]> git.ipfire.org Git - thirdparty/linux.git/commit
batman-adv: retrieve ethhdr after potential skb realloc on RX
authorSven Eckelmann <sven@narfation.org>
Sun, 28 Jun 2026 04:44:13 +0000 (06:44 +0200)
committerSven Eckelmann <sven@narfation.org>
Sun, 28 Jun 2026 05:56:46 +0000 (07:56 +0200)
commit035e1fed892d3d06002a73ff73668f618a514644
treed57847fe0f19df0aed1638bffc5d8b4ca25a940c
parent805185b7c7a1069e407b6f7b3bc98e44d415f484
batman-adv: retrieve ethhdr after potential skb realloc on RX

pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind
the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.

This was done correctly for the VLAN header but missed for the ethernet
header which is later used for the TT and AP isolation handling.

Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Fixes: c78296665c3d ("batman-adv: Check skb size before using encapsulated ETH+VLAN header")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
net/batman-adv/mesh-interface.c