From patchwork Fri Mar 16 10:29:10 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthias Schiffer X-Patchwork-Id: 17304 X-Patchwork-Delegate: sw@simonwunderlich.de Return-Path: X-Original-To: patchwork@open-mesh.org Delivered-To: patchwork@open-mesh.org Received: from open-mesh.org (localhost [IPv6:::1]) by open-mesh.org (Postfix) with ESMTP id 8E6F181542; Fri, 16 Mar 2018 11:39:40 +0100 (CET) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=2001:19f0:6c01:100::1; helo=orthanc.universe-factory.net; envelope-from=mschiffer@universe-factory.net; receiver= X-Greylist: delayed 575 seconds by postgrey-1.36 at open-mesh.org; Fri, 16 Mar 2018 11:39:38 CET Received: from orthanc.universe-factory.net (orthanc.universe-factory.net [IPv6:2001:19f0:6c01:100::1]) by open-mesh.org (Postfix) with ESMTPS id 81F5C815AA for ; Fri, 16 Mar 2018 11:39:38 +0100 (CET) Received: from localhost.localdomain (unknown [IPv6:2001:19f0:6c01:100::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by orthanc.universe-factory.net (Postfix) with ESMTPSA id 3C38C1F509 for ; Fri, 16 Mar 2018 11:30:02 +0100 (CET) From: Matthias Schiffer To: b.a.t.m.a.n@lists.open-mesh.org Date: Fri, 16 Mar 2018 11:29:10 +0100 Message-Id: <3cc8fb9bb6b983a5b7972af2fd803041095d8c90.1521196151.git.mschiffer@universe-factory.net> X-Mailer: git-send-email 2.16.2 In-Reply-To: References: In-Reply-To: References: Subject: [B.A.T.M.A.N.] [PATCH maint 2/3] batman-adv: fix header size check in batadv_dbg_arp() X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking Errors-To: b.a.t.m.a.n-bounces@lists.open-mesh.org Sender: "B.A.T.M.A.N" Checking for 0 is insufficient: when an SKB without a batadv header, but with a VLAN header is received, hdr_size will be 4, making the following code interpret the Ethernet header as a batadv header. Signed-off-by: Matthias Schiffer --- net/batman-adv/distributed-arp-table.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c index 19b15de455ab..b7ca4a311b91 100644 --- a/net/batman-adv/distributed-arp-table.c +++ b/net/batman-adv/distributed-arp-table.c @@ -393,7 +393,7 @@ static void batadv_dbg_arp(struct batadv_priv *bat_priv, struct sk_buff *skb, batadv_arp_hw_src(skb, hdr_size), &ip_src, batadv_arp_hw_dst(skb, hdr_size), &ip_dst); - if (hdr_size == 0) + if (hdr_size < sizeof(struct batadv_unicast_packet)) return; unicast_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data;