[PATCH batadv v2 4/5] batman-adv: bla: reacquire gw address after skb realloc

[Sven Eckelmann]

The pskb_may_pull() called by batadv_bla_is_backbone_gw() could reallocate
the buffer behind the skb. Variables which were pointing to the old buffer
need to be reassigned to avoid an use-after-free.

Fixes: bfe2a1971f43 ("batman-adv: drop unicast packets from other backbone gw")
Signed-off-by: Sven Eckelmann <s...@narfation.org>
---
 net/batman-adv/routing.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 10168d23..7d9a2b59 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -1073,6 +1073,7 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
                                                          hdr_size);
                        batadv_orig_node_put(orig_node_gw);
                        if (is_gw) {
+                               orig_addr_gw = eth_hdr(skb)->h_source;
                                batadv_dbg(BATADV_DBG_BLA, bat_priv,
                                           "%s(): Dropped unicast pkt received 
from another backbone gw %pM.\n",
                                           __func__, orig_addr_gw);

-- 
2.47.3