On Thursday, 9 July 2026 21:45:57 CEST Sven Eckelmann wrote: > batadv_mcast_forw_packet() is not only called by the unsharing+linearizing > batadv_recv_mcast_packet() handler. When it is called by > batadv_mcast_forw_mcsend() then it will be unshared but not linearized. The > SKB_LINEAR_ASSERT() can therefore cause a fatal BUG(). > > The batadv_mcast_forw_packet() must handle the linearization itself. > > Reported-by: Sashiko <[email protected]> > Fixes: 8ed36122d709 ("batman-adv: mcast: implement multicast packet reception > and forwarding") > Signed-off-by: Sven Eckelmann <[email protected]> > --- > net/batman-adv/multicast_forw.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/net/batman-adv/multicast_forw.c b/net/batman-adv/multicast_forw.c > index c5b8e2e3..9fbd2876 100644 > --- a/net/batman-adv/multicast_forw.c > +++ b/net/batman-adv/multicast_forw.c > @@ -937,8 +937,10 @@ static int batadv_mcast_forw_packet(struct batadv_priv > *bat_priv, > u8 *dest; > int ret; > > - /* (at least) TVLV part needs to be linearized */ > - SKB_LINEAR_ASSERT(skb); > + /* packet needs to be linearized to access the tvlv content */ > + ret = skb_linearize(skb); > + if (ret < 0) > + return -ENOMEM; > > /* check if batadv_tvlv_mcast_tracker header is within skb length */ > if (sizeof(*mcast_tracker) > skb_network_header_len(skb)) > >
We might move this to the same place as the skb_cow fix (see patch 2) because
batadv_mcast_forw_scrape() has also this assert and following unlinearized-skb
callchain exists:
batadv_interface_tx
batadv_mcast_forw_mode
batadv_mcast_forw_mode_by_count
batadv_mcast_forw_push
batadv_mcast_forw_push_tvlvs
batadv_mcast_forw_push_dests
batadv_mcast_forw_push_adjust_padding
batadv_mcast_forw_scrape
And this is called before batadv_mcast_forw_packet
Regards,
Sven
signature.asc
Description: This is a digitally signed message part.
