[PATCH batadv v2 0/5] batman-adv: reacquire pointers to skb buffer data

When a function is called which reallocated the skbuff, it is necessary to
reacquire the pointers into the skb data. Otherwise they might cause an
use-after-free.

There are multiple such cases in the batman-adv code - some of them are
hard to find because they are only indirectly calling pskb_may_pull. To
ease the situation, annotate these functions. And based on this
information, restructure the callers to avoid the potential use-after-free
scenarios.

Signed-off-by: Sven Eckelmann <[email protected]>
---
Changes in v2:
- drop already merged first patch
- add fixes for indirect callers of pskb_may_pull
- annotate non-skb-consuming functions which might reallocate the skb
- Link to v1: https://patch.msgid.link/[email protected]

---
Sven Eckelmann (5):
      batman-adv: access unicast_ttvn skb->data only after skb realloc
      batman-adv: gw: acquire ethernet header only after skb realloc
      batman-adv: dat: acquire ARP hw source only after skb realloc
      batman-adv: bla: reacquire gw address after skb realloc
      batman-adv: annotate functions which may reallocate the skbuff

 net/batman-adv/bridge_loop_avoidance.c | 10 ++++++++
 net/batman-adv/distributed-arp-table.c | 45 +++++++++++++++++++++++++++++++++-
 net/batman-adv/gateway_client.c        |  9 +++++--
 net/batman-adv/main.c                  |  5 ++++
 net/batman-adv/routing.c               |  8 +++++-
 5 files changed, 73 insertions(+), 4 deletions(-)
---
base-commit: 6f34546691685542e30c7f7a3a5612821e917560
change-id: 20260628-skb-post-realloc-1eb51d508d33

Best regards,
--  
Sven Eckelmann <[email protected]>