Re: [B.A.T.M.A.N.] [PATCH] batman-adv: fix skb->data assignment

[Antonio Quartulli <ordex@autistici.org>]

[-- Attachment #1: Type: text/plain, Size: 1334 bytes --]

On Fri, Jun 15, 2012 at 01:45:11PM +0200, Sven Eckelmann wrote:
> On Thursday 14 June 2012 22:21:28 Antonio Quartulli wrote:
> > skb_linearize(skb) possibly rearranges the skb internal data and then
> > changes the skb->data pointer value. For this reason any other pointer in
> > the code that was assigned skb->data before invoking skb_linearise(skb)
> > must be re-assigned.
> > 
> > In the current tt_query message handling code this is not done and
> > therefore, in case of skb linearization, the pointer used to handle the
> > packet header ends up in pointing to poisoned memory. The packet is then
> > dropped but the translation-table mechanism is corrupted.
> > 
> > Signed-off-by: Antonio Quartulli <ordex@autistici.org>
> > ---
> > 
> > *** this patch is an important fix and it is for maint ***
> 
> Don't forget to add 
> 
> Cc: stable <stable@vger.kernel.org>
> 
> to the patch and a small explanation since when the bug is there (I guess 
> v3.1) and that it may lead to crashes and not only poisened memory (that is 
> the best case.. but maybe the page was removed and we end up in hell when 
> accessing the memory region).

Hi Sven,

Thank you for your suggestions. Sure, I will.

Regards,


-- 
Antonio Quartulli

..each of us alone is worth nothing..
Ernesto "Che" Guevara

[-- Attachment #2: Type: application/pgp-signature, Size: 198 bytes --]