Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 162d549c authored by Sven Eckelmann's avatar Sven Eckelmann Committed by Antonio Quartulli
Browse files

batman-adv: Don't leak information through uninitialized packet fields 



The reserved fields in batman-adv packets are not set to a constant value. The
content of these memory regions is leaked unintentionally to the network.

This regression was introduced in 3b27ffb0

Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
Signed-off-by: default avatarAntonio Quartulli <ordex@autistici.org>
parent 0c5e45b6

net/batman-adv/soft-interface.c

+1 −0
Original line number Diff line number Diff line
@@ -214,6 +214,7 @@ static int batadv_interface_tx(struct sk_buff *skb, 


		/* batman packet type: broadcast */

		bcast_packet->header.packet_type = BATADV_BCAST;

		bcast_packet->reserved = 0;



		/* hw address of first interface is the orig mac because only

		 * this mac is known throughout the mesh

net/batman-adv/translation-table.c

+1 −0
Original line number Diff line number Diff line
@@ -2052,6 +2052,7 @@ static void batadv_send_roam_adv(struct batadv_priv *bat_priv, uint8_t *client, 
	roam_adv_packet->header.packet_type = BATADV_ROAM_ADV;

	roam_adv_packet->header.version = BATADV_COMPAT_VERSION;

	roam_adv_packet->header.ttl = BATADV_TTL;

	roam_adv_packet->reserved = 0;

	primary_if = batadv_primary_if_get_selected(bat_priv);

	if (!primary_if)

		goto out;

net/batman-adv/vis.c

+2 −0
Original line number Diff line number Diff line
@@ -589,6 +589,7 @@ static int batadv_generate_vis_packet(struct batadv_priv *bat_priv) 
	packet->header.ttl = BATADV_TTL;

	packet->seqno = htonl(ntohl(packet->seqno) + 1);

	packet->entries = 0;

	packet->reserved = 0;

	skb_trim(info->skb_packet, sizeof(*packet));



	if (packet->vis_type == BATADV_VIS_TYPE_CLIENT_UPDATE) {
@@ -890,6 +891,7 @@ int batadv_vis_init(struct batadv_priv *bat_priv) 
	packet->header.packet_type = BATADV_VIS;

	packet->header.ttl = BATADV_TTL;

	packet->seqno = 0;

	packet->reserved = 0;

	packet->entries = 0;



	INIT_LIST_HEAD(&bat_priv->vis_send_list);