averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-08-09 06:14:34 +02:00
Code Issues Packages Projects Releases Wiki Activity

batman-adv: frag: avoid underflow of TTL

Browse Source 
commit 493d9d2528 upstream.

Packets with a TTL are using it to limit the amount of time this packet can
be forwarded. But for batadv_frag_packet, the TTL was always only reduced
but it was never evaluated. It could even underflow without any effect.

Check the TTL in batadv_frag_skb_fwd() before attempting to prepare it for
forwarding. This keeps it in sync with the not fragmented unicast packet.

Cc: stable@kernel.org
Fixes: 610bfc6bc9 ("batman-adv: Receive fragmented packets and merge")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Sven Eckelmann
2026-07-04 13:41:30 +02:00
committed by Greg Kroah-Hartman
parent ab369207cd
commit dbd0dc4bd0
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/batman-adv/fragmentation.c
+7
View File
@@ -420,6 +420,13 @@ bool batadv_frag_skb_fwd(struct sk_buff *skb,
*/
total_size = ntohs(packet->total_size);
if (total_size > neigh_node->if_incoming->net_dev->mtu) {
if (packet->ttl < 2) {
kfree_skb(skb);
*rx_result = NET_RX_DROP;
ret = true;
goto out;
}
if (skb_cow(skb, ETH_HLEN) < 0) {
kfree_skb(skb);
*rx_result = NET_RX_DROP;