diff options
| author | Sven Eckelmann <sven@narfation.org> | 2026-06-28 08:35:35 +0200 |
|---|---|---|
| committer | Sven Eckelmann <sven@narfation.org> | 2026-06-28 09:58:13 +0200 |
| commit | 7141990add3f75436f2933cb310654cad3b1e3e9 (patch) | |
| tree | bd9bdd36d237da0d00734afab25792fc82ad9530 /lib/raid/raid6/git@git.tavy.me:linux-stable.git | |
| parent | 035e1fed892d3d06002a73ff73668f618a514644 (diff) | |
batman-adv: access unicast_ttvn skb->data only after skb realloc
The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.
This was done correctly for the ethernet header but missed for the
unicast_packet pointer.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: c018ad3de61a ("batman-adv: add the VLAN ID attribute to the TT entry")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Diffstat (limited to 'lib/raid/raid6/git@git.tavy.me:linux-stable.git')
0 files changed, 0 insertions, 0 deletions