Re: [PATCH net v3] batman-adv: reject unrepresentable multicast TVLV offsets
Sven Eckelmann <[email protected]>
| Newsgroups | org.kernel.vger.stable,org.kernel.vger.linux-kernel,org.kernel.vger.netdev,org.open-mesh.lists.batman |
|---|---|
| Message-ID | <178695824178.1497243.16045312752677179315.b4-review@b4> |
> The network and transport header fields in struct sk_buff are 16-bit > offsets from skb->head, and U16_MAX is reserved as the unset transport > header value. batadv_tvlv_call_handler() sets both fields from a received > multicast TVLV without checking whether the TVLV end is representable. > > If the end offset exceeds the field's range, skb_set_transport_header() > truncates it so that the transport header precedes the network header. > The negative difference is then returned by skb_network_header_len() as > a large u32. batadv_mcast_forw_packet() consequently accepts an oversized > multicast tracker and accesses memory beyond the skb data. [...] > --- > Changes in v3: > - Rename transport_offset to thoff so the comparisons fit on one line. > > v2: https://lore.kernel.org/netdev/[email protected]/ Looks to me like you've also dropped the Suggested-by: Sven Eckelmann <[email protected]> b4 diff -v2 [email protected] Acked-by: Sven Eckelmann <[email protected]> -- Sven Eckelmann <[email protected]>