[B.A.T.M.A.N.] [PATCH 1/3] batman-adv: protect against ogm packet overflow by checking table length

[B.A.T.M.A.N.] [PATCH 1/3] batman-adv: protect against ogm packet overflow by checking table length

[Marek Lindner]

Reported-by: Sam Yeung <sam.cwyeung@gmail.com>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
---
 batman-adv/translation-table.c |    9 +++++++--
 1 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/batman-adv/translation-table.c b/batman-adv/translation-table.c
index 9cae140..75c8ce0 100644
--- a/batman-adv/translation-table.c
+++ b/batman-adv/translation-table.c
@@ -60,6 +60,7 @@ void hna_local_add(struct net_device *soft_iface, uint8_t *addr)
 	struct hna_global_entry *hna_global_entry;
 	struct hashtable_t *swaphash;
 	unsigned long flags;
+	int required_bytes;
 
 	spin_lock_irqsave(&bat_priv->hna_lhash_lock, flags);
 	hna_local_entry =
@@ -75,8 +76,12 @@ void hna_local_add(struct net_device *soft_iface, uint8_t *addr)
 	/* only announce as many hosts as possible in the batman-packet and
 	   space in batman_packet->num_hna That also should give a limit to
 	   MAC-flooding. */
-	if ((bat_priv->num_local_hna + 1 > (ETH_DATA_LEN - BAT_PACKET_LEN)
-								/ ETH_ALEN) ||
+	required_bytes = (bat_priv->num_local_hna + 1) * ETH_ALEN;
+	required_bytes += BAT_PACKET_LEN;
+
+	if ((required_bytes > ETH_DATA_LEN) ||
+	    (atomic_read(&bat_priv->aggregation_enabled) &&
+	     required_bytes > MAX_AGGREGATION_BYTES) ||
 	    (bat_priv->num_local_hna + 1 > 255)) {
 		bat_dbg(DBG_ROUTES, bat_priv,
 			"Can't add new local hna entry (%pM): "
-- 
1.7.1

[B.A.T.M.A.N.] [PATCH 2/3] batman-adv: fix crash when new OGM is generated

[Marek Lindner]

If aggregation is not enabled the local translation table can grow
much bigger and expects to fill a full ethernet packet.

Reported-by: Sam Yeung <sam.cwyeung@gmail.com>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
---
 batman-adv/aggregation.c |   10 ++++++++--
 1 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/batman-adv/aggregation.c b/batman-adv/aggregation.c
index 46b9c2b..16b268e 100644
--- a/batman-adv/aggregation.c
+++ b/batman-adv/aggregation.c
@@ -123,8 +123,14 @@ static void new_aggregated_packet(unsigned char *packet_buff, int packet_len,
 		return;
 	}
 
-	forw_packet_aggr->skb = dev_alloc_skb(MAX_AGGREGATION_BYTES +
-					      sizeof(struct ethhdr));
+	if ((atomic_read(&bat_priv->aggregation_enabled)) &&
+	    (packet_len < MAX_AGGREGATION_BYTES))
+		forw_packet_aggr->skb = dev_alloc_skb(MAX_AGGREGATION_BYTES +
+						      sizeof(struct ethhdr));
+	else
+		forw_packet_aggr->skb = dev_alloc_skb(packet_len +
+						      sizeof(struct ethhdr));
+
 	if (!forw_packet_aggr->skb) {
 		if (!own_packet)
 			atomic_inc(&bat_priv->batman_queue_left);
-- 
1.7.1

[B.A.T.M.A.N.] [PATCH 3/3] batman-adv: process OGMs bigger than MAX_AGGREGATION_BYTES

[Marek Lindner]

Reported-by: Sam Yeung <sam.cwyeung@gmail.com>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
---
 batman-adv/aggregation.c |    7 +++----
 1 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/batman-adv/aggregation.c b/batman-adv/aggregation.c
index 16b268e..08624d4 100644
--- a/batman-adv/aggregation.c
+++ b/batman-adv/aggregation.c
@@ -257,9 +257,7 @@ void receive_aggr_bat_packet(struct ethhdr *ethhdr, unsigned char *packet_buff,
 
 	batman_packet = (struct batman_packet *)packet_buff;
 
-	while (aggregated_packet(buff_pos, packet_len,
-				 batman_packet->num_hna)) {
-
+	do {
 		/* network to host order for our 32bit seqno, and the
 		   orig_interval. */
 		batman_packet->seqno = ntohl(batman_packet->seqno);
@@ -272,5 +270,6 @@ void receive_aggr_bat_packet(struct ethhdr *ethhdr, unsigned char *packet_buff,
 		buff_pos += BAT_PACKET_LEN + hna_len(batman_packet);
 		batman_packet = (struct batman_packet *)
 			(packet_buff + buff_pos);
-	}
+	} while (aggregated_packet(buff_pos, packet_len,
+				   batman_packet->num_hna));
 }
-- 
1.7.1

Re: [B.A.T.M.A.N.] [PATCH 1/3] batman-adv: protect against ogm packet overflow by checking table length

[Marek Lindner]

On Friday 15 October 2010 17:43:35 Marek Lindner wrote:
> Reported-by: Sam Yeung <sam.cwyeung@gmail.com>

Applied in revision 1830-1832.

Regards,
Marek