Re: [PATCH net v3] batman-adv: reject unrepresentable multicast TVLV offsets
Sven Eckelmann <[email protected]>
| Newsgroups | gmane.org.freifunk.batman,gmane.linux.network,gmane.linux.kernel,gmane.linux.kernel.stable |
|---|---|
| Message-ID | <178695824178.1497243.16045312752677179315.b4-review@b4> |
> The network and transport header fields in struct sk_buff are 16-bit > offsets from skb->head, and U16_MAX is reserved as the unset transport > header value. batadv_tvlv_call_handler() sets both fields from a received > multicast TVLV without checking whether the TVLV end is representable. > > If the end offset exceeds the field's range, skb_set_transport_header() > truncates it so that the transport header precedes the network header. > The negative difference is then returned by skb_network_header_len() as > a large u32. batadv_mcast_forw_packet() consequently accepts an oversized > multicast tracker and accesses memory beyond the skb data. [...] > --- > Changes in v3: > - Rename transport_offset to thoff so the comparisons fit on one line. > > v2: https://lore.kernel.org/netdev/20260810145754.828936-1-david.lee-MuOliuq6EJRM+xtBniklyQ@public.gmane.org/ Looks to me like you've also dropped the Suggested-by: Sven Eckelmann <[email protected]> b4 diff -v2 20260817084955.944189-1-david.lee-MuOliuq6EJRM+xtBniklyQ@public.gmane.org Acked-by: Sven Eckelmann <[email protected]> -- Sven Eckelmann <[email protected]>