averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-09-22 09:34:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

batman-adv: dat: acquire ARP hw source only after skb realloc

Browse Source 
commit 48067b2ae4 upstream.

The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.

Cc: stable@vger.kernel.org
Fixes: b61ec31c85 ("batman-adv: Snoop DHCPACKs for DAT")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Sven Eckelmann
2026-07-24 16:03:33 +02:00
committed by Greg Kroah-Hartman
parent ed90eb5c68
commit 3404be97b9
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/batman-adv/distributed-arp-table.c
+4 -1
View File
@@ -1758,6 +1758,7 @@ void batadv_dat_snoop_incoming_dhcp_ack(struct batadv_priv *bat_priv,
struct ethhdr *ethhdr;
__be32 ip_src, yiaddr;
unsigned short vid;
int hdr_size_tmp;
__be16 proto;
u8 *hw_src;
@@ -1774,8 +1775,10 @@ void batadv_dat_snoop_incoming_dhcp_ack(struct batadv_priv *bat_priv,
if (!batadv_dat_check_dhcp_ack(skb, proto, &ip_src, chaddr, &yiaddr))
return;
hdr_size_tmp = hdr_size;
vid = batadv_dat_get_vid(skb, &hdr_size_tmp);
ethhdr = (struct ethhdr *)(skb->data + hdr_size);
hw_src = ethhdr->h_source;
vid = batadv_dat_get_vid(skb, &hdr_size);
batadv_dat_entry_add(bat_priv, yiaddr, chaddr, vid);
batadv_dat_entry_add(bat_priv, ip_src, hw_src, vid);