From patchwork Wed Sep 19 12:22:03 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Simon Wunderlich X-Patchwork-Id: 17483 X-Patchwork-Delegate: sw@simonwunderlich.de Return-Path: X-Original-To: patchwork@open-mesh.org Delivered-To: patchwork@open-mesh.org Received: from open-mesh.org (localhost [IPv6:::1]) by open-mesh.org (Postfix) with ESMTP id 9879782326; Wed, 19 Sep 2018 14:22:16 +0200 (CEST) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=2001:4d88:2000:24::c0de; helo=mail.mail.packetmixer.de; envelope-from=sw@simonwunderlich.de; receiver= Received: from mail.mail.packetmixer.de (packetmixer.de [IPv6:2001:4d88:2000:24::c0de]) by open-mesh.org (Postfix) with ESMTPS id E1BC181FE7 for ; Wed, 19 Sep 2018 14:22:15 +0200 (CEST) Received: from kero.packetmixer.de (p200300C593D42E00B540A3BB6637942E.dip0.t-ipconnect.de [IPv6:2003:c5:93d4:2e00:b540:a3bb:6637:942e]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.mail.packetmixer.de (Postfix) with ESMTPSA id 516B562050; Wed, 19 Sep 2018 14:22:15 +0200 (CEST) From: Simon Wunderlich To: davem@davemloft.net Date: Wed, 19 Sep 2018 14:22:03 +0200 Message-Id: <20180919122213.23108-2-sw@simonwunderlich.de> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180919122213.23108-1-sw@simonwunderlich.de> References: <20180919122213.23108-1-sw@simonwunderlich.de> Subject: [B.A.T.M.A.N.] [PATCH 01/11] batman-adv: Avoid probe ELP information leak X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking Cc: netdev@vger.kernel.org, b.a.t.m.a.n@lists.open-mesh.org Errors-To: b.a.t.m.a.n-bounces@lists.open-mesh.org Sender: "B.A.T.M.A.N" From: Sven Eckelmann The probe ELPs for WiFi interfaces are expanded to contain at least BATADV_ELP_MIN_PROBE_SIZE bytes. This is usually a lot more than the number of bytes which the template ELP packet requires. These extra padding bytes were not initialized and thus could contain data which were previously stored at the same location. It is therefore required to set it to some predefined or random values to avoid leaking private information from the system transmitting these kind of packets. Fixes: e4623c913508 ("batman-adv: Avoid probe ELP information leak") Signed-off-by: Sven Eckelmann Acked-by: Antonio Quartulli Signed-off-by: Simon Wunderlich --- net/batman-adv/bat_v_elp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c index 71c20c1d4002..e103c759b7ab 100644 --- a/net/batman-adv/bat_v_elp.c +++ b/net/batman-adv/bat_v_elp.c @@ -241,7 +241,7 @@ batadv_v_elp_wifi_neigh_probe(struct batadv_hardif_neigh_node *neigh) * the packet to be exactly of that size to make the link * throughput estimation effective. */ - skb_put(skb, probe_len - hard_iface->bat_v.elp_skb->len); + skb_put_zero(skb, probe_len - hard_iface->bat_v.elp_skb->len); batadv_dbg(BATADV_DBG_BATMAN, bat_priv, "Sending unicast (probe) ELP packet on interface %s to %pM\n",