batman-adv: frag: ensure fragment is writable before modifying TTL

Before batman-adv is allowed to write to an skb, it either has to have its
own copy of the skb or use skb_cow() to ensure that the data part is not
shared. But batadv_frag_skb_fwd() modifies the TTL even when it is shared.

Adding a skb_cow() right before this operation avoids this and can at the
same time prepare it for the modifications required to forward the
fragment.

Cc: stable@kernel.org
Fixes: 610bfc6bc99b ("batman-adv: Receive fragmented packets and merge")
Signed-off-by: Sven Eckelmann <sven@narfation.org>

diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index 1e42cf99f8b338568068d075d5c0d4a37c7bedbd..f311a42203d2eb8a95b6ff20fcd9be12a71f87ca 100644 (file)
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -386,6 +386,8 @@ out_err:
  * @skb: skb to forward
  * @recv_if: interface that the skb is received on
  * @orig_node_src: originator that the skb is received from
+ * @rx_result: set to NET_RX_SUCCESS when the fragment was forwarded and
+ *  NET_RX_DROP when it was dropped; only valid when true is returned
  *
  * Look up the next-hop of the fragments payload and check if the merged packet
  * will exceed the MTU towards the next-hop. If so, the fragment is forwarded
@@ -395,7 +397,8 @@ out_err:
  */
 bool batadv_frag_skb_fwd(struct sk_buff *skb,
                         struct batadv_hard_iface *recv_if,
-                        struct batadv_orig_node *orig_node_src)
+                        struct batadv_orig_node *orig_node_src,
+                        int *rx_result)
 {
        struct batadv_priv *bat_priv = netdev_priv(recv_if->mesh_iface);
        struct batadv_neigh_node *neigh_node = NULL;
@@ -414,12 +417,22 @@ bool batadv_frag_skb_fwd(struct sk_buff *skb,
         */
        total_size = ntohs(packet->total_size);
        if (total_size > neigh_node->if_incoming->net_dev->mtu) {
+               if (skb_cow(skb, ETH_HLEN) < 0) {
+                       kfree_skb(skb);
+                       *rx_result = NET_RX_DROP;
+                       ret = true;
+                       goto out;
+               }
+
+               packet = (struct batadv_frag_packet *)skb->data;
+
                batadv_inc_counter(bat_priv, BATADV_CNT_FRAG_FWD);
                batadv_add_counter(bat_priv, BATADV_CNT_FRAG_FWD_BYTES,
                                   skb->len + ETH_HLEN);
 
                packet->ttl--;
                batadv_send_unicast_skb(skb, neigh_node);
+               *rx_result = NET_RX_SUCCESS;
                ret = true;
        }
 

diff --git a/net/batman-adv/fragmentation.h b/net/batman-adv/fragmentation.h
index dbf0871f87030344ba14bc56c4b50123c88900ac..51e281027ab6303c00534e3faa46e90d285d5209 100644 (file)
--- a/net/batman-adv/fragmentation.h
+++ b/net/batman-adv/fragmentation.h
@@ -19,7 +19,8 @@ void batadv_frag_purge_orig(struct batadv_orig_node *orig,
                            bool (*check_cb)(struct batadv_frag_table_entry *));
 bool batadv_frag_skb_fwd(struct sk_buff *skb,
                         struct batadv_hard_iface *recv_if,
-                        struct batadv_orig_node *orig_node_src);
+                        struct batadv_orig_node *orig_node_src,
+                        int *rx_result);
 bool batadv_frag_skb_buffer(struct sk_buff **skb,
                            struct batadv_orig_node *orig_node);
 int batadv_frag_send_packet(struct sk_buff *skb,

diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 8786b66c8a924e55216199e4df26a672b5e64ed0..9db57fd36e7d4bbe8a4814ad05343c357e554b30 100644 (file)
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -1168,10 +1168,9 @@ int batadv_recv_frag_packet(struct sk_buff *skb,
 
        /* Route the fragment if it is not for us and too big to be merged. */
        if (!batadv_is_my_mac(bat_priv, frag_packet->dest) &&
-           batadv_frag_skb_fwd(skb, recv_if, orig_node_src)) {
+           batadv_frag_skb_fwd(skb, recv_if, orig_node_src, &ret)) {
                /* skb was consumed */
                skb = NULL;
-               ret = NET_RX_SUCCESS;
                goto put_orig_node;
        }