a6a73781b4
[ Upstream commit a063f2fba3fa633a599253b62561051ac185fa99 ]
The receiving interface might have used GRO to receive more fragments than
MAX_SKB_FRAGS fragments. In this case, these will not be stored in
skb_shinfo(skb)->frags but merged into the frag list.
batman-adv relies on the function skb_split to split packets up into
multiple smaller packets which are not larger than the MTU on the outgoing
interface. But this function cannot handle frag_list entries and is only
operating on skb_shinfo(skb)->frags. If it is still trying to split such an
skb and xmit'ing it on an interface without support for NETIF_F_FRAGLIST,
then validate_xmit_skb() will try to linearize it. But this fails due to
inconsistent information. And __pskb_pull_tail will trigger a BUG_ON after
skb_copy_bits() returns an error.
In case of entries in frag_list, just linearize the skb before operating on
it with skb_split().
Reported-by: Felix Kaechele <felix@kaechele.ca>
Fixes:
|
||
|---|---|---|
| .. | ||
| bat_algo.c | ||
| bat_algo.h | ||
| bat_iv_ogm.c | ||
| bat_iv_ogm.h | ||
| bat_v_elp.c | ||
| bat_v_elp.h | ||
| bat_v_ogm.c | ||
| bat_v_ogm.h | ||
| bat_v.c | ||
| bat_v.h | ||
| bitarray.c | ||
| bitarray.h | ||
| bridge_loop_avoidance.c | ||
| bridge_loop_avoidance.h | ||
| debugfs.c | ||
| debugfs.h | ||
| distributed-arp-table.c | ||
| distributed-arp-table.h | ||
| fragmentation.c | ||
| fragmentation.h | ||
| gateway_client.c | ||
| gateway_client.h | ||
| gateway_common.c | ||
| gateway_common.h | ||
| hard-interface.c | ||
| hard-interface.h | ||
| hash.c | ||
| hash.h | ||
| icmp_socket.c | ||
| icmp_socket.h | ||
| Kconfig | ||
| log.c | ||
| log.h | ||
| main.c | ||
| main.h | ||
| Makefile | ||
| multicast.c | ||
| multicast.h | ||
| netlink.c | ||
| netlink.h | ||
| network-coding.c | ||
| network-coding.h | ||
| originator.c | ||
| originator.h | ||
| routing.c | ||
| routing.h | ||
| send.c | ||
| send.h | ||
| soft-interface.c | ||
| soft-interface.h | ||
| sysfs.c | ||
| sysfs.h | ||
| tp_meter.c | ||
| tp_meter.h | ||
| trace.c | ||
| trace.h | ||
| translation-table.c | ||
| translation-table.h | ||
| tvlv.c | ||
| tvlv.h | ||
| types.h | ||