diff options
| author | Sven Eckelmann <sven@narfation.org> | 2018-12-31 22:31:01 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-02-15 08:10:13 +0100 |
| commit | 4dd911f1e38e69329cda3386ca600b200af0ebcf (patch) | |
| tree | 0f90ad56f00c4d4f7701326e233d38ec914ddfce | |
| parent | a21222305015312ca569a86d8bbf389a41dc8798 (diff) | |
| download | linux-stable-4dd911f1e38e69329cda3386ca600b200af0ebcf.tar.gz linux-stable-4dd911f1e38e69329cda3386ca600b200af0ebcf.tar.bz2 linux-stable-4dd911f1e38e69329cda3386ca600b200af0ebcf.zip | |
batman-adv: Force mac header to start of data on xmit
commit 9114daa825fc3f335f9bea3313ce667090187280 upstream.
The caller of ndo_start_xmit may not already have called
skb_reset_mac_header. The returned value of skb_mac_header/eth_hdr
therefore can be in the wrong position and even outside the current skbuff.
This for example happens when the user binds to the device using a
PF_PACKET-SOCK_RAW with enabled qdisc-bypass:
int opt = 4;
setsockopt(sock, SOL_PACKET, PACKET_QDISC_BYPASS, &opt, sizeof(opt));
Since eth_hdr is used all over the codebase, the batadv_interface_tx
function must always take care of resetting it.
Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Reported-by: syzbot+9d7405c7faa390e60b4e@syzkaller.appspotmail.com
Reported-by: syzbot+7d20bc3f1ddddc0f9079@syzkaller.appspotmail.com
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/batman-adv/soft-interface.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c index 626ddca332db..3899fa6e201d 100644 --- a/net/batman-adv/soft-interface.c +++ b/net/batman-adv/soft-interface.c @@ -221,6 +221,8 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb, netif_trans_update(soft_iface); vid = batadv_get_vid(skb, 0); + + skb_reset_mac_header(skb); ethhdr = eth_hdr(skb); switch (ntohs(ethhdr->h_proto)) { |