Repository : ssh://git@diktynna/batctl On branches: main,main
commit 18dea5a4186796679b65de313ef04cb62eeb39ac Author: Erick Archer erick.archer@outlook.com Date: Fri Jun 7 18:19:12 2024 +0200
batctl: Add flex array to struct batadv_tvlv_tt_data
The "struct batadv_tvlv_tt_data" uses a dynamically sized set of trailing elements. Specifically, it uses an array of structures of type "batadv_tvlv_tt_vlan_data". So, use the preferred way in the kernel declaring a flexible array [1].
At the same time, prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). In this case, it is important to note that the attribute used is specifically __counted_by_be since variable "num_vlan" is of type __be16.
The following change to the "batadv_tt_tvlv_ogm_handler_v1" function:
- tt_vlan = (struct batadv_tvlv_tt_vlan_data *)(tt_data + 1); - tt_change = (struct batadv_tvlv_tt_change *)(tt_vlan + num_vlan);
+ tt_change = (struct batadv_tvlv_tt_change *)((void *)tt_data + + flex_size);
is intended to prevent the compiler from generating an "out-of-bounds" notification due to the __counted_by attribute. The compiler can do a pointer calculation using the vlan_data flexible array memory, or in other words, this may be calculated as an array offset, since it is the same as:
&tt_data->vlan_data[num_vlan]
Therefore, we go past the end of the array. In other "multiple trailing flexible array" situations, this has been solved by addressing from the base pointer, since the compiler either knows the full allocation size or it knows nothing about it (this case, since it came from a "void *" function argument).
The order in which the structure batadv_tvlv_tt_data and the structure batadv_tvlv_tt_vlan_data are defined must be swap to avoid an incomplete type error.
Link: https://www.kernel.org/doc/html/next/process/deprecated.html#zero-length-and... [1] Link: https://www.kernel.org/doc/html/next/process/deprecated.html#open-coded-arit... [2] Reviewed-by: Kees Cook keescook@chromium.org Signed-off-by: Erick Archer erick.archer@outlook.com Signed-off-by: Sven Eckelmann sven@narfation.org
18dea5a4186796679b65de313ef04cb62eeb39ac backbonetable.c | 2 +- batadv_packet.h | 29 ++++++++++++++++------------- batadv_packet_compat.h | 20 ++++++++++++++++++++ claimtable.c | 2 +- dat_cache.c | 1 - event.c | 1 - gateways.c | 1 - genl_json.c | 2 +- icmp_helper.c | 2 +- icmp_helper.h | 2 +- main.h | 4 ++-- mcast_flags.c | 2 +- neighbors.c | 1 - netlink.c | 1 - originators.c | 1 - ping.c | 2 +- routing_algo.c | 1 - tcpdump.c | 2 +- throughputmeter.c | 1 - traceroute.c | 2 +- transglobal.c | 1 - translocal.c | 1 - 22 files changed, 47 insertions(+), 34 deletions(-)
diff --git a/backbonetable.c b/backbonetable.c index 17fbd1d..db4b4ba 100644 --- a/backbonetable.c +++ b/backbonetable.c @@ -14,7 +14,7 @@ #include <stdlib.h> #include <stdint.h>
-#include "batadv_packet.h" +#include "batadv_packet_compat.h" #include "batman_adv.h" #include "bat-hosts.h" #include "debug.h" diff --git a/batadv_packet.h b/batadv_packet.h index 6e25753..439132a 100644 --- a/batadv_packet.h +++ b/batadv_packet.h @@ -9,6 +9,7 @@
#include <asm/byteorder.h> #include <linux/if_ether.h> +#include <linux/stddef.h> #include <linux/types.h>
/** @@ -592,19 +593,6 @@ struct batadv_tvlv_gateway_data { __be32 bandwidth_up; };
-/** - * struct batadv_tvlv_tt_data - tt data propagated through the tt tvlv container - * @flags: translation table flags (see batadv_tt_data_flags) - * @ttvn: translation table version number - * @num_vlan: number of announced VLANs. In the TVLV this struct is followed by - * one batadv_tvlv_tt_vlan_data object per announced vlan - */ -struct batadv_tvlv_tt_data { - __u8 flags; - __u8 ttvn; - __be16 num_vlan; -}; - /** * struct batadv_tvlv_tt_vlan_data - vlan specific tt data propagated through * the tt tvlv container @@ -618,6 +606,21 @@ struct batadv_tvlv_tt_vlan_data { __u16 reserved; };
+/** + * struct batadv_tvlv_tt_data - tt data propagated through the tt tvlv container + * @flags: translation table flags (see batadv_tt_data_flags) + * @ttvn: translation table version number + * @num_vlan: number of announced VLANs. In the TVLV this struct is followed by + * one batadv_tvlv_tt_vlan_data object per announced vlan + * @vlan_data: array of batadv_tvlv_tt_vlan_data objects + */ +struct batadv_tvlv_tt_data { + __u8 flags; + __u8 ttvn; + __be16 num_vlan; + struct batadv_tvlv_tt_vlan_data vlan_data[] __counted_by_be(num_vlan); +}; + /** * struct batadv_tvlv_tt_change - translation table diff data * @flags: status indicators concerning the non-mesh client (see diff --git a/batadv_packet_compat.h b/batadv_packet_compat.h new file mode 100644 index 0000000..ee99fb0 --- /dev/null +++ b/batadv_packet_compat.h @@ -0,0 +1,20 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* Copyright (C) B.A.T.M.A.N. contributors: + * + * Andreas Langer an.langer@gmx.de, Marek Lindner mareklindner@neomailbox.ch + * + * License-Filename: LICENSES/preferred/GPL-2.0 + */ + +#ifndef _BATCTL_BATADV_PACKET_COMPAT_H +#define _BATCTL_BATADV_PACKET_COMPAT_H + +#include <linux/stddef.h> + +#ifndef __counted_by_be +#define __counted_by_be(m) +#endif + +#include "batadv_packet.h" + +#endif diff --git a/claimtable.c b/claimtable.c index b6bf9f5..10691b7 100644 --- a/claimtable.c +++ b/claimtable.c @@ -14,7 +14,7 @@ #include <stdlib.h> #include <stdint.h>
-#include "batadv_packet.h" +#include "batadv_packet_compat.h" #include "batman_adv.h" #include "bat-hosts.h" #include "debug.h" diff --git a/dat_cache.c b/dat_cache.c index 8d47171..b51ecc9 100644 --- a/dat_cache.c +++ b/dat_cache.c @@ -17,7 +17,6 @@ #include <stdint.h> #include <sys/socket.h>
-#include "batadv_packet.h" #include "batman_adv.h" #include "bat-hosts.h" #include "debug.h" diff --git a/event.c b/event.c index 274f99f..c2e4941 100644 --- a/event.c +++ b/event.c @@ -18,7 +18,6 @@ #include <stdint.h> #include <sys/time.h>
-#include "batadv_packet.h" #include "batman_adv.h" #include "bat-hosts.h" #include "debug.h" diff --git a/gateways.c b/gateways.c index bdd6795..f5b8a44 100644 --- a/gateways.c +++ b/gateways.c @@ -17,7 +17,6 @@ #include <stdlib.h> #include <string.h>
-#include "batadv_packet.h" #include "batman_adv.h" #include "bat-hosts.h" #include "debug.h" diff --git a/genl_json.c b/genl_json.c index 4cb1baf..2c2c5c3 100644 --- a/genl_json.c +++ b/genl_json.c @@ -22,7 +22,7 @@ #include <unistd.h>
#include "functions.h" -#include "batadv_packet.h" +#include "batadv_packet_compat.h" #include "batman_adv.h" #include "netlink.h"
diff --git a/icmp_helper.c b/icmp_helper.c index cbb6122..f0b5082 100644 --- a/icmp_helper.c +++ b/icmp_helper.c @@ -26,7 +26,7 @@ #include <sys/uio.h> #include <unistd.h>
-#include "batadv_packet.h" +#include "batadv_packet_compat.h" #include "debug.h" #include "functions.h" #include "list.h" diff --git a/icmp_helper.h b/icmp_helper.h index 5eed55e..d117993 100644 --- a/icmp_helper.h +++ b/icmp_helper.h @@ -19,10 +19,10 @@ #include <stddef.h> #include <stdint.h>
-#include "batadv_packet.h" #include "list.h"
struct timeval; +struct batadv_icmp_header;
struct icmp_interface { char name[IFNAMSIZ]; diff --git a/main.h b/main.h index b69f02b..14af61e 100644 --- a/main.h +++ b/main.h @@ -39,8 +39,8 @@ extern char module_ver_path[]; #define VLAN_VID_MASK 0xfff #endif
-#define BATADV_PRINT_VID(vid) (vid & BATADV_VLAN_HAS_TAG ? \ - (int)(vid & VLAN_VID_MASK) : -1) +#define BATADV_PRINT_VID(vid) ((vid) & (1UL << 15) ? \ + (int)((vid) & 0xfff) : -1)
#define ARRAY_SIZE(x) (sizeof(x) / sizeof(*(x)))
diff --git a/mcast_flags.c b/mcast_flags.c index 7d4c1d6..819f767 100644 --- a/mcast_flags.c +++ b/mcast_flags.c @@ -17,7 +17,7 @@ #include <stdlib.h> #include <stdint.h>
-#include "batadv_packet.h" +#include "batadv_packet_compat.h" #include "batman_adv.h" #include "bat-hosts.h" #include "debug.h" diff --git a/neighbors.c b/neighbors.c index f34952b..f3de544 100644 --- a/neighbors.c +++ b/neighbors.c @@ -16,7 +16,6 @@ #include <stdlib.h> #include <stdint.h>
-#include "batadv_packet.h" #include "batman_adv.h" #include "bat-hosts.h" #include "debug.h" diff --git a/netlink.c b/netlink.c index e92fa80..8e0162d 100644 --- a/netlink.c +++ b/netlink.c @@ -23,7 +23,6 @@ #include <arpa/inet.h>
#include "bat-hosts.h" -#include "batadv_packet.h" #include "batman_adv.h" #include "netlink.h" #include "functions.h" diff --git a/originators.c b/originators.c index 9f4f526..e687078 100644 --- a/originators.c +++ b/originators.c @@ -18,7 +18,6 @@ #include <stdint.h> #include <string.h>
-#include "batadv_packet.h" #include "batman_adv.h" #include "bat-hosts.h" #include "debug.h" diff --git a/ping.c b/ping.c index 3681e7e..52bce4d 100644 --- a/ping.c +++ b/ping.c @@ -23,7 +23,7 @@ #include <sys/time.h> #include <netinet/if_ether.h>
-#include "batadv_packet.h" +#include "batadv_packet_compat.h" #include "main.h" #include "functions.h" #include "bat-hosts.h" diff --git a/routing_algo.c b/routing_algo.c index 0adf32f..bff1e90 100644 --- a/routing_algo.c +++ b/routing_algo.c @@ -22,7 +22,6 @@ #include <sys/types.h> #include <unistd.h>
-#include "batadv_packet.h" #include "batman_adv.h" #include "debug.h" #include "functions.h" diff --git a/tcpdump.c b/tcpdump.c index 1a9c3af..bed0243 100644 --- a/tcpdump.c +++ b/tcpdump.c @@ -33,7 +33,7 @@ #include <sys/select.h> #include <sys/socket.h>
-#include "batadv_packet.h" +#include "batadv_packet_compat.h" #include "tcpdump.h" #include "bat-hosts.h" #include "functions.h" diff --git a/throughputmeter.c b/throughputmeter.c index fb1e35b..16016e7 100644 --- a/throughputmeter.c +++ b/throughputmeter.c @@ -27,7 +27,6 @@ #include <unistd.h>
#include "bat-hosts.h" -#include "batadv_packet.h" #include "batman_adv.h" #include "functions.h" #include "genl.h" diff --git a/traceroute.c b/traceroute.c index 40e1e8f..d63ae87 100644 --- a/traceroute.c +++ b/traceroute.c @@ -20,7 +20,7 @@ #include <sys/select.h> #include <sys/time.h>
-#include "batadv_packet.h" +#include "batadv_packet_compat.h" #include "main.h" #include "functions.h" #include "bat-hosts.h" diff --git a/transglobal.c b/transglobal.c index 4eae95d..ea5a943 100644 --- a/transglobal.c +++ b/transglobal.c @@ -15,7 +15,6 @@ #include <stdlib.h> #include <stdint.h>
-#include "batadv_packet.h" #include "batman_adv.h" #include "bat-hosts.h" #include "debug.h" diff --git a/translocal.c b/translocal.c index bac6be9..2fbae01 100644 --- a/translocal.c +++ b/translocal.c @@ -15,7 +15,6 @@ #include <stdlib.h> #include <stdint.h>
-#include "batadv_packet.h" #include "batman_adv.h" #include "bat-hosts.h" #include "debug.h"