From: Sven Eckelmann <sven@narfation.org>
Date: Sun, 28 Jun 2026 06:45:41 +0000 (+0200)
Subject: batman-adv: bla: reacquire gw address after skb realloc
X-Git-Tag: v7.2-rc2~22^2^2~1
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=cdf3b5af2bc4431e58629e8ad2086b1e9185c761;p=thirdparty%2Flinux.git

batman-adv: bla: reacquire gw address after skb realloc

The pskb_may_pull() called by batadv_bla_is_backbone_gw() could reallocate
the buffer behind the skb. Variables which were pointing to the old buffer
need to be reassigned to avoid an use-after-free.

Cc: stable@vger.kernel.org
Fixes: 9e794b6bf4a2 ("batman-adv: drop unicast packets from other backbone gw")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
---

diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 2cc2307a4170..bbd40fe3a8e5 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -1029,6 +1029,7 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
 							  hdr_size);
 			batadv_orig_node_put(orig_node_gw);
 			if (is_gw) {
+				orig_addr_gw = eth_hdr(skb)->h_source;
 				batadv_dbg(BATADV_DBG_BLA, bat_priv,
 					   "%s(): Dropped unicast pkt received from another backbone gw %pM.\n",
 					   __func__, orig_addr_gw);