Staging: batman-adv: ensure that eth_type_trans gets linear memory

commit b6faaae1a15a352d68b3e3cd8b840e56709820bf upstream.

eth_type_trans tries to pull data with the length of the ethernet header
from the skb. We only ensured that enough data for the first ethernet
header and the batman header is available in non-paged memory of the skb
and not for the ethernet after the batman header.

eth_type_trans would fail sometimes with drivers which don't ensure that
all there data is perfectly linearised.

The failure was noticed through a kernel bug Oops generated by the
skb_pull inside eth_type_trans.

Reported-by: Rafal Lesniak <lesniak@eresi-project.org>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Andi Kleen <ak@linux.intel.com>

diff --git a/drivers/staging/batman-adv/soft-interface.c b/drivers/staging/batman-adv/soft-interface.c
index 51c40b77c8d73d2246b3e15882a1c7429b50e889..0ae6c03612a9bf56b96fc9b90b8ae9d91ad5b6ed 100644 (file)
--- a/drivers/staging/batman-adv/soft-interface.c
+++ b/drivers/staging/batman-adv/soft-interface.c
@@ -295,6 +295,10 @@ void interface_rx(struct sk_buff *skb, int hdr_size)
        skb_pull_rcsum(skb, hdr_size);
 /*     skb_set_mac_header(skb, -sizeof(struct ethhdr));*/
 
+       if (unlikely(!pskb_may_pull(skb, ETH_HLEN))) {
+               kfree_skb(skb);
+               return;
+       }
        skb->dev = dev;
        skb->protocol = eth_type_trans(skb, dev);