[B.A.T.M.A.N.] [PATCH 1/3] batman-adv: protect against ogm packet overflow by checking table length
Reported-by: Sam Yeung sam.cwyeung@gmail.com Signed-off-by: Marek Lindner lindner_marek@yahoo.de --- batman-adv/translation-table.c | 9 +++++++-- 1 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/batman-adv/translation-table.c b/batman-adv/translation-table.c index 9cae140..75c8ce0 100644 --- a/batman-adv/translation-table.c +++ b/batman-adv/translation-table.c @@ -60,6 +60,7 @@ void hna_local_add(struct net_device *soft_iface, uint8_t *addr) struct hna_global_entry *hna_global_entry; struct hashtable_t *swaphash; unsigned long flags; + int required_bytes;
spin_lock_irqsave(&bat_priv->hna_lhash_lock, flags); hna_local_entry = @@ -75,8 +76,12 @@ void hna_local_add(struct net_device *soft_iface, uint8_t *addr) /* only announce as many hosts as possible in the batman-packet and space in batman_packet->num_hna That also should give a limit to MAC-flooding. */ - if ((bat_priv->num_local_hna + 1 > (ETH_DATA_LEN - BAT_PACKET_LEN) - / ETH_ALEN) || + required_bytes = (bat_priv->num_local_hna + 1) * ETH_ALEN; + required_bytes += BAT_PACKET_LEN; + + if ((required_bytes > ETH_DATA_LEN) || + (atomic_read(&bat_priv->aggregation_enabled) && + required_bytes > MAX_AGGREGATION_BYTES) || (bat_priv->num_local_hna + 1 > 255)) { bat_dbg(DBG_ROUTES, bat_priv, "Can't add new local hna entry (%pM): "
If aggregation is not enabled the local translation table can grow much bigger and expects to fill a full ethernet packet.
Reported-by: Sam Yeung sam.cwyeung@gmail.com Signed-off-by: Marek Lindner lindner_marek@yahoo.de --- batman-adv/aggregation.c | 10 ++++++++-- 1 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/batman-adv/aggregation.c b/batman-adv/aggregation.c index 46b9c2b..16b268e 100644 --- a/batman-adv/aggregation.c +++ b/batman-adv/aggregation.c @@ -123,8 +123,14 @@ static void new_aggregated_packet(unsigned char *packet_buff, int packet_len, return; }
- forw_packet_aggr->skb = dev_alloc_skb(MAX_AGGREGATION_BYTES + - sizeof(struct ethhdr)); + if ((atomic_read(&bat_priv->aggregation_enabled)) && + (packet_len < MAX_AGGREGATION_BYTES)) + forw_packet_aggr->skb = dev_alloc_skb(MAX_AGGREGATION_BYTES + + sizeof(struct ethhdr)); + else + forw_packet_aggr->skb = dev_alloc_skb(packet_len + + sizeof(struct ethhdr)); + if (!forw_packet_aggr->skb) { if (!own_packet) atomic_inc(&bat_priv->batman_queue_left);
Reported-by: Sam Yeung sam.cwyeung@gmail.com Signed-off-by: Marek Lindner lindner_marek@yahoo.de --- batman-adv/aggregation.c | 7 +++---- 1 files changed, 3 insertions(+), 4 deletions(-)
diff --git a/batman-adv/aggregation.c b/batman-adv/aggregation.c index 16b268e..08624d4 100644 --- a/batman-adv/aggregation.c +++ b/batman-adv/aggregation.c @@ -257,9 +257,7 @@ void receive_aggr_bat_packet(struct ethhdr *ethhdr, unsigned char *packet_buff,
batman_packet = (struct batman_packet *)packet_buff;
- while (aggregated_packet(buff_pos, packet_len, - batman_packet->num_hna)) { - + do { /* network to host order for our 32bit seqno, and the orig_interval. */ batman_packet->seqno = ntohl(batman_packet->seqno); @@ -272,5 +270,6 @@ void receive_aggr_bat_packet(struct ethhdr *ethhdr, unsigned char *packet_buff, buff_pos += BAT_PACKET_LEN + hna_len(batman_packet); batman_packet = (struct batman_packet *) (packet_buff + buff_pos); - } + } while (aggregated_packet(buff_pos, packet_len, + batman_packet->num_hna)); }
On Friday 15 October 2010 17:43:35 Marek Lindner wrote:
Reported-by: Sam Yeung sam.cwyeung@gmail.com
Applied in revision 1830-1832.
Regards, Marek
b.a.t.m.a.n@lists.open-mesh.org
-
Marek Lindner