commits January 2024

commits@lists.open-mesh.org

1 participants
49 discussions

[linux-merge]linux integration; annotated tag, v6.8-rc2, created. v6.8-rc2
by postmaster＠open-mesh.org 29 Jan '24

29 Jan '24

The annotated tag, v6.8-rc2 has been created at c18956a7ed4b71eec72700a0899ad21167b994bb (tag) tagging 41bccc98fb7931d63d03f326a746ac4d429c1dd3 (commit) replaces v6.8-rc1 tagged by Linus Torvalds on Sun Jan 28 17:01:12 2024 -0800 - Shortlog ------------------------------------------------------------ Linux 6.8-rc2 -----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmW2+NgeHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGNMoH/RbwRC7SpkT55lsD lIpaUrIYLuXkPKJa/3eD75cOtOv4Yi+aHGXfdTbo+JwWBKg4zY8X2pr7IZrvfpp5 TZD+PADQtFAReWlQtVsaNM7om8k+2ltm+nkso1G+FpHljqqHgl3gc95UrVlmM70r iEScR0KbHkJ2Yv5H8C6ardcA87JYMaex6USK9GWSoylBN3R+Z49YEC9q07IQatAA Do8i6jDtw3O9OF2PpnhIPXxQZkwsn15pY1HwZxUEDMPXteMZa6NogvFsj6kSIudo YTF3FK+oX5CXNATL49OY4ibJ701mPCKqsuY3z6SuoYtvhI6wR96sIGFjEWV9tHvU VhPBvCI= =BKso -----END PGP SIGNATURE----- ----------------------------------------------------------------------- -- linux integration

1 0

[batctl] main,main: batctl: tcpdump: Fix missing sanity check for batman-adv header (7ae3bdb)
by postmaster＠open-mesh.org 29 Jan '24

29 Jan '24

Repository : ssh://git@diktynna/batctl On branches: main,main >--------------------------------------------------------------- commit 7ae3bdb59a7501197e12d3a7ab0d9924341e9ca8 Author: Sven Eckelmann <sven(a)narfation.org> Date: Sat Jan 27 13:48:59 2024 +0100 batctl: tcpdump: Fix missing sanity check for batman-adv header parse_eth_hdr() is assuming that every ETH_P_BATMAN ethernet packet has a valid, minimal batman-adv header (packet_type, version, ttl) attached. But it doesn't actually check if the received buffer has enough bytes to access the two bytes packet_type + version. So it is possible that it tries to read outside of the received data. Fixes: 3bdfc388e74b ("implement simple tcpdump, first only batman packets") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> >--------------------------------------------------------------- 7ae3bdb59a7501197e12d3a7ab0d9924341e9ca8 tcpdump.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tcpdump.c b/tcpdump.c index 5e7c76c..e1ed754 100644 --- a/tcpdump.c +++ b/tcpdump.c @@ -1167,6 +1167,9 @@ static void parse_eth_hdr(unsigned char *packet_buff, ssize_t buff_len, int read dump_vlan(packet_buff, buff_len, read_opt, time_printed); break; case ETH_P_BATMAN: + /* check for batman-adv packet_type + version */ + LEN_CHECK(buff_len, sizeof(*eth_hdr) + 2, "BAT HEADER") + batman_ogm_packet = (struct batadv_ogm_packet *)(packet_buff + ETH_HLEN); if ((read_opt & COMPAT_FILTER) &&

1 0

[batctl] main,main: batctl: tcpdump: Add missing ICMPv6 Neighbor Advert length check (da75747)
by postmaster＠open-mesh.org 29 Jan '24

29 Jan '24

Repository : ssh://git@diktynna/batctl On branches: main,main >--------------------------------------------------------------- commit da75747d435ca8a32a74895655a1d5bff8b7709b Author: Sven Eckelmann <sven(a)narfation.org> Date: Sat Jan 27 13:49:02 2024 +0100 batctl: tcpdump: Add missing ICMPv6 Neighbor Advert length check dump_ipv6() is doing a length check for the original ICMPv6 header length. But the neighbor advertisement (which is also handled by this function) is accessed without doing an additional length check. So it is possible that it tries to read outside of the received data. Fixes: 35b37756f4a3 ("add IPv6 support to tcpdump parser") Cc: Marco Dalla Torre <marco.dallato(a)gmail.com> Signed-off-by: Sven Eckelmann <sven(a)narfation.org> >--------------------------------------------------------------- da75747d435ca8a32a74895655a1d5bff8b7709b tcpdump.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tcpdump.c b/tcpdump.c index 3e8dece..51f0391 100644 --- a/tcpdump.c +++ b/tcpdump.c @@ -659,6 +659,8 @@ static void dump_ipv6(unsigned char *packet_buff, ssize_t buff_len, nd_nas_target, buff_len); break; case ND_NEIGHBOR_ADVERT: + LEN_CHECK((size_t)buff_len - (size_t)(sizeof(struct ip6_hdr)), + sizeof(*nd_advert), "ICMPv6 Neighbor Advertisement"); nd_advert = (struct nd_neighbor_advert *)icmphdr; inet_ntop(AF_INET6, &(nd_advert->nd_na_target), nd_nas_target, 40);

1 0

[batctl] main,main: batctl: tcpdump: Fix ICMPv4 inner IPv4 header length check (fb7a514)
by postmaster＠open-mesh.org 29 Jan '24

29 Jan '24

Repository : ssh://git@diktynna/batctl On branches: main,main >--------------------------------------------------------------- commit fb7a51466bf46a4914a32edd8e1be6ba0733cd49 Author: Sven Eckelmann <sven(a)narfation.org> Date: Sat Jan 27 13:49:04 2024 +0100 batctl: tcpdump: Fix ICMPv4 inner IPv4 header length check dump_ip() is doing a length check for the inner (inside ICMP) IPv4 header length. But it is just assuming that the inner ICMPv4 header has ihl set to 5 - without actually checking for this. The more complex IPv4 header length check for the outer IPv4 header is missing before it tries to access the UDP header using the inner ihl IPv4 header length information. So it is possible that it tries to read outside of the received data. Fixes: 75d68356f3fa ("[batctl] tcpdump - add basic IPv4 support") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> >--------------------------------------------------------------- fb7a51466bf46a4914a32edd8e1be6ba0733cd49 tcpdump.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/tcpdump.c b/tcpdump.c index 6cfe74e..1a9c3af 100644 --- a/tcpdump.c +++ b/tcpdump.c @@ -730,12 +730,20 @@ static void dump_ip(unsigned char *packet_buff, ssize_t buff_len, (size_t)buff_len - (iphdr->ihl * 4)); break; case ICMP_DEST_UNREACH: - LEN_CHECK((size_t)buff_len - (iphdr->ihl * 4) - sizeof(struct icmphdr), - sizeof(struct iphdr) + 8, "ICMP DEST_UNREACH"); - switch (icmphdr->code) { case ICMP_PORT_UNREACH: + LEN_CHECK((size_t)buff_len - (iphdr->ihl * 4) - sizeof(struct icmphdr), + sizeof(struct iphdr), "ICMP DEST_UNREACH"); + + /* validate inner IP header information */ tmp_iphdr = (struct iphdr *)(((char *)icmphdr) + sizeof(struct icmphdr)); + LEN_CHECK((size_t)buff_len - (iphdr->ihl * 4) - sizeof(struct icmphdr), + (size_t)(tmp_iphdr->ihl * 4), "ICMP DEST_UNREACH"); + LEN_CHECK((size_t)(tmp_iphdr->ihl * 4), sizeof(*iphdr), "ICMP DEST_UNREACH"); + + LEN_CHECK((size_t)buff_len - (iphdr->ihl * 4) - sizeof(struct icmphdr) - (tmp_iphdr->ihl * 4), + sizeof(*tmp_udphdr), "ICMP DEST_UNREACH"); + tmp_udphdr = (struct udphdr *)(((char *)tmp_iphdr) + (tmp_iphdr->ihl * 4)); printf("%s: ICMP ", ipdst);

1 0

[batctl] main,main: batctl: tcpdump: Add missing ICMPv6 Neighbor Solicit length check (8302593)
by postmaster＠open-mesh.org 29 Jan '24

29 Jan '24

Repository : ssh://git@diktynna/batctl On branches: main,main >--------------------------------------------------------------- commit 83025933cb502192d22edc89de3c57103968c4ed Author: Sven Eckelmann <sven(a)narfation.org> Date: Sat Jan 27 13:49:03 2024 +0100 batctl: tcpdump: Add missing ICMPv6 Neighbor Solicit length check dump_ipv6() is doing a length check for the original ICMPv6 header length. But the neighbor solicitation (which is also handled by this function) is accessed without doing an additional length check. So it is possible that it tries to read outside of the received data. Fixes: 35b37756f4a3 ("add IPv6 support to tcpdump parser") Cc: Marco Dalla Torre <marco.dallato(a)gmail.com> Signed-off-by: Sven Eckelmann <sven(a)narfation.org> >--------------------------------------------------------------- 83025933cb502192d22edc89de3c57103968c4ed tcpdump.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tcpdump.c b/tcpdump.c index 51f0391..6cfe74e 100644 --- a/tcpdump.c +++ b/tcpdump.c @@ -652,6 +652,8 @@ static void dump_ipv6(unsigned char *packet_buff, ssize_t buff_len, (size_t)buff_len - sizeof(struct icmp6_hdr)); break; case ND_NEIGHBOR_SOLICIT: + LEN_CHECK((size_t)buff_len - (size_t)(sizeof(struct ip6_hdr)), + sizeof(*nd_neigh_sol), "ICMPv6 Neighbor Solicitation"); nd_neigh_sol = (struct nd_neighbor_solicit *)icmphdr; inet_ntop(AF_INET6, &(nd_neigh_sol->nd_ns_target), nd_nas_target, 40);

1 0

[batctl] main,main: batctl: tcpdump: Fix IPv4 header length check (ddb254b)
by postmaster＠open-mesh.org 29 Jan '24

29 Jan '24

Repository : ssh://git@diktynna/batctl On branches: main,main >--------------------------------------------------------------- commit ddb254bd51aa43d216159f3be9c575369b041d35 Author: Sven Eckelmann <sven(a)narfation.org> Date: Sat Jan 27 13:49:01 2024 +0100 batctl: tcpdump: Fix IPv4 header length check dump_ip() is directly accessing the header in the header length check and assumes that ihl can be trusted. But when when ihl is set to something less than 5 then it would not even be possible to store the basic IPv4 header in it. But dump_ip would have still accepted it because it didn't check if there are at least enough bytes available to read the basic IPv4 header. So it is possible that it tries to read outside of the received data. Fixes: 75d68356f3fa ("[batctl] tcpdump - add basic IPv4 support") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> >--------------------------------------------------------------- ddb254bd51aa43d216159f3be9c575369b041d35 tcpdump.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tcpdump.c b/tcpdump.c index e60b7d1..3e8dece 100644 --- a/tcpdump.c +++ b/tcpdump.c @@ -694,7 +694,9 @@ static void dump_ip(unsigned char *packet_buff, ssize_t buff_len, struct icmphdr *icmphdr; iphdr = (struct iphdr *)packet_buff; + LEN_CHECK((size_t)buff_len, sizeof(*iphdr), ip_string); LEN_CHECK((size_t)buff_len, (size_t)(iphdr->ihl * 4), ip_string); + LEN_CHECK((size_t)(iphdr->ihl * 4), sizeof(*iphdr), ip_string); if (!time_printed) print_time();

1 0

[batctl] main,main: batctl: tcpdump: Add missing throughput header length check (189b664)
by postmaster＠open-mesh.org 29 Jan '24

29 Jan '24

Repository : ssh://git@diktynna/batctl On branches: main,main >--------------------------------------------------------------- commit 189b66496309bc1a54b4821292da2428de8ceb1c Author: Sven Eckelmann <sven(a)narfation.org> Date: Sat Jan 27 13:49:00 2024 +0100 batctl: tcpdump: Add missing throughput header length check dump_batman_icmp() is only doing a length check for the original ICMP packet length. But the throughput packet (which is also handled by this function) is accessed without doing an additional length check. So it is possible that it tries to read outside of the received data. Fixes: f109b3473f86 ("batctl: introduce throughput meter support") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> >--------------------------------------------------------------- 189b66496309bc1a54b4821292da2428de8ceb1c tcpdump.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tcpdump.c b/tcpdump.c index e1ed754..e60b7d1 100644 --- a/tcpdump.c +++ b/tcpdump.c @@ -911,7 +911,6 @@ static void dump_batman_icmp(unsigned char *packet_buff, ssize_t buff_len, int r LEN_CHECK((size_t)buff_len - sizeof(struct ether_header), sizeof(struct batadv_icmp_packet), "BAT ICMP"); icmp_packet = (struct batadv_icmp_packet *)(packet_buff + sizeof(struct ether_header)); - tp = (struct batadv_icmp_tp_packet *)icmp_packet; if (!time_printed) print_time(); @@ -942,6 +941,10 @@ static void dump_batman_icmp(unsigned char *packet_buff, ssize_t buff_len, int r (size_t)buff_len - sizeof(struct ether_header)); break; case BATADV_TP: + LEN_CHECK((size_t)buff_len - sizeof(struct ether_header), sizeof(*tp), "BAT TP"); + + tp = (struct batadv_icmp_tp_packet *)icmp_packet; + printf("%s: ICMP TP type %s (%hhu), id %hhu, seq %u, ttl %2d, v %d, length %zu\n", name, tp->subtype == BATADV_TP_MSG ? "MSG" : tp->subtype == BATADV_TP_ACK ? "ACK" : "N/A",

1 0

[linux-merge]linux integration; branch, batadv/net-next, updated. v6.8-rc1-4-gdb60ad8b21ce
by postmaster＠open-mesh.org 27 Jan '24

27 Jan '24

The following commit has been merged in the batadv/net-next branch: commit ffc15626c861f811f9778914be004fcf43810a91 Author: Markus Elfring <elfring(a)users.sourceforge.net> Date: Tue Jan 2 07:27:45 2024 +0100 batman-adv: Return directly after a failed batadv_dat_select_candidates() in batadv_dat_forward_data() The kfree() function was called in one case by the batadv_dat_forward_data() function during error handling even if the passed variable contained a null pointer. This issue was detected by using the Coccinelle software. * Thus return directly after a batadv_dat_select_candidates() call failed at the beginning. * Delete the label “out” which became unnecessary with this refactoring. Signed-off-by: Markus Elfring <elfring(a)users.sourceforge.net> Acked-by: Sven Eckelmann <sven(a)narfation.org> Signed-off-by: Simon Wunderlich <sw(a)simonwunderlich.de> diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c index 28a939d56090..4c7e85534324 100644 --- a/net/batman-adv/distributed-arp-table.c +++ b/net/batman-adv/distributed-arp-table.c @@ -684,7 +684,7 @@ static bool batadv_dat_forward_data(struct batadv_priv *bat_priv, cand = batadv_dat_select_candidates(bat_priv, ip, vid); if (!cand) - goto out; + return ret; batadv_dbg(BATADV_DBG_DAT, bat_priv, "DHT_SEND for %pI4\n", &ip); @@ -728,7 +728,6 @@ free_orig: batadv_orig_node_put(cand[i].orig_node); } -out: kfree(cand); return ret; } -- linux integration

1 0

[linux-merge]linux integration; branch, batadv/net-next, updated. v6.8-rc1-4-gdb60ad8b21ce
by postmaster＠open-mesh.org 27 Jan '24

27 Jan '24

The following commit has been merged in the batadv/net-next branch: commit db60ad8b21cee0394cb0a1092d9f9190d310562c Author: Sven Eckelmann <sven(a)narfation.org> Date: Mon Jan 22 14:03:38 2024 +0100 batman-adv: Drop usage of export.h The linux/export.h include was introduced in commit 9bcb94c8617e ("batman-adv: Introduce missing headers for genetlink restructure") to have access to THIS_MODULE. But with commit 5b20755b7780 ("init: move THIS_MODULE from <linux/export.h> to <linux/init.h>"), it was moved and the include for export.h is no longer needed. Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Signed-off-by: Simon Wunderlich <sw(a)simonwunderlich.de> diff --git a/net/batman-adv/netlink.c b/net/batman-adv/netlink.c index 1f7ed9d4f6fd..0954757f0b8b 100644 --- a/net/batman-adv/netlink.c +++ b/net/batman-adv/netlink.c @@ -15,7 +15,6 @@ #include <linux/cache.h> #include <linux/err.h> #include <linux/errno.h> -#include <linux/export.h> #include <linux/genetlink.h> #include <linux/gfp.h> #include <linux/if_ether.h> -- linux integration

1 0

[linux-merge]linux integration; branch, batadv/net-next, updated. v6.8-rc1-4-gdb60ad8b21ce
by postmaster＠open-mesh.org 27 Jan '24

27 Jan '24

The following commit has been merged in the batadv/net-next branch: commit 5593e9abf1cf2bf096366d8c7fd933bc69d561ce Author: Markus Elfring <elfring(a)users.sourceforge.net> Date: Tue Jan 2 07:52:21 2024 +0100 batman-adv: Improve exception handling in batadv_throw_uevent() The kfree() function was called in up to three cases by the batadv_throw_uevent() function during error handling even if the passed variable contained a null pointer. This issue was detected by using the Coccinelle software. * Thus adjust jump targets. * Reorder kfree() calls at the end. Signed-off-by: Markus Elfring <elfring(a)users.sourceforge.net> Acked-by: Sven Eckelmann <sven(a)narfation.org> Signed-off-by: Simon Wunderlich <sw(a)simonwunderlich.de> diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c index 5fc754b0b3f7..75119f1ffccc 100644 --- a/net/batman-adv/main.c +++ b/net/batman-adv/main.c @@ -691,29 +691,31 @@ int batadv_throw_uevent(struct batadv_priv *bat_priv, enum batadv_uev_type type, "%s%s", BATADV_UEV_TYPE_VAR, batadv_uev_type_str[type]); if (!uevent_env[0]) - goto out; + goto report_error; uevent_env[1] = kasprintf(GFP_ATOMIC, "%s%s", BATADV_UEV_ACTION_VAR, batadv_uev_action_str[action]); if (!uevent_env[1]) - goto out; + goto free_first_env; /* If the event is DEL, ignore the data field */ if (action != BATADV_UEV_DEL) { uevent_env[2] = kasprintf(GFP_ATOMIC, "%s%s", BATADV_UEV_DATA_VAR, data); if (!uevent_env[2]) - goto out; + goto free_second_env; } ret = kobject_uevent_env(bat_kobj, KOBJ_CHANGE, uevent_env); -out: - kfree(uevent_env[0]); - kfree(uevent_env[1]); kfree(uevent_env[2]); +free_second_env: + kfree(uevent_env[1]); +free_first_env: + kfree(uevent_env[0]); if (ret) +report_error: batadv_dbg(BATADV_DBG_BATMAN, bat_priv, "Impossible to send uevent for (%s,%s,%s) event (err: %d)\n", batadv_uev_type_str[type], -- linux integration

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

commits January 2024