Re: [B.A.T.M.A.N.] [PATCH maint v2] batman-adv: Avoid race in TT TVLV allocator helper

[Antonio Quartulli <a@unstable.cc>]

[-- Attachment #1.1: Type: text/plain, Size: 1423 bytes --]

On 10/05/18 03:07, Sven Eckelmann wrote:
> The functions batadv_tt_prepare_tvlv_local_data and
> batadv_tt_prepare_tvlv_global_data are responsible for preparing a buffer
> which can be used to store the TVLV container for TT and add the VLAN
> information to it.
> 
> This will be done in three phases:
> 
> 1. count the number of VLANs and their entries
> 2. allocate the buffer using the counters from the previous step and limits
>    from the caller (parameter tt_len)
> 3. insert the VLAN information to the buffer
> 
> The step 1 and 3 operate on a list which contains the VLANs. The access to
> these lists must be protected with an appropriate lock or otherwise they
> might operate on on different entries. This could for example happen when
> another context is adding VLAN entries to this list.
> 
> This could lead to a buffer overflow in these functions when enough entries
> were added between step 1 and 3 to the VLAN lists that the buffer room for
> the entries (*tt_change) is smaller then the now required extra buffer for
> new VLAN entries.
> 
> Fixes: 21a57f6e7a3b ("batman-adv: make the TT CRC logic VLAN specific")
> Signed-off-by: Sven Eckelmann <sven@narfation.org>

Acked-by: Antonio Quartulli <a@unstable.cc>

Good catch. Unfortunately this issue was caused by my misunderstanding
of the RCU mechanism when used with lists.


Cheers,

-- 
Antonio Quartulli


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]