batman-adv: dat: acquire ARP hw source only after skb realloc

The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.

Cc: stable@vger.kernel.org
Fixes: b61ec31c8575 ("batman-adv: Snoop DHCPACKs for DAT")
Signed-off-by: Sven Eckelmann <sven@narfation.org>

diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index ae39cea..ead02c9 100644 (file)
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -1747,6 +1747,7 @@ void batadv_dat_snoop_incoming_dhcp_ack(struct batadv_priv *bat_priv,
        struct ethhdr *ethhdr;
        __be32 ip_src, yiaddr;
        unsigned short vid;
+       int hdr_size_tmp;
        __be16 proto;
        u8 *hw_src;
 
@@ -1763,8 +1764,10 @@ void batadv_dat_snoop_incoming_dhcp_ack(struct batadv_priv *bat_priv,
        if (!batadv_dat_check_dhcp_ack(skb, proto, &ip_src, chaddr, &yiaddr))
                return;
 
+       hdr_size_tmp = hdr_size;
+       vid = batadv_dat_get_vid(skb, &hdr_size_tmp);
+       ethhdr = (struct ethhdr *)(skb->data + hdr_size);
        hw_src = ethhdr->h_source;
-       vid = batadv_dat_get_vid(skb, &hdr_size);
 
        batadv_dat_entry_add(bat_priv, yiaddr, chaddr, vid);
        batadv_dat_entry_add(bat_priv, ip_src, hw_src, vid);