lkml.org 
[lkml]   [2019]   [Feb]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 189/305] batman-adv: Expand merged fragment buffer for full packet
    3.16.63-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Sven Eckelmann <sven@narfation.org>

    commit d7d8bbb40a5b1f682ee6589e212934f4c6b8ad60 upstream.

    The complete size ("total_size") of the fragmented packet is stored in the
    fragment header and in the size of the fragment chain. When the fragments
    are ready for merge, the skbuff's tail of the first fragment is expanded to
    have enough room after the data pointer for at least total_size. This means
    that it gets expanded by total_size - first_skb->len.

    But this is ignoring the fact that after expanding the buffer, the fragment
    header is pulled by from this buffer. Assuming that the tailroom of the
    buffer was already 0, the buffer after the data pointer of the skbuff is
    now only total_size - len(fragment_header) large. When the merge function
    is then processing the remaining fragments, the code to copy the data over
    to the merged skbuff will cause an skb_over_panic when it tries to actually
    put enough data to fill the total_size bytes of the packet.

    The size of the skb_pull must therefore also be taken into account when the
    buffer's tailroom is expanded.

    Fixes: 610bfc6bc99b ("batman-adv: Receive fragmented packets and merge")
    Reported-by: Martin Weinelt <martin@darmstadt.freifunk.net>
    Co-authored-by: Linus Lüssing <linus.luessing@c0d3.blue>
    Signed-off-by: Sven Eckelmann <sven@narfation.org>
    Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    net/batman-adv/fragmentation.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/net/batman-adv/fragmentation.c
    +++ b/net/batman-adv/fragmentation.c
    @@ -250,7 +250,7 @@ batadv_frag_merge_packets(struct hlist_h
    kfree(entry);

    packet = (struct batadv_frag_packet *)skb_out->data;
    - size = ntohs(packet->total_size);
    + size = ntohs(packet->total_size) + hdr_size;

    /* Make room for the rest of the fragments. */
    if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) {
    \
     
     \ /
      Last update: 2019-02-03 14:58    [W:4.169 / U:1.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site