summaryrefslogtreecommitdiff
path: root/kernel
diff options
context:
space:
mode:
authorSven Eckelmann <sven@narfation.org>2014-12-20 13:48:56 +0100
committerDavid S. Miller <davem@davemloft.net>2014-12-23 23:13:37 -0500
commit0402e444cd199389b7fe47be68a67b817e09e097 (patch)
tree10e1c37a8ff24ce5118b08e2de16086599df21ee /kernel
parent5b6698b0e4a37053de35cc24ee695b98a7eb712b (diff)
batman-adv: Unify fragment size calculation
The fragmentation code was replaced in 610bfc6bc99bc83680d190ebc69359a05fc7f605 ("batman-adv: Receive fragmented packets and merge") by an implementation which can handle up to 16 fragments of a packet. The packet is prepared for the split in fragments by the function batadv_frag_send_packet and the actual split is done by batadv_frag_create. Both functions calculate the size of a fragment themself. But their calculation differs because batadv_frag_send_packet also subtracts ETH_HLEN. Therefore, the check in batadv_frag_send_packet "can a full fragment can be created?" may return true even when batadv_frag_create cannot create a full fragment. The function batadv_frag_create doesn't check the size of the skb before splitting it and therefore might try to create a larger fragment than the remaining buffer. This creates an integer underflow and an invalid len is given to skb_split. Signed-off-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'kernel')
0 files changed, 0 insertions, 0 deletions