Commit f2f7358c authored by Remi Pommarel's avatar Remi Pommarel Committed by Simon Wunderlich
Browse files

batman-adv: Do not send uninitialized TT changes 



The number of TT changes can be less than initially expected in
batadv_tt_tvlv_container_update() (changes can be removed by
batadv_tt_local_event() in ADD+DEL sequence between reading
tt_diff_entries_num and actually iterating the change list under lock).

Thus tt_diff_len could be bigger than the actual changes size that need
to be sent. Because batadv_send_my_tt_response sends the whole
packet, uninitialized data can be interpreted as TT changes on other
nodes leading to weird TT global entries on those nodes such as:

 * 00:00:00:00:00:00   -1 [....] (  0) 88:12:4e:ad:7e:ba (179) (0x45845380)
 * 00:00:00:00:78:79 4092 [.W..] (  0) 88:12:4e:ad:7e:3c (145) (0x8ebadb8b)

All of the above also applies to OGM tvlv container buffer's tvlv_len.

Remove the extra allocated space to avoid sending uninitialized TT
changes in batadv_send_my_tt_response() and batadv_v_ogm_send_softif().

Fixes: e1bf0c14 ("batman-adv: tvlv - convert tt data sent within OGMs")
Signed-off-by: default avatarRemi Pommarel <repk@triplefau.lt>
Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
Signed-off-by: default avatarSimon Wunderlich <sw@simonwunderlich.de>
parent 40384c84

net/batman-adv/translation-table.c

+7 −0
Original line number Diff line number Diff line
@@ -948,6 +948,7 @@ static void batadv_tt_tvlv_container_update(struct batadv_priv *bat_priv) 
	int tt_diff_len, tt_change_len = 0;

	int tt_diff_entries_num = 0;

	int tt_diff_entries_count = 0;

	size_t tt_extra_len = 0;

	u16 tvlv_len;



	tt_diff_entries_num = atomic_read(&bat_priv->tt.local_changes);
@@ -985,6 +986,9 @@ static void batadv_tt_tvlv_container_update(struct batadv_priv *bat_priv) 
	}

	spin_unlock_bh(&bat_priv->tt.changes_list_lock);



	tt_extra_len = batadv_tt_len(tt_diff_entries_num -

				     tt_diff_entries_count);



	/* Keep the buffer for possible tt_request */

	spin_lock_bh(&bat_priv->tt.last_changeset_lock);

	kfree(bat_priv->tt.last_changeset);
@@ -993,6 +997,7 @@ static void batadv_tt_tvlv_container_update(struct batadv_priv *bat_priv) 
	tt_change_len = batadv_tt_len(tt_diff_entries_count);

	/* check whether this new OGM has no changes due to size problems */

	if (tt_diff_entries_count > 0) {

		tt_diff_len -= tt_extra_len;

		/* if kmalloc() fails we will reply with the full table

		 * instead of providing the diff

		 */
@@ -1005,6 +1010,8 @@ static void batadv_tt_tvlv_container_update(struct batadv_priv *bat_priv) 
	}

	spin_unlock_bh(&bat_priv->tt.last_changeset_lock);



	/* Remove extra packet space for OGM */

	tvlv_len -= tt_extra_len;

container_register:

	batadv_tvlv_container_register(bat_priv, BATADV_TVLV_TT, 1, tt_data,

				       tvlv_len);