• Antonio Quartulli's avatar
    batman-adv: fix skb->data assignment · d2b6cc8e
    Antonio Quartulli authored
    skb_linearize(skb) possibly rearranges the skb internal data and then changes
    the skb->data pointer value. For this reason any other pointer in the code that
    was assigned skb->data before invoking skb_linearise(skb) must be re-assigned.
    
    In the current tt_query message handling code this is not done and therefore, in
    case of skb linearization, the pointer used to handle the packet header ends up
    in pointing to poisoned memory. The packet is then dropped but the
    translation-table mechanism is corrupted.
    Signed-off-by: default avatarAntonio Quartulli <ordex@autistici.org>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
    d2b6cc8e
routing.c 30.1 KB