github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

batman-adv: tvlv: enforce 2-byte alignment

Browse Source 
The fields of an aggregated OGM(v2) are accessed assuming (at least) 2-byte
alignment, so a following OGM must start at an even offset. As the header
length is even, an odd tvlv_len would misalign it and trigger unaligned
accesses on strict-alignment architectures.

Such a misaligned TVLV/OGM/OGMv2 is not created by a normal participant in
the mesh. Therefore, reject such malformed packets.

Cc: stable@kernel.org
Fixes: ef26157747 ("batman-adv: tvlv - basic infrastructure")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
This commit is contained in:
Sven Eckelmann 2026-06-14 10:19:54 +02:00
parent 20d7658b74
commit 32a6799255
No known key found for this signature in database
GPG Key ID: 4D0F772BD314F5CB
4 changed files with 32 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
net/batman-adv/bat_iv_ogm.c
View File

@ -316,14 +316,23 @@ batadv_iv_ogm_aggr_packet(int buff_pos, int packet_len,
const struct batadv_ogm_packet *ogm_packet)
{
int next_buff_pos = 0;
u16 tvlv_len;
/* check if there is enough space for the header */
next_buff_pos += buff_pos + sizeof(*ogm_packet);
if (next_buff_pos > packet_len)
return false;
tvlv_len = ntohs(ogm_packet->tvlv_len);
/* the fields of an aggregated OGM are accessed assuming (at least)
* 2-byte alignment, so a following OGM must start at an even offset.
*/
if (tvlv_len & 1)
return false;
/* check if there is enough space for the optional TVLV */
next_buff_pos += ntohs(ogm_packet->tvlv_len);
next_buff_pos += tvlv_len;
return next_buff_pos <= packet_len;
}

11
net/batman-adv/bat_v_ogm.c
View File

@ -849,14 +849,23 @@ batadv_v_ogm_aggr_packet(int buff_pos, int packet_len,
const struct batadv_ogm2_packet *ogm2_packet)
{
int next_buff_pos = 0;
u16 tvlv_len;
/* check if there is enough space for the header */
next_buff_pos += buff_pos + sizeof(*ogm2_packet);
if (next_buff_pos > packet_len)
return false;
tvlv_len = ntohs(ogm2_packet->tvlv_len);
/* the fields of an aggregated OGMv2 are accessed assuming (at least)
* 2-byte alignment, so a following OGMv2 must start at an even offset.
*/
if (tvlv_len & 1)
return false;
/* check if there is enough space for the optional TVLV */
next_buff_pos += ntohs(ogm2_packet->tvlv_len);
next_buff_pos += tvlv_len;
return next_buff_pos <= packet_len;
}

6
net/batman-adv/routing.c
View File

@ -1366,6 +1366,12 @@ int batadv_recv_mcast_packet(struct sk_buff *skb,
if (tvlv_buff_len > skb->len - hdr_size)
goto free_skb;
/* the fields of an multicast payload are accessed assuming (at least)
* 2-byte alignment, so a following packet must start at an even offset.
*/
if (tvlv_buff_len & 1)
goto free_skb;
ret = batadv_tvlv_containers_process(bat_priv, BATADV_MCAST, NULL, skb,
tvlv_buff, tvlv_buff_len);
if (ret >= 0) {

6
net/batman-adv/tvlv.c
View File

@ -477,6 +477,12 @@ int batadv_tvlv_containers_process(struct batadv_priv *bat_priv,
if (tvlv_value_cont_len > tvlv_value_len)
break;
/* the next tvlv header is accessed assuming (at least) 2-byte
* alignment, so it must start at an even offset.
*/
if (tvlv_value_cont_len & 1)
break;
tvlv_handler = batadv_tvlv_handler_get(bat_priv,
tvlv_hdr->type,
tvlv_hdr->version);