]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
batman-adv: access unicast_ttvn skb->data only after skb realloc
authorSven Eckelmann <sven@narfation.org>
Sun, 28 Jun 2026 06:35:35 +0000 (08:35 +0200)
committerSven Eckelmann <sven@narfation.org>
Sun, 28 Jun 2026 07:58:13 +0000 (09:58 +0200)
commit7141990add3f75436f2933cb310654cad3b1e3e9
treebd9bdd36d237da0d00734afab25792fc82ad9530
parent035e1fed892d3d06002a73ff73668f618a514644
batman-adv: access unicast_ttvn skb->data only after skb realloc

The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.

This was done correctly for the ethernet header but missed for the
unicast_packet pointer.

Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: c018ad3de61a ("batman-adv: add the VLAN ID attribute to the TT entry")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
net/batman-adv/routing.c