From patchwork Fri Jun 21 14:39:14 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Simon Wunderlich X-Patchwork-Id: 18653 X-Patchwork-Delegate: sw@simonwunderlich.de Return-Path: X-Original-To: patchwork@open-mesh.org Delivered-To: patchwork@open-mesh.org Received: from diktynna.open-mesh.org (localhost [IPv6:::1]) by diktynna.open-mesh.org (Postfix) with ESMTP id 68A01835CA for ; Fri, 21 Jun 2024 16:40:27 +0200 (CEST) ARC-Seal: i=2; cv=pass; a=rsa-sha256; d=open-mesh.org; s=20121; t=1718980827; b=WwBdvR7KM8KuK37jkvnKcJCdaGSsc2q6G+653Ub6R/ooX/9Krqk50A1jcOuH5fGWUJRzm fhtAxqHdk9Rfw1LRsVesWaTgylB5pW0qatuaTzVXOKRKHE5jHeKugtmVjIKMAWhVgRVsBdS sfiH3I2a9bRYLzDgFZnKUKOpiK/nzRk= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=open-mesh.org; s=20121; t=1718980827; h=from : sender : reply-to : subject : date : message-id : to : cc : mime-version : content-type : content-transfer-encoding : content-id : content-description : resent-date : resent-from : resent-sender : resent-to : resent-cc : resent-message-id : in-reply-to : references : list-id : list-help : list-unsubscribe : list-subscribe : list-post : list-owner : list-archive; bh=Nrjk2IMCUn2HY56O4Q0YieosIzW7xt+NJNtnjPeqhQM=; b=JxOyp5fRdlleFmIZ6uV97XPPlpj9uGL42GbaiRY7RieUbyCQ/3Xq0ZWNvoDP+hx2KxUon 1+hL7w+5BCLikvAB9W8IvtTZJwI9iihKdt1mL3efOcC+sOJLF0mXywE+jwMqB7V0sKEbHgl at6HRr3Vuk+9+WMvS96cKzVM9ElaULY= ARC-Authentication-Results: i=2; open-mesh.org; dkim=fail; arc=pass; dmarc=fail (Used From Domain Record) header.from=simonwunderlich.de policy.dmarc=none Authentication-Results: open-mesh.org; dkim=fail; arc=pass; dmarc=fail (Used From Domain Record) header.from=simonwunderlich.de policy.dmarc=none Received: from mail.simonwunderlich.de (mail.simonwunderlich.de [23.88.38.48]) by diktynna.open-mesh.org (Postfix) with ESMTPS id 5B1E2825E9 for ; Fri, 21 Jun 2024 16:39:24 +0200 (CEST) ARC-Seal: i=1; s=20121; d=open-mesh.org; t=1718980764; a=rsa-sha256; cv=none; b=dF1xaihXJnh2S8kiCcRzwoT0KGFQECBQjKZaSgIPXllJ7kCIicAF07R1zzGe6EC9JI6cR+ tnthV3gKzn9PXFVQp5hgXO8mLQ6oMW8NiUohn/GEPZ8/Ob8SPw8rR+jeLfM26XSRii/SzQ /mqDiXDIpi6XVdXSPH96PGx/qoMqnKc= ARC-Authentication-Results: i=1; diktynna.open-mesh.org; dkim=none; dmarc=pass (policy=none) header.from=simonwunderlich.de; spf=pass (diktynna.open-mesh.org: domain of sw@simonwunderlich.de designates 23.88.38.48 as permitted sender) smtp.mailfrom=sw@simonwunderlich.de ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=open-mesh.org; s=20121; t=1718980764; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Nrjk2IMCUn2HY56O4Q0YieosIzW7xt+NJNtnjPeqhQM=; b=MFE80D05ZnQYtPSyJT3V8Ba3pAwF7qqhDdQVSrEX5eG+2XYOM7juuf3ih3+b9feII7Z6MZ vVB91zxqme0vnJ1AiUMnqf6kwqV2sYyhEszn+UFARGC5GZTF+BKEyzCawM6dArkcOUiU/v hRpxANIk/cWiv1xsq0lLHQzSvIoOf9o= Received: from kero.packetmixer.de (p200300c5970FCfd871714591023aA0cD.dip0.t-ipconnect.de [IPv6:2003:c5:970f:cfd8:7171:4591:23a:a0cd]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (prime256v1) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mail.simonwunderlich.de (Postfix) with ESMTPSA id B531EFA132; Fri, 21 Jun 2024 16:39:22 +0200 (CEST) From: Simon Wunderlich To: davem@davemloft.net, kuba@kernel.org Cc: netdev@vger.kernel.org, b.a.t.m.a.n@lists.open-mesh.org, Sven Eckelmann , stable@vger.kernel.org, =?utf-8?q?Linu?= =?utf-8?q?s_L=C3=BCssing?= , Simon Wunderlich Subject: [PATCH 1/2] batman-adv: Don't accept TT entries for out-of-spec VIDs Date: Fri, 21 Jun 2024 16:39:14 +0200 Message-Id: <20240621143915.49137-2-sw@simonwunderlich.de> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20240621143915.49137-1-sw@simonwunderlich.de> References: <20240621143915.49137-1-sw@simonwunderlich.de> MIME-Version: 1.0 Message-ID-Hash: I3ASOKTOP2GHDTPFDT7WXS3NLGFR4A3W X-Message-ID-Hash: I3ASOKTOP2GHDTPFDT7WXS3NLGFR4A3W X-MailFrom: sw@simonwunderlich.de X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-b.a.t.m.a.n.lists.open-mesh.org-0; header-match-b.a.t.m.a.n.lists.open-mesh.org-1; header-match-b.a.t.m.a.n.lists.open-mesh.org-2; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.8 Precedence: list List-Id: The list for a Better Approach To Mobile Ad-hoc Networking Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Sven Eckelmann The internal handling of VLAN IDs in batman-adv is only specified for following encodings: * VLAN is used - bit 15 is 1 - bit 11 - bit 0 is the VLAN ID (0-4095) - remaining bits are 0 * No VLAN is used - bit 15 is 0 - remaining bits are 0 batman-adv was only preparing new translation table entries (based on its soft interface information) using this encoding format. But the receive path was never checking if entries in the roam or TT TVLVs were also following this encoding. It was therefore possible to create more than the expected maximum of 4096 + 1 entries in the originator VLAN list. Simply by setting the "remaining bits" to "random" values in corresponding TVLV. Cc: stable@vger.kernel.org Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific") Reported-by: Linus Lüssing Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich --- net/batman-adv/originator.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c index ac74f6ead62d..8f6dd2c6ee41 100644 --- a/net/batman-adv/originator.c +++ b/net/batman-adv/originator.c @@ -12,6 +12,7 @@ #include #include #include +#include #include #include #include @@ -131,6 +132,29 @@ batadv_orig_node_vlan_get(struct batadv_orig_node *orig_node, return vlan; } +/** + * batadv_vlan_id_valid() - check if vlan id is in valid batman-adv encoding + * @vid: the VLAN identifier + * + * Return: true when either no vlan is set or if VLAN is in correct range, + * false otherwise + */ +static bool batadv_vlan_id_valid(unsigned short vid) +{ + unsigned short non_vlan = vid & ~(BATADV_VLAN_HAS_TAG | VLAN_VID_MASK); + + if (vid == 0) + return true; + + if (!(vid & BATADV_VLAN_HAS_TAG)) + return false; + + if (non_vlan) + return false; + + return true; +} + /** * batadv_orig_node_vlan_new() - search and possibly create an orig_node_vlan * object @@ -149,6 +173,9 @@ batadv_orig_node_vlan_new(struct batadv_orig_node *orig_node, { struct batadv_orig_node_vlan *vlan; + if (!batadv_vlan_id_valid(vid)) + return NULL; + spin_lock_bh(&orig_node->vlan_list_lock); /* first look if an object for this vid already exists */