From: Simon Wunderlich <sw@simonwunderlich.de>
To: netdev@vger.kernel.org
Cc: "David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>,
b.a.t.m.a.n@lists.open-mesh.org,
Sven Eckelmann <sven@narfation.org>,
stable@vger.kernel.org, Simon Wunderlich <sw@simonwunderlich.de>
Subject: [PATCH net 2/9] batman-adv: fix VLAN priority offset
Date: Wed, 8 Jul 2026 11:18:14 +0200 [thread overview]
Message-ID: <20260708091821.314516-3-sw@simonwunderlich.de> (raw)
In-Reply-To: <20260708091821.314516-1-sw@simonwunderlich.de>
From: Sven Eckelmann <sven@narfation.org>
The batadv_skb_set_priority() receives an SKB with the inner ethernet
header at position "offset". When it tries to extract the IPv4 and IPv6
header, it needs to skip the ethernet header to get access to the IP
header.
But for VLAN header, it performs the access with the struct vlan_ethhdr.
This struct contains both both the ethernet header and the VLAN header. It
is therefore incorrect to skip over the whole vlan_ethhdr size to get
access to the vlan_ethhdr.
Cc: stable@vger.kernel.org
Fixes: c54f38c9aa22 ("batman-adv: set skb priority according to content")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
net/batman-adv/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index 4d3807a645b78..8844e40e6a803 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -368,7 +368,7 @@ void batadv_skb_set_priority(struct sk_buff *skb, int offset)
switch (ethhdr->h_proto) {
case htons(ETH_P_8021Q):
- vhdr = skb_header_pointer(skb, offset + sizeof(*vhdr),
+ vhdr = skb_header_pointer(skb, offset,
sizeof(*vhdr), &vhdr_tmp);
if (!vhdr)
return;
--
2.47.3
next prev parent reply other threads:[~2026-07-08 9:25 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-08 9:18 [PATCH net 0/9] pull request: batman-adv 2026-07-08 Simon Wunderlich
2026-07-08 9:18 ` [PATCH net 1/9] batman-adv: ensure minimal ethernet header on TX Simon Wunderlich
2026-07-09 9:20 ` patchwork-bot+netdevbpf
2026-07-08 9:18 ` Simon Wunderlich [this message]
2026-07-08 9:18 ` [PATCH net 3/9] batman-adv: clean untagged VLAN on netdev registration failure Simon Wunderlich
2026-07-08 9:18 ` [PATCH net 4/9] batman-adv: tt: avoid request storms during pending request Simon Wunderlich
2026-07-08 9:18 ` [PATCH net 5/9] batman-adv: tt: prevent TVLV OOB check overflow Simon Wunderlich
2026-07-08 9:18 ` [PATCH net 6/9] batman-adv: frag: free unfragmentable packet Simon Wunderlich
2026-07-08 9:18 ` [PATCH net 7/9] batman-adv: frag: fix primary_if leak on failed linearization Simon Wunderlich
2026-07-08 9:18 ` [PATCH net 8/9] batman-adv: mcast: avoid OOB read of num_dests header Simon Wunderlich
2026-07-08 9:18 ` [PATCH net 9/9] batman-adv: dat: fix tie-break for candidate selection Simon Wunderlich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260708091821.314516-3-sw@simonwunderlich.de \
--to=sw@simonwunderlich.de \
--cc=b.a.t.m.a.n@lists.open-mesh.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=stable@vger.kernel.org \
--cc=sven@narfation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox