[B.A.T.M.A.N.] [PATCH] batman-adv: Linearize fragment packets before merge

[B.A.T.M.A.N.] [PATCH] batman-adv: Linearize fragment packets before merge

[Sven Eckelmann]

We access the data inside the skbs of two fragments directly using memmove
during the merge. The data of the skb could span over multiple skb pages. An
direct access without knowledge about the pages would lead to an invalid memory
access.

Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
 batman-adv/unicast.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/batman-adv/unicast.c b/batman-adv/unicast.c
index 6a9ab61..04b152c 100644
--- a/batman-adv/unicast.c
+++ b/batman-adv/unicast.c
@@ -50,6 +50,11 @@ static struct sk_buff *frag_merge_packet(struct list_head *head,
 		skb = tfp->skb;
 	}
 
+	if (skb_linearize(skb) < 0 || skb_linearize(tmp_skb) < 0) {
+		kfree_skb(tfp->skb);
+		return NULL;
+	}
+
 	skb_pull(tmp_skb, sizeof(struct unicast_frag_packet));
 	if (pskb_expand_head(skb, 0, tmp_skb->len, GFP_ATOMIC) < 0) {
 		/* free buffered skb, skb will be freed later */
-- 
1.7.2.3

Re: [B.A.T.M.A.N.] [PATCH] batman-adv: Linearize fragment packets before merge

[Marek Lindner]

On Saturday 05 February 2011 22:41:58 Sven Eckelmann wrote:
> We access the data inside the skbs of two fragments directly using memmove
> during the merge. The data of the skb could span over multiple skb pages.
> An direct access without knowledge about the pages would lead to an
> invalid memory access.

Applied in revision 1933.

Thanks,
Marek

[B.A.T.M.A.N.] pull request: batman-adv 2011-02-08

[Sven Eckelmann]

Hi,

I would like to propose following patch for net-2.6.git/2.6.38 which fixes a
possible kernel oops in the unicast fragmentation code.

thanks,
	Sven

The following changes since commit 1181e1daace88018b2ff66592aa10a4791d705ff:

  batman-adv: Make vis info stack traversal threadsafe (2011-01-30 10:32:08 +0100)

are available in the git repository at:
  git://git.open-mesh.org/ecsv/linux-merge.git batman-adv/merge

Sven Eckelmann (1):
      batman-adv: Linearize fragment packets before merge

 net/batman-adv/unicast.c |   15 ++++++++++-----
 1 files changed, 10 insertions(+), 5 deletions(-)

[B.A.T.M.A.N.] [PATCH] batman-adv: Linearize fragment packets before merge

[Sven Eckelmann]

We access the data inside the skbs of two fragments directly using memmove
during the merge. The data of the skb could span over multiple skb pages. An
direct access without knowledge about the pages would lead to an invalid memory
access.

Signed-off-by: Sven Eckelmann <sven@narfation.org>
[lindner_marek@yahoo.de: Move return from function to the end]
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
---
 net/batman-adv/unicast.c |   15 ++++++++++-----
 1 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/net/batman-adv/unicast.c b/net/batman-adv/unicast.c
index ee41fef..d1a6113 100644
--- a/net/batman-adv/unicast.c
+++ b/net/batman-adv/unicast.c
@@ -50,12 +50,12 @@ static struct sk_buff *frag_merge_packet(struct list_head *head,
 		skb = tfp->skb;
 	}
 
+	if (skb_linearize(skb) < 0 || skb_linearize(tmp_skb) < 0)
+		goto err;
+
 	skb_pull(tmp_skb, sizeof(struct unicast_frag_packet));
-	if (pskb_expand_head(skb, 0, tmp_skb->len, GFP_ATOMIC) < 0) {
-		/* free buffered skb, skb will be freed later */
-		kfree_skb(tfp->skb);
-		return NULL;
-	}
+	if (pskb_expand_head(skb, 0, tmp_skb->len, GFP_ATOMIC) < 0)
+		goto err;
 
 	/* move free entry to end */
 	tfp->skb = NULL;
@@ -70,6 +70,11 @@ static struct sk_buff *frag_merge_packet(struct list_head *head,
 	unicast_packet->packet_type = BAT_UNICAST;
 
 	return skb;
+
+err:
+	/* free buffered skb, skb will be freed later */
+	kfree_skb(tfp->skb);
+	return NULL;
 }
 
 static void frag_create_entry(struct list_head *head, struct sk_buff *skb)
-- 
1.7.2.3