From patchwork Mon Dec 1 12:59:44 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Sven Eckelmann X-Patchwork-Id: 4304 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=79.140.41.39; helo=v3-1039.vlinux.de; envelope-from=sven@narfation.org; receiver=b.a.t.m.a.n@lists.open-mesh.org Received: from v3-1039.vlinux.de (narfation.org [79.140.41.39]) by open-mesh.org (Postfix) with ESMTPS id 0A66B6015F0 for ; Mon, 1 Dec 2014 13:59:50 +0100 (CET) Received: from sven-desktop.home.narfation.org (unknown [IPv6:2a02:3100:2607:89fd::2e16]) by v3-1039.vlinux.de (Postfix) with ESMTPSA id 721701100D1; Mon, 1 Dec 2014 13:59:50 +0100 (CET) From: Sven Eckelmann To: b.a.t.m.a.n@lists.open-mesh.org Date: Mon, 1 Dec 2014 13:59:44 +0100 Message-Id: <1417438784-20880-1-git-send-email-sven@narfation.org> X-Mailer: git-send-email 2.1.3 Cc: Sven Eckelmann Subject: [B.A.T.M.A.N.] [PATCH] batman-adv: Unify fragment size calculation X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Dec 2014 12:59:51 -0000 The fragmentation code was replaced in 9b3eab61754d74a93c9840c296013fe3b4a1b606 ("batman-adv: Receive fragmented packets and merge") by an implementation which can handle up to 16 fragments of a packet. The packet is prepared for the split in fragments by the function batadv_frag_send_packet and the actual split is done by batadv_frag_create. Both functions calculate the size of a fragment themself. But their calculation differs because batadv_frag_send_packet also subtracts ETH_HLEN. Therefore, the check in batadv_frag_send_packet if a full fragment can be created may return true even when batadv_frag_create cannot create a full fragment. The function batadv_frag_create doesn't check the size of the skb before splitting it and therefore might try to create a larger fragment than the remaining buffer. This creates an integer underflow and an invalid len is given to skb_split. Signed-off-by: Sven Eckelmann Acked-by: Martin Hundebøll --- fragmentation.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fragmentation.c b/fragmentation.c index 0ab228f..9e06457 100644 --- a/fragmentation.c +++ b/fragmentation.c @@ -433,7 +433,7 @@ bool batadv_frag_send_packet(struct sk_buff *skb, * fragments larger than BATADV_FRAG_MAX_FRAG_SIZE */ mtu = min_t(unsigned, mtu, BATADV_FRAG_MAX_FRAG_SIZE); - max_fragment_size = (mtu - header_size - ETH_HLEN); + max_fragment_size = mtu - header_size; max_packet_size = max_fragment_size * BATADV_FRAG_MAX_FRAGMENTS; /* Don't even try to fragment, if we need more than 16 fragments */