Sven Eckelmann d7d8bbb40a batman-adv: Expand merged fragment buffer for full packet ... The complete size ("total_size") of the fragmented packet is stored in the fragment header and in the size of the fragment chain. When the fragments are ready for merge, the skbuff's tail of the first fragment is expanded to have enough room after the data pointer for at least total_size. This means that it gets expanded by total_size - first_skb->len. But this is ignoring the fact that after expanding the buffer, the fragment header is pulled by from this buffer. Assuming that the tailroom of the buffer was already 0, the buffer after the data pointer of the skbuff is now only total_size - len(fragment_header) large. When the merge function is then processing the remaining fragments, the code to copy the data over to the merged skbuff will cause an skb_over_panic when it tries to actually put enough data to fill the total_size bytes of the packet. The size of the skb_pull must therefore also be taken into account when the buffer's tailroom is expanded. Fixes: 610bfc6bc9 ("batman-adv: Receive fragmented packets and merge") Reported-by: Martin Weinelt <martin@darmstadt.freifunk.net> Co-authored-by: Linus Lüssing <linus.luessing@c0d3.blue> Signed-off-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>		2018-11-12 10:41:29 +01:00
..
6lowpan	6lowpan: iphc: reset mac_header after decompress to fix panic	2018-07-06 12:32:12 +02:00
9p	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-03 10:35:52 -07:00
802
8021q	netpoll: allow cleanup to be synchronous	2018-10-19 17:01:43 -07:00
appletalk	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
atm	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
ax25	ax25: remove blank line at EOF	2018-07-24 14:10:42 -07:00
batman-adv	batman-adv: Expand merged fragment buffer for full packet	2018-11-12 10:41:29 +01:00
bluetooth	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-01 19:58:52 -07:00
bpf	bpf: add tests for direct packet access from CGROUP_SKB	2018-10-19 13:49:34 -07:00
bpfilter	net: bpfilter: Set user mode helper's command line	2018-10-22 19:37:36 -07:00
bridge	net: bridge: remove ipv6 zero address check in mcast queries	2018-10-28 19:18:09 -07:00
caif	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
can	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
ceph	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-01 19:58:52 -07:00
core	rtnetlink: Disallow FDB configuration for non-Ethernet device	2018-10-29 20:52:35 -07:00
dcb	net: dcb: Add priority-to-DSCP map getters	2018-07-27 13:17:50 -07:00
dccp	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
decnet	decnet: Remove unnecessary check for dev->name	2018-09-21 19:48:36 -07:00
dns_resolver	dns: Allow the dns resolver to retrieve a server set	2018-10-04 09:40:52 -07:00
dsa	net: dsa: legacy: simplify getting .driver_data	2018-10-22 19:49:04 -07:00
ethernet	net: Convert GRO SKB handling to list_head.	2018-06-26 11:33:04 +09:00
hsr
ieee802154	net/ipfrag: let ip[6]frag_high_thresh in ns be higher than in init_net	2018-09-21 19:45:52 -07:00
ife
ipv4	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-11-01 09:16:01 -07:00
ipv6	net: allow traceroute with a specified interface in a vrf	2018-10-26 16:03:08 -07:00
iucv	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
kcm	Revert "kcm: remove any offset before parsing messages"	2018-09-17 18:43:42 -07:00
key	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2018-07-27 09:33:37 -07:00
l2tp	l2tp: fix unused function warning	2018-08-13 20:45:49 -07:00
l3mdev
lapb
llc	llc: do not use sk_eat_skb()	2018-10-22 19:59:20 -07:00
mac80211	mac80211: implement ieee80211_tx_rate_update to update rate	2018-10-12 13:05:40 +02:00
mac802154	mac802154: Remove VLA usage of skcipher	2018-09-28 12:46:07 +08:00
mpls	net/mpls: Handle kernel side filtering of route dumps	2018-10-16 00:14:07 -07:00
ncsi	net/ncsi: Add NCSI Broadcom OEM command	2018-10-17 22:14:54 -07:00
netfilter	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-01 19:58:52 -07:00
netlabel	netlabel: check for IPV4MASK in addrinfo_get	2018-09-21 18:58:34 -07:00
netlink	netlink: Add answer_flags to netlink_callback	2018-10-16 00:13:12 -07:00
netrom	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
nfc	Merge branch 'work.tty-ioctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-10-24 14:43:41 +01:00
nsh	nsh: set mac len based on inner packet	2018-07-12 16:55:29 -07:00
openvswitch	openvswitch: Fix push/pop ethernet validation	2018-10-31 18:37:16 -07:00
packet	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-10-06 14:43:42 -07:00
phonet	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
psample
qrtr	net: qrtr: Reset the node and port ID of broadcast messages	2018-07-05 20:20:03 +09:00
rds	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-10-12 21:38:46 -07:00
rfkill	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-09-04 21:33:03 -07:00
rose	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
rxrpc	Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2018-10-25 16:43:35 -07:00
sched	net: sched: gred: pass the right attribute to gred_change_table_def()	2018-10-28 19:23:26 -07:00
sctp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-11-01 09:16:01 -07:00
smc	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-01 19:58:52 -07:00
strparser	bpf, sockmap: convert to generic sk_msg interface	2018-10-15 12:23:19 -07:00
sunrpc	NFS client bugfixes for Linux 4.20	2018-11-04 08:20:09 -08:00
switchdev
tipc	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-01 19:58:52 -07:00
tls	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-01 19:58:52 -07:00
unix	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
vmw_vsock	vsock: split dwork to avoid reinitializations	2018-08-07 12:39:13 -07:00
wimax	wimax: remove blank lines at EOF	2018-07-24 14:10:42 -07:00
wireless	nl80211: Add per peer statistics to compute FCS error rate	2018-10-12 12:56:34 +02:00
x25	x25: remove blank lines at EOF	2018-07-24 14:10:42 -07:00
xdp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-10-19 11:03:06 -07:00
xfrm	Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-11-03 18:25:17 -07:00
compat.c	y2038: socket: Change recvmmsg to use __kernel_timespec	2018-08-29 15:42:24 +02:00
Kconfig	bpf, sockmap: convert to generic sk_msg interface	2018-10-15 12:23:19 -07:00
Makefile	bpfilter: check compiler capability in Kconfig	2018-06-28 13:36:39 +09:00
socket.c	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-01 19:58:52 -07:00
sysctl_net.c