Merge pull request #443 from ecsv/batadv-17.01

[feed/routing.git] / batman-adv / patches / 0059-batman-adv-Force-mac-header-to-start-of-data-on-xmit.patch

diff --git a/batman-adv/patches/0059-batman-adv-Force-mac-header-to-start-of-data-on-xmit.patch b/batman-adv/patches/0059-batman-adv-Force-mac-header-to-start-of-data-on-xmit.patch
new file mode 100644 (file)
index 0000000..dba1826
--- /dev/null
+++ b/batman-adv/patches/0059-batman-adv-Force-mac-header-to-start-of-data-on-xmit.patch
@@ -0,0 +1,39 @@
+From: Sven Eckelmann <sven@narfation.org>
+Date: Mon, 31 Dec 2018 22:46:09 +0100
+Subject: [PATCH] batman-adv: Force mac header to start of data on xmit
+
+The caller of ndo_start_xmit may not already have called
+skb_reset_mac_header. The returned value of skb_mac_header/eth_hdr
+therefore can be in the wrong position and even outside the current skbuff.
+This for example happens when the user binds to the device using a
+PF_PACKET-SOCK_RAW with enabled qdisc-bypass:
+
+  int opt = 4;
+  setsockopt(sock, SOL_PACKET, PACKET_QDISC_BYPASS, &opt, sizeof(opt));
+
+Since eth_hdr is used all over the codebase, the batadv_interface_tx
+function must always take care of resetting it.
+
+Fixes: fe28a94c01e1 ("batman-adv: receive packets directly using skbs")
+Reported-by: syzbot+9d7405c7faa390e60b4e@syzkaller.appspotmail.com
+Reported-by: syzbot+7d20bc3f1ddddc0f9079@syzkaller.appspotmail.com
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+
+Origin: upstream, https://git.open-mesh.org/batman-adv.git/commit/74c4b0c50f19f986752ee18ed393732f4eed7a66
+---
+ net/batman-adv/soft-interface.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index ff797f32fb3bb81dafe1e7d3e9c6307e6a5aaff1..f590c7b2c76816303fe1d3f5d2858e3a9b126539 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -232,6 +232,8 @@ static int batadv_interface_tx(struct sk_buff *skb,
+ 
+       netif_trans_update(soft_iface);
+       vid = batadv_get_vid(skb, 0);
++
++      skb_reset_mac_header(skb);
+       ethhdr = eth_hdr(skb);
+ 
+       switch (ntohs(ethhdr->h_proto)) {