Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2afd0a24 authored by David S. Miller's avatar David S. Miller
Browse files

Merge tag 'batman-adv-fix-for-davem' of git://git.open-mesh.org/linux-merge 



Included changes ares:
- fix an skb memleak in DAT
- fix the ARP filtering routine in DAT by preventing bogus entries to overwrite
  already existing ones in the local cache.
- fix the ARP filtering routine in DAT by preventing it to parse and add to the
  cache bogus entries

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 1591ab67 b618ad11

net/batman-adv/distributed-arp-table.c

+18 −1
Original line number Diff line number Diff line
@@ -738,6 +738,7 @@ static uint16_t batadv_arp_get_type(struct batadv_priv *bat_priv, 
	struct arphdr *arphdr;

	struct ethhdr *ethhdr;

	__be32 ip_src, ip_dst;

	uint8_t *hw_src, *hw_dst;

	uint16_t type = 0;



	/* pull the ethernet header */
@@ -777,8 +778,22 @@ static uint16_t batadv_arp_get_type(struct batadv_priv *bat_priv, 
	ip_src = batadv_arp_ip_src(skb, hdr_size);

	ip_dst = batadv_arp_ip_dst(skb, hdr_size);

	if (ipv4_is_loopback(ip_src) || ipv4_is_multicast(ip_src) ||

	    ipv4_is_loopback(ip_dst) || ipv4_is_multicast(ip_dst))

	    ipv4_is_loopback(ip_dst) || ipv4_is_multicast(ip_dst) ||

	    ipv4_is_zeronet(ip_src) || ipv4_is_lbcast(ip_src) ||

	    ipv4_is_zeronet(ip_dst) || ipv4_is_lbcast(ip_dst))

		goto out;



	hw_src = batadv_arp_hw_src(skb, hdr_size);

	if (is_zero_ether_addr(hw_src) || is_multicast_ether_addr(hw_src))

		goto out;



	/* we don't care about the destination MAC address in ARP requests */

	if (arphdr->ar_op != htons(ARPOP_REQUEST)) {

		hw_dst = batadv_arp_hw_dst(skb, hdr_size);

		if (is_zero_ether_addr(hw_dst) ||

		    is_multicast_ether_addr(hw_dst))

			goto out;

	}



	type = ntohs(arphdr->ar_op);

out:
@@ -1012,6 +1027,8 @@ bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv, 
	 */

	ret = !batadv_is_my_client(bat_priv, hw_dst);

out:

	if (ret)

		kfree_skb(skb);

	/* if ret == false -> packet has to be delivered to the interface */

	return ret;

}