Re: [PATCH batadv 3/3] batman-adv: mcast: linearize skbuff for packet generation

[Sven Eckelmann <sven@narfation.org>]

[-- Attachment #1: Type: text/plain, Size: 1857 bytes --]

On Thursday, 9 July 2026 21:45:57 CEST Sven Eckelmann wrote:
> batadv_mcast_forw_packet() is not only called by the unsharing+linearizing
> batadv_recv_mcast_packet() handler. When it is called by
> batadv_mcast_forw_mcsend() then it will be unshared but not linearized. The
> SKB_LINEAR_ASSERT() can therefore cause a fatal BUG().
> 
> The batadv_mcast_forw_packet() must handle the linearization itself.
> 
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Fixes: 8ed36122d709 ("batman-adv: mcast: implement multicast packet reception and forwarding")
> Signed-off-by: Sven Eckelmann <sven@narfation.org>
> ---
>  net/batman-adv/multicast_forw.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/net/batman-adv/multicast_forw.c b/net/batman-adv/multicast_forw.c
> index c5b8e2e3..9fbd2876 100644
> --- a/net/batman-adv/multicast_forw.c
> +++ b/net/batman-adv/multicast_forw.c
> @@ -937,8 +937,10 @@ static int batadv_mcast_forw_packet(struct batadv_priv *bat_priv,
>  	u8 *dest;
>  	int ret;
>  
> -	/* (at least) TVLV part needs to be linearized */
> -	SKB_LINEAR_ASSERT(skb);
> +	/* packet needs to be linearized to access the tvlv content */
> +	ret = skb_linearize(skb);
> +	if (ret < 0)
> +		return -ENOMEM;
>  
>  	/* check if batadv_tvlv_mcast_tracker header is within skb length */
>  	if (sizeof(*mcast_tracker) > skb_network_header_len(skb))
> 
> 

We might move this to the same place as the skb_cow fix (see patch 2) because 
batadv_mcast_forw_scrape() has also this assert and following unlinearized-skb 
callchain exists:


batadv_interface_tx
batadv_mcast_forw_mode
batadv_mcast_forw_mode_by_count
batadv_mcast_forw_push
batadv_mcast_forw_push_tvlvs
batadv_mcast_forw_push_dests
batadv_mcast_forw_push_adjust_padding
batadv_mcast_forw_scrape


And this is called before batadv_mcast_forw_packet

Regards,
	Sven

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 228 bytes --]