From patchwork Tue Sep 8 15:23:02 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 264349 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DD5E2C43461 for ; Tue, 8 Sep 2020 16:05:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A2F3D21919 for ; Tue, 8 Sep 2020 16:05:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1599581122; bh=5P0hcenspg1C1KXF6xTEF80JoHY/H6bE/siOpbWumH0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=TU60GxQKw4J2hRHvfK1ZDn2cqfRklYOqOr5DG0zOzHmP4oBOwcAO53Slpe1VMkH2J t2hC+KYuKBwZFoGXnhJk8+z0G34Puu+P/3RWg+eauqcOiiYx7YMJqp8FyeKGH4JEIx fN1caYy437BZ5qRW4CLV8hCfl9SuMBJS84R5FpKA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731222AbgIHQFU (ORCPT ); Tue, 8 Sep 2020 12:05:20 -0400 Received: from mail.kernel.org ([198.145.29.99]:52116 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731171AbgIHQEj (ORCPT ); Tue, 8 Sep 2020 12:04:39 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A2B07229F0; Tue, 8 Sep 2020 15:35:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1599579351; bh=5P0hcenspg1C1KXF6xTEF80JoHY/H6bE/siOpbWumH0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MHhRiU4ZPlb8psz5DePE4p506K8K8M0BUiHI9wHbxsyElf4jg1td7ikk0pwUxgvOR jGMZ9YXEbEIgb0r4o1+69GtpBUJ5EyO+ZJkaXYF0Ubgr4I8rQNUEiK5rnm5X9SFHI7 p7vlVc1woYv8X6Y60XrMKWfNYobNy8Ig4b/2CZnI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+ab16e463b903f5a37036@syzkaller.appspotmail.com, Sven Eckelmann , Antonio Quartulli , Simon Wunderlich , Sasha Levin Subject: [PATCH 5.8 040/186] batman-adv: Avoid uninitialized chaddr when handling DHCP Date: Tue, 8 Sep 2020 17:23:02 +0200 Message-Id: <20200908152243.615263848@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200908152241.646390211@linuxfoundation.org> References: <20200908152241.646390211@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Sven Eckelmann [ Upstream commit 303216e76dcab6049c9d42390b1032f0649a8206 ] The gateway client code can try to optimize the delivery of DHCP packets to avoid broadcasting them through the whole mesh. But also transmissions to the client can be optimized by looking up the destination via the chaddr of the DHCP packet. But the chaddr is currently only done when chaddr is fully inside the non-paged area of the skbuff. Otherwise it will not be initialized and the unoptimized path should have been taken. But the implementation didn't handle this correctly. It didn't retrieve the correct chaddr but still tried to perform the TT lookup with this uninitialized memory. Reported-by: syzbot+ab16e463b903f5a37036@syzkaller.appspotmail.com Fixes: 6c413b1c22a2 ("batman-adv: send every DHCP packet as bat-unicast") Signed-off-by: Sven Eckelmann Acked-by: Antonio Quartulli Signed-off-by: Simon Wunderlich Signed-off-by: Sasha Levin --- net/batman-adv/gateway_client.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c index a18dcc686dc31..ef3f85b576c4c 100644 --- a/net/batman-adv/gateway_client.c +++ b/net/batman-adv/gateway_client.c @@ -703,8 +703,10 @@ batadv_gw_dhcp_recipient_get(struct sk_buff *skb, unsigned int *header_len, chaddr_offset = *header_len + BATADV_DHCP_CHADDR_OFFSET; /* store the client address if the message is going to a client */ - if (ret == BATADV_DHCP_TO_CLIENT && - pskb_may_pull(skb, chaddr_offset + ETH_ALEN)) { + if (ret == BATADV_DHCP_TO_CLIENT) { + if (!pskb_may_pull(skb, chaddr_offset + ETH_ALEN)) + return BATADV_DHCP_NO; + /* check if the DHCP packet carries an Ethernet DHCP */ p = skb->data + *header_len + BATADV_DHCP_HTYPE_OFFSET; if (*p != BATADV_DHCP_HTYPE_ETHERNET)