From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0C3C6C41620 for ; Thu, 19 Mar 2020 13:34:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id CA9782137B for ; Thu, 19 Mar 2020 13:34:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1584624881; bh=P4XLEO7Wra/co4h5lqb13rvEA+kkl2hmiKJ2dvmVNZU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=aTmYD8mB7roEIXHAUbeaZAxRkL6s34ft+ln1Otc4li75mADtS/SmNSunlZ+w2zlkV KWf0sTZqWp/rTNI4LEvRAwljL83rJyfZ53y1jj8E6FX8MorUtzW1jTVR5GWi6mYtGm srEWF1h6dRm0n1X6QK779EWl9KhxfyLOEs/kgBUg= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728989AbgCSNMp (ORCPT ); Thu, 19 Mar 2020 09:12:45 -0400 Received: from mail.kernel.org ([198.145.29.99]:59012 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728983AbgCSNMm (ORCPT ); Thu, 19 Mar 2020 09:12:42 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DF131208D6; Thu, 19 Mar 2020 13:12:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1584623562; bh=P4XLEO7Wra/co4h5lqb13rvEA+kkl2hmiKJ2dvmVNZU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mhX6Pw/Te9GxJPWziNfGJOzxw9zZ6JBmLlF9vcv8hd5e9bkn71ejN8Zh4gybWnDF7 TePUQ72LmlDcaRiUtLWSKnds8cDgbcUFIuxDSnK5ubGE5c9WT7DX4YJTsGAdpPn6ws rG2YB4F+zMJ4uRP68S85g/zR18m4chZ76aFCAuoE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , =?UTF-8?q?Leonardo=20M=F6rlein?= , =?UTF-8?q?Linus=20L=FCssing?= , Simon Wunderlich Subject: [PATCH 4.9 69/90] batman-adv: Fix multicast TT issues with bogus ROAM flags Date: Thu, 19 Mar 2020 14:00:31 +0100 Message-Id: <20200319123949.879419690@linuxfoundation.org> X-Mailer: git-send-email 2.25.2 In-Reply-To: <20200319123928.635114118@linuxfoundation.org> References: <20200319123928.635114118@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Linus Lüssing commit a44ebeff6bbd6ef50db41b4195fca87b21aefd20 upstream. When a (broken) node wrongly sends multicast TT entries with a ROAM flag then this causes any receiving node to drop all entries for the same multicast MAC address announced by other nodes, leading to packet loss. Fix this DoS vector by only storing TT sync flags. For multicast TT non-sync'ing flag bits like ROAM are unused so far anyway. Fixes: 1d8ab8d3c176 ("batman-adv: Modified forwarding behaviour for multicast packets") Reported-by: Leonardo Mörlein Signed-off-by: Linus Lüssing Signed-off-by: Simon Wunderlich Signed-off-by: Greg Kroah-Hartman --- net/batman-adv/translation-table.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -1708,7 +1708,8 @@ static bool batadv_tt_global_add(struct ether_addr_copy(common->addr, tt_addr); common->vid = vid; - common->flags = flags & (~BATADV_TT_SYNC_MASK); + if (!is_multicast_ether_addr(common->addr)) + common->flags = flags & (~BATADV_TT_SYNC_MASK); tt_global_entry->roam_at = 0; /* node must store current time in case of roaming. This is @@ -1772,7 +1773,8 @@ static bool batadv_tt_global_add(struct * TT_CLIENT_TEMP, therefore they have to be copied in the * client entry */ - common->flags |= flags & (~BATADV_TT_SYNC_MASK); + if (!is_multicast_ether_addr(common->addr)) + common->flags |= flags & (~BATADV_TT_SYNC_MASK); /* If there is the BATADV_TT_CLIENT_ROAM flag set, there is only * one originator left in the list and we previously received a