Skip to content

Commit

Permalink
batman-adv: Force mac header to start of data on xmit
Browse files Browse the repository at this point in the history 
commit 9114daa upstream.

The caller of ndo_start_xmit may not already have called
skb_reset_mac_header. The returned value of skb_mac_header/eth_hdr
therefore can be in the wrong position and even outside the current skbuff.
This for example happens when the user binds to the device using a
PF_PACKET-SOCK_RAW with enabled qdisc-bypass:

  int opt = 4;
  setsockopt(sock, SOL_PACKET, PACKET_QDISC_BYPASS, &opt, sizeof(opt));

Since eth_hdr is used all over the codebase, the batadv_interface_tx
function must always take care of resetting it.

Fixes: c6c8fea ("net: Add batman-adv meshing protocol")
Reported-by: syzbot+9d7405c7faa390e60b4e@syzkaller.appspotmail.com
Reported-by: syzbot+7d20bc3f1ddddc0f9079@syzkaller.appspotmail.com
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Sven Eckelmann authored and Greg Kroah-Hartman committed Feb 15, 2019
1 parent a5a1ce4 commit 1474d65
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions net/batman-adv/soft-interface.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -211,6 +211,8 @@ static int batadv_interface_tx(struct sk_buff *skb,

netif_trans_update(soft_iface);
vid = batadv_get_vid(skb, 0);

skb_reset_mac_header(skb);
ethhdr = eth_hdr(skb);

switch (ntohs(ethhdr->h_proto)) {
Expand Down

0 comments on commit 1474d65

Please sign in to comment.