqLICtN+8RO9UYz5MrjjAM Qp1wWn7PHh6PdemJ7SZOn0Fby4gUWfgj5gly3KTirEWWGDbaLMl6qxZ7YtFY5NQEZjC2YnI fAKSm4nbrCIZb4G89XrI7+Z/bmECrNZc24nA6+82N12yb0I2fpinQ0wQC5BYJz4TGmlhpmh W+4lRrC67/dKJiBHtKZZg== Subject: [B.A.T.M.A.N.] [PATCH 2/2] batman-adv: fix potential kernel paging error for unicast transmissions X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jul 2013 18:51:20 -0000 batadv_send_skb_prepare_unicast(_4addr) might reallocate the skb's data. If it does then our ethhdr pointer is not valid anymore in batadv_send_skb_unicast(), resulting in a kernel paging error. This patch fixes this issue by storing the few bytes we are interested in on the stack before modifying the skb. Signed-off-by: Linus Lüssing --- send.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/send.c b/send.c index 9c9cab6..b9a1f15 100644 --- a/send.c +++ b/send.c @@ -257,13 +257,15 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv, struct batadv_orig_node *orig_node, unsigned short vid) { - struct ethhdr *ethhdr = (struct ethhdr *)skb->data; + uint8_t dest[ETH_ALEN]; struct batadv_unicast_packet *unicast_packet; int ret = NET_XMIT_DROP; if (!orig_node) goto out; + memcpy(dest, ((struct ethhdr *)skb->data)->h_dest, sizeof(dest)); + switch (packet_type) { case BATADV_UNICAST: if (!batadv_send_skb_prepare_unicast(skb, orig_node)) @@ -289,7 +291,7 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv, * try to reroute it because the ttvn contained in the header is less * than the current one */ - if (batadv_tt_global_client_is_roaming(bat_priv, ethhdr->h_dest, vid)) + if (batadv_tt_global_client_is_roaming(bat_priv, dest, vid)) unicast_packet->ttvn = unicast_packet->ttvn - 1; if (batadv_send_skb_to_orig(skb, orig_node, NULL) != NET_XMIT_DROP)