b.a.t.m.a.n.lists.open-mesh.org archive mirror
 help / color / mirror / Atom feed
From: Simon Wunderlich <sw@simonwunderlich.de>
To: davem@davemloft.net
Cc: netdev@vger.kernel.org, b.a.t.m.a.n@lists.open-mesh.org,
	Sven Eckelmann <sven@narfation.org>,
	Simon Wunderlich <sw@simonwunderlich.de>
Subject: [B.A.T.M.A.N.] [PATCH 01/11] batman-adv: Avoid probe ELP information leak
Date: Wed, 19 Sep 2018 14:22:03 +0200	[thread overview]
Message-ID: <20180919122213.23108-2-sw@simonwunderlich.de> (raw)
In-Reply-To: <20180919122213.23108-1-sw@simonwunderlich.de>

From: Sven Eckelmann <sven@narfation.org>

The probe ELPs for WiFi interfaces are expanded to contain at least
BATADV_ELP_MIN_PROBE_SIZE bytes. This is usually a lot more than the
number of bytes which the template ELP packet requires.

These extra padding bytes were not initialized and thus could contain data
which were previously stored at the same location. It is therefore required
to set it to some predefined or random values to avoid leaking private
information from the system transmitting these kind of packets.

Fixes: e4623c913508 ("batman-adv: Avoid probe ELP information leak")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Acked-by: Antonio Quartulli <a@unstable.cc>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
 net/batman-adv/bat_v_elp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
index 71c20c1d4002..e103c759b7ab 100644
--- a/net/batman-adv/bat_v_elp.c
+++ b/net/batman-adv/bat_v_elp.c
@@ -241,7 +241,7 @@ batadv_v_elp_wifi_neigh_probe(struct batadv_hardif_neigh_node *neigh)
 		 * the packet to be exactly of that size to make the link
 		 * throughput estimation effective.
 		 */
-		skb_put(skb, probe_len - hard_iface->bat_v.elp_skb->len);
+		skb_put_zero(skb, probe_len - hard_iface->bat_v.elp_skb->len);
 
 		batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
 			   "Sending unicast (probe) ELP packet on interface %s to %pM\n",
-- 
2.11.0


  reply	other threads:[~2018-09-19 12:22 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-09-19 12:22 [B.A.T.M.A.N.] [PATCH 00/11] pull request for net: batman-adv 2018-09-19 Simon Wunderlich
2018-09-19 12:22 ` Simon Wunderlich [this message]
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 02/11] batman-adv: Fix segfault when writing to throughput_override Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 03/11] batman-adv: Fix segfault when writing to sysfs elp_interval Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 04/11] batman-adv: Prevent duplicated gateway_node entry Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 05/11] batman-adv: Prevent duplicated nc_node entry Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 06/11] batman-adv: Prevent duplicated softif_vlan entry Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 07/11] batman-adv: Prevent duplicated global TT entry Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 08/11] batman-adv: Prevent duplicated tvlv handler Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 09/11] batman-adv: fix backbone_gw refcount on queue_work() failure Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 10/11] batman-adv: fix hardif_neigh " Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 11/11] batman-adv: Increase version number to 2018.3 Simon Wunderlich
2018-09-20  3:34 ` [B.A.T.M.A.N.] [PATCH 00/11] pull request for net: batman-adv 2018-09-19 David Miller
2018-09-20  8:09   ` Simon Wunderlich

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180919122213.23108-2-sw@simonwunderlich.de \
    --to=sw@simonwunderlich.de \
    --cc=b.a.t.m.a.n@lists.open-mesh.org \
    --cc=davem@davemloft.net \
    --cc=netdev@vger.kernel.org \
    --cc=sven@narfation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).