batadv_mcast_forw_packet() is not only called by the unsharing+linearizing batadv_recv_mcast_packet() handler. When it is called by batadv_mcast_forw_mcsend() then it will be unshared but not linearized. The SKB_LINEAR_ASSERT() can therefore cause a fatal BUG().
The batadv_mcast_forw_packet() must handle the linearization itself. Reported-by: Sashiko <[email protected]> Fixes: 8ed36122d709 ("batman-adv: mcast: implement multicast packet reception and forwarding") Signed-off-by: Sven Eckelmann <[email protected]> --- net/batman-adv/multicast_forw.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/batman-adv/multicast_forw.c b/net/batman-adv/multicast_forw.c index c5b8e2e3..9fbd2876 100644 --- a/net/batman-adv/multicast_forw.c +++ b/net/batman-adv/multicast_forw.c @@ -937,8 +937,10 @@ static int batadv_mcast_forw_packet(struct batadv_priv *bat_priv, u8 *dest; int ret; - /* (at least) TVLV part needs to be linearized */ - SKB_LINEAR_ASSERT(skb); + /* packet needs to be linearized to access the tvlv content */ + ret = skb_linearize(skb); + if (ret < 0) + return -ENOMEM; /* check if batadv_tvlv_mcast_tracker header is within skb length */ if (sizeof(*mcast_tracker) > skb_network_header_len(skb)) -- 2.47.3
