6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sven Eckelmann commit 82bf207f48ebb7a38157f1d91dac884fc9b8cfd8 upstream. When a packet is transmitted via a batman-adv interface and has already enough room for the header then nothing will make sure that the skbuff is unshared. But it is not allowed to modify a currently shared skbuff. Always make sure that the pskb_expand_head() is not only called for a too small header but also for shared skbuffs. Cc: stable@vger.kernel.org Fixes: 90039133221e ("batman-adv: mcast: implement multicast packet generation") Signed-off-by: Sven Eckelmann Signed-off-by: Greg Kroah-Hartman --- net/batman-adv/multicast_forw.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/net/batman-adv/multicast_forw.c +++ b/net/batman-adv/multicast_forw.c @@ -1100,8 +1100,7 @@ static int batadv_mcast_forw_expand_head return -EINVAL; } - if (skb_headroom(skb) < hdr_size && - pskb_expand_head(skb, hdr_size, 0, GFP_ATOMIC) < 0) + if (skb_cow(skb, hdr_size) < 0) return -ENOMEM; return 0;