diff options
| author |   Sven Eckelmann <sven@narfation.org> | 2026-05-13 09:01:34 +0200 |
|---|---|---|
| committer | Sven Eckelmann <sven@narfation.org> | 2026-05-14 20:01:31 +0200 |
| commit | 2d8826a2d3657cea66fb0370f9e521575a673871 (patch) | |
| tree | a056f4818f0c4845459695e54cb63d1e35734b6d /tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com | |
| parent | batman-adv: clear current gateway during teardown (diff) | |
batman-adv: dat: handle forward allocation error
batadv_dat_forward_data() calls pskb_copy_for_clone() to duplicate an skb
for each DHT candidate, but does not check the return value before passing
it to batadv_send_skb_prepare_unicast_4addr(). That function dereferences
the skb unconditionally, so a failed allocation triggers a NULL pointer
dereference.
Skip forwarding to the current DHT candidate on allocation failure.
Cc: stable@kernel.org
Fixes: 785ea1144182 ("batman-adv: Distributed ARP Table - create DHT helper functions")
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Reviewed-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Diffstat (limited to 'tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions