Merge pull request #538 from ecsv/batadv-for-17.01

[feed/routing.git] / batman-adv / patches / 0069-batman-adv-Only-read-OGM2-tvlv_len-after-buffer-len-.patch

diff --git a/batman-adv/patches/0069-batman-adv-Only-read-OGM2-tvlv_len-after-buffer-len-.patch b/batman-adv/patches/0069-batman-adv-Only-read-OGM2-tvlv_len-after-buffer-len-.patch
new file mode 100644 (file)
index 0000000..26c51f9
--- /dev/null
+++ b/batman-adv/patches/0069-batman-adv-Only-read-OGM2-tvlv_len-after-buffer-len-.patch
@@ -0,0 +1,62 @@
+From: Sven Eckelmann <sven@narfation.org>
+Date: Fri, 23 Aug 2019 14:34:28 +0200
+Subject: batman-adv: Only read OGM2 tvlv_len after buffer len check
+
+Multiple batadv_ogm2_packet can be stored in an skbuff. The functions
+batadv_v_ogm_send_to_if() uses batadv_v_ogm_aggr_packet() to check if there
+is another additional batadv_ogm2_packet in the skb or not before they
+continue processing the packet.
+
+The length for such an OGM2 is BATADV_OGM2_HLEN +
+batadv_ogm2_packet->tvlv_len. The check must first check that at least
+BATADV_OGM2_HLEN bytes are available before it accesses tvlv_len (which is
+part of the header. Otherwise it might try read outside of the currently
+available skbuff to get the content of tvlv_len.
+
+Fixes: 667996ebeab4 ("batman-adv: OGMv2 - implement originators logic")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+
+Origin: upstream, https://git.open-mesh.org/batman-adv.git/commit/18f77da3761c5550f42a2d131f0fe5cac62e022d
+
+diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c
+index 38b9aab83fc0eaf63e3713d278482524253d5c1a..5f4fe1889053d4ea7624e4500dcefe2601371024 100644
+--- a/net/batman-adv/bat_v_ogm.c
++++ b/net/batman-adv/bat_v_ogm.c
+@@ -644,17 +644,23 @@ batadv_v_ogm_process_per_outif(struct batadv_priv *bat_priv,
+  * batadv_v_ogm_aggr_packet - checks if there is another OGM aggregated
+  * @buff_pos: current position in the skb
+  * @packet_len: total length of the skb
+- * @tvlv_len: tvlv length of the previously considered OGM
++ * @ogm2_packet: potential OGM2 in buffer
+  *
+  * Return: true if there is enough space for another OGM, false otherwise.
+  */
+-static bool batadv_v_ogm_aggr_packet(int buff_pos, int packet_len,
+-                                   __be16 tvlv_len)
++static bool
++batadv_v_ogm_aggr_packet(int buff_pos, int packet_len,
++                       const struct batadv_ogm2_packet *ogm2_packet)
+ {
+       int next_buff_pos = 0;
+ 
+-      next_buff_pos += buff_pos + BATADV_OGM2_HLEN;
+-      next_buff_pos += ntohs(tvlv_len);
++      /* check if there is enough space for the header */
++      next_buff_pos += buff_pos + sizeof(*ogm2_packet);
++      if (next_buff_pos > packet_len)
++              return false;
++
++      /* check if there is enough space for the optional TVLV */
++      next_buff_pos += ntohs(ogm2_packet->tvlv_len);
+ 
+       return (next_buff_pos <= packet_len) &&
+              (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES);
+@@ -831,7 +837,7 @@ int batadv_v_ogm_packet_recv(struct sk_buff *skb,
+       ogm_packet = (struct batadv_ogm2_packet *)skb->data;
+ 
+       while (batadv_v_ogm_aggr_packet(ogm_offset, skb_headlen(skb),
+-                                      ogm_packet->tvlv_len)) {
++                                      ogm_packet)) {
+               batadv_v_ogm_process(skb, ogm_offset, if_incoming);
+ 
+               ogm_offset += BATADV_OGM2_HLEN;