From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AEC86C433FE for ; Wed, 24 Nov 2021 12:11:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243647AbhKXMOn (ORCPT ); Wed, 24 Nov 2021 07:14:43 -0500 Received: from mail.kernel.org ([198.145.29.99]:34104 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242498AbhKXMLb (ORCPT ); Wed, 24 Nov 2021 07:11:31 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id 9BB646109D; Wed, 24 Nov 2021 12:06:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1637755590; bh=ko8PvQdEl2K1wmJAEXAPeZIKzNEsI1bGym7J0nLuIw4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=szf25pgnRI6DlBL8JlhaOOfCq2ojb4n7u1UNL70DGVJwarP4XVW4qjY+18eYBfv5t 2yQgOui/IrhvLkyo1Q/SHaT5JhIO33BSrqpSj6hzWZ0PfpSNhKY1H6XPJ+AlSnDvXv tkS5WUioPwgq3gQnm/zotV8U3W19aiWWTZ8O0ERA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , =?UTF-8?q?Leonardo=20M=F6rlein?= , =?UTF-8?q?Linus=20L=FCssing?= , Simon Wunderlich , Sven Eckelmann Subject: [PATCH 4.4 150/162] batman-adv: Fix multicast TT issues with bogus ROAM flags Date: Wed, 24 Nov 2021 12:57:33 +0100 Message-Id: <20211124115703.126363471@linuxfoundation.org> X-Mailer: git-send-email 2.34.0 In-Reply-To: <20211124115658.328640564@linuxfoundation.org> References: <20211124115658.328640564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Linus Lüssing commit a44ebeff6bbd6ef50db41b4195fca87b21aefd20 upstream. When a (broken) node wrongly sends multicast TT entries with a ROAM flag then this causes any receiving node to drop all entries for the same multicast MAC address announced by other nodes, leading to packet loss. Fix this DoS vector by only storing TT sync flags. For multicast TT non-sync'ing flag bits like ROAM are unused so far anyway. Fixes: 1d8ab8d3c176 ("batman-adv: Modified forwarding behaviour for multicast packets") Reported-by: Leonardo Mörlein Signed-off-by: Linus Lüssing Signed-off-by: Simon Wunderlich [ bp: 4.4 backported: adjust context, use old style to access flags ] Signed-off-by: Sven Eckelmann Signed-off-by: Greg Kroah-Hartman --- net/batman-adv/translation-table.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -1426,7 +1426,8 @@ static bool batadv_tt_global_add(struct ether_addr_copy(common->addr, tt_addr); common->vid = vid; - common->flags = flags & (~BATADV_TT_SYNC_MASK); + if (!is_multicast_ether_addr(common->addr)) + common->flags = flags & (~BATADV_TT_SYNC_MASK); tt_global_entry->roam_at = 0; /* node must store current time in case of roaming. This is @@ -1489,7 +1490,8 @@ static bool batadv_tt_global_add(struct * TT_CLIENT_WIFI, therefore they have to be copied in the * client entry */ - tt_global_entry->common.flags |= flags & (~BATADV_TT_SYNC_MASK); + if (!is_multicast_ether_addr(common->addr)) + tt_global_entry->common.flags |= flags & (~BATADV_TT_SYNC_MASK); /* If there is the BATADV_TT_CLIENT_ROAM flag set, there is only * one originator left in the list and we previously received a