batman-adv: fix skb->data assignment
authorAntonio Quartulli <ordex@autistici.org>
Thu, 14 Jun 2012 20:21:28 +0000 (22:21 +0200)
committerAntonio Quartulli <ordex@autistici.org>
Mon, 18 Jun 2012 16:00:56 +0000 (18:00 +0200)
commitd2b6cc8e460494251442a877fcbc150faa175b4f
treee6552d7b815c400999ff09e651777a875a3ab074
parent284fefd59ae0357695b17b59cb44d7cc12445bb5
batman-adv: fix skb->data assignment

skb_linearize(skb) possibly rearranges the skb internal data and then changes
the skb->data pointer value. For this reason any other pointer in the code that
was assigned skb->data before invoking skb_linearise(skb) must be re-assigned.

In the current tt_query message handling code this is not done and therefore, in
case of skb linearization, the pointer used to handle the packet header ends up
in pointing to poisoned memory. The packet is then dropped but the
translation-table mechanism is corrupted.

Signed-off-by: Antonio Quartulli <ordex@autistici.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
net/batman-adv/routing.c