[PATCH batadv 3/3] batman-adv: mcast: linearize skbuff for packet generation

Sven Eckelmann <[email protected]> Thu, 09 Jul 2026 21:45:57 +0200
Newsgroups org.open-mesh.lists.batman
Message-ID <20260709-mcast-header-generation-bugs-v1-3-c7c111fa45b6@narfation.org>
batadv_mcast_forw_packet() is not only called by the unsharing+linearizing
batadv_recv_mcast_packet() handler. When it is called by
batadv_mcast_forw_mcsend() then it will be unshared but not linearized. The
SKB_LINEAR_ASSERT() can therefore cause a fatal BUG().

The batadv_mcast_forw_packet() must handle the linearization itself.

Reported-by: Sashiko <[email protected]>
Fixes: 8ed36122d709 ("batman-adv: mcast: implement multicast packet reception and forwarding")
Signed-off-by: Sven Eckelmann <[email protected]>
---
 net/batman-adv/multicast_forw.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/batman-adv/multicast_forw.c b/net/batman-adv/multicast_forw.c
index c5b8e2e3..9fbd2876 100644
--- a/net/batman-adv/multicast_forw.c
+++ b/net/batman-adv/multicast_forw.c
@@ -937,8 +937,10 @@ static int batadv_mcast_forw_packet(struct batadv_priv *bat_priv,
 	u8 *dest;
 	int ret;
 
-	/* (at least) TVLV part needs to be linearized */
-	SKB_LINEAR_ASSERT(skb);
+	/* packet needs to be linearized to access the tvlv content */
+	ret = skb_linearize(skb);
+	if (ret < 0)
+		return -ENOMEM;
 
 	/* check if batadv_tvlv_mcast_tracker header is within skb length */
 	if (sizeof(*mcast_tracker) > skb_network_header_len(skb))

-- 
2.47.3