[linux-next] LinuxNextTracking branch, master, updated. next-20141226

batman at open-mesh.org batman at open-mesh.org
Sat Dec 27 00:17:57 CET 2014


The following commit has been merged in the master branch:
commit 0402e444cd199389b7fe47be68a67b817e09e097
Author: Sven Eckelmann <sven at narfation.org>
Date:   Sat Dec 20 13:48:56 2014 +0100

    batman-adv: Unify fragment size calculation
    
    The fragmentation code was replaced in 610bfc6bc99bc83680d190ebc69359a05fc7f605
    ("batman-adv: Receive fragmented packets and merge") by an implementation which
    can handle up to 16 fragments of a packet. The packet is prepared for the split
    in fragments by the function batadv_frag_send_packet and the actual split is
    done by batadv_frag_create.
    
    Both functions calculate the size of a fragment themself. But their calculation
    differs because batadv_frag_send_packet also subtracts ETH_HLEN. Therefore,
    the check in batadv_frag_send_packet "can a full fragment can be created?" may
    return true even when batadv_frag_create cannot create a full fragment.
    
    The function batadv_frag_create doesn't check the size of the skb before
    splitting it and therefore might try to create a larger fragment than the
    remaining buffer. This creates an integer underflow and an invalid len is given
    to skb_split.
    
    Signed-off-by: Sven Eckelmann <sven at narfation.org>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index 8af3461..00f9e14 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -434,7 +434,7 @@ bool batadv_frag_send_packet(struct sk_buff *skb,
 	 * fragments larger than BATADV_FRAG_MAX_FRAG_SIZE
 	 */
 	mtu = min_t(unsigned, mtu, BATADV_FRAG_MAX_FRAG_SIZE);
-	max_fragment_size = (mtu - header_size - ETH_HLEN);
+	max_fragment_size = mtu - header_size;
 	max_packet_size = max_fragment_size * BATADV_FRAG_MAX_FRAGMENTS;
 
 	/* Don't even try to fragment, if we need more than 16 fragments */

-- 
LinuxNextTracking


More information about the linux-merge mailing list