korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-24 20:54:10 +08:00
Code Issues Packages Projects Releases Wiki Activity

batman-adv: Linearize fragment packets before merge

Browse Source 
We access the data inside the skbs of two fragments directly using memmove
during the merge. The data of the skb could span over multiple skb pages. An
direct access without knowledge about the pages would lead to an invalid memory
access.

Signed-off-by: Sven Eckelmann <sven@narfation.org>
[lindner_marek@yahoo.de: Move return from function to the end]
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
This commit is contained in:
Sven Eckelmann 2011-02-06 23:26:43 +00:00
parent 1181e1daac
commit 531c9da8c8
1 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
net/batman-adv/unicast.c
View File

@ -50,12 +50,12 @@ static struct sk_buff *frag_merge_packet(struct list_head *head,
skb = tfp->skb; skb = tfp->skb;
} }
if (skb_linearize(skb) < 0 || skb_linearize(tmp_skb) < 0)
goto err;
skb_pull(tmp_skb, sizeof(struct unicast_frag_packet)); skb_pull(tmp_skb, sizeof(struct unicast_frag_packet));
if (pskb_expand_head(skb, 0, tmp_skb->len, GFP_ATOMIC) < 0) { if (pskb_expand_head(skb, 0, tmp_skb->len, GFP_ATOMIC) < 0)
/* free buffered skb, skb will be freed later */ goto err;
kfree_skb(tfp->skb);
return NULL;
}
/* move free entry to end */ /* move free entry to end */
tfp->skb = NULL; tfp->skb = NULL;
@ -70,6 +70,11 @@ static struct sk_buff *frag_merge_packet(struct list_head *head,
unicast_packet->packet_type = BAT_UNICAST; unicast_packet->packet_type = BAT_UNICAST;
return skb; return skb;
err:
/* free buffered skb, skb will be freed later */
kfree_skb(tfp->skb);
return NULL;
} }
static void frag_create_entry(struct list_head *head, struct sk_buff *skb) static void frag_create_entry(struct list_head *head, struct sk_buff *skb)