From: Antonio Quartulli Date: Sat, 15 Feb 2014 20:50:37 +0000 (+0100) Subject: batman-adv: fix potential kernel paging error for unicast transmissions X-Git-Tag: v3.13.6~101 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=944734c3d3554e6776f7c5a570abb572492e3988;p=thirdparty%2Fkernel%2Fstable.git batman-adv: fix potential kernel paging error for unicast transmissions [ Upstream commit 70b271a78beba787155d6696aacd7c4d4a251c50 ] batadv_send_skb_prepare_unicast(_4addr) might reallocate the skb's data. If it does then our ethhdr pointer is not valid anymore in batadv_send_skb_unicast(), resulting in a kernel paging error. Fixing this by refetching the ethhdr pointer after the potential reallocation. Signed-off-by: Linus Lüssing Signed-off-by: Antonio Quartulli Signed-off-by: Greg Kroah-Hartman --- diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c index fba4dcfcfac21..81b1dbe79b70f 100644 --- a/net/batman-adv/send.c +++ b/net/batman-adv/send.c @@ -256,9 +256,9 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv, struct batadv_orig_node *orig_node, unsigned short vid) { - struct ethhdr *ethhdr = (struct ethhdr *)skb->data; + struct ethhdr *ethhdr; struct batadv_unicast_packet *unicast_packet; - int ret = NET_XMIT_DROP; + int ret = NET_XMIT_DROP, hdr_size; if (!orig_node) goto out; @@ -267,12 +267,16 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv, case BATADV_UNICAST: if (!batadv_send_skb_prepare_unicast(skb, orig_node)) goto out; + + hdr_size = sizeof(*unicast_packet); break; case BATADV_UNICAST_4ADDR: if (!batadv_send_skb_prepare_unicast_4addr(bat_priv, skb, orig_node, packet_subtype)) goto out; + + hdr_size = sizeof(struct batadv_unicast_4addr_packet); break; default: /* this function supports UNICAST and UNICAST_4ADDR only. It @@ -281,6 +285,7 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv, goto out; } + ethhdr = (struct ethhdr *)(skb->data + hdr_size); unicast_packet = (struct batadv_unicast_packet *)skb->data; /* inform the destination node that we are still missing a correct route