lkml.org 
[lkml]   [2018]   [May]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 202/329] batman-adv: fix header size check in batadv_dbg_arp()
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Matthias Schiffer <mschiffer@universe-factory.net>

    [ Upstream commit 6f27d2c2a8c236d296201c19abb8533ec20d212b ]

    Checking for 0 is insufficient: when an SKB without a batadv header, but
    with a VLAN header is received, hdr_size will be 4, making the following
    code interpret the Ethernet header as a batadv header.

    Fixes: be1db4f6615b ("batman-adv: make the Distributed ARP Table vlan aware")
    Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
    Signed-off-by: Sven Eckelmann <sven@narfation.org>
    Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/batman-adv/distributed-arp-table.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/net/batman-adv/distributed-arp-table.c
    +++ b/net/batman-adv/distributed-arp-table.c
    @@ -391,7 +391,7 @@ static void batadv_dbg_arp(struct batadv
    batadv_arp_hw_src(skb, hdr_size), &ip_src,
    batadv_arp_hw_dst(skb, hdr_size), &ip_dst);

    - if (hdr_size == 0)
    + if (hdr_size < sizeof(struct batadv_unicast_packet))
    return;

    unicast_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data;

    \
     
     \ /
      Last update: 2018-05-28 16:20    [W:4.419 / U:0.316 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site