mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 09:20:13 -04:00
Code Issues Packages Projects Releases Wiki Activity

batman-adv: reject unrepresentable multicast TVLV offsets

Browse Source 
The network and transport header fields in struct sk_buff are 16-bit
offsets from skb->head, and U16_MAX is reserved as the unset transport
header value. batadv_tvlv_call_handler() sets both fields from a received
multicast TVLV without checking whether the TVLV end is representable.

If the end offset exceeds the field's range, skb_set_transport_header()
truncates it so that the transport header precedes the network header.
The negative difference is then returned by skb_network_header_len() as
a large u32. batadv_mcast_forw_packet() consequently accepts an oversized
multicast tracker and accesses memory beyond the skb data.

Add skb_set_transport_header_careful(), an offset-aware counterpart to
skb_reset_transport_header_careful(), which validates the final
head-relative offset before assigning it. Use the new helper in
batadv_tvlv_call_handler() and reject unrepresentable TVLVs before
setting the network header.

Fixes: 07afe1ba28 ("batman-adv: mcast: implement multicast packet reception and forwarding")
Cc: stable@vger.kernel.org
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Co-developed-by: David Lee <david.lee@trailofbits.com>
Signed-off-by: David Lee <david.lee@trailofbits.com>
Acked-by: Sven Eckelmann <sven@narfation.org>
Link: https://patch.msgid.link/20260817084955.944189-1-david.lee@trailofbits.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Kyle Zeng
2026-08-17 08:49:54 +00:00
committed by Jakub Kicinski
parent 44930446dd
commit f12c2de4f5
2 changed files with 28 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
include/linux/skbuff.h
View File

@@ -3126,6 +3126,30 @@ static inline void skb_set_transport_header(struct sk_buff *skb,
skb->transport_header += offset;
}
/**
* skb_set_transport_header_careful - conditionally set transport header
* @skb: buffer to alter
* @offset: offset to add to skb->data
*
* Hardened version of skb_set_transport_header().
*
* Returns: true if the operation was a success.
*/
static inline bool __must_check
skb_set_transport_header_careful(struct sk_buff *skb, const int offset)
{
long thoff = skb->data - skb->head + offset;
if (unlikely(thoff != (typeof(skb->transport_header))thoff))
return false;
if (unlikely(thoff == (typeof(skb->transport_header))~0U))
return false;
skb->transport_header = thoff;
return true;
}
static inline unsigned char *skb_network_header(const struct sk_buff *skb)
{
return skb->head + skb->network_header;

5
net/batman-adv/tvlv.c
View File

@@ -438,8 +438,11 @@ static int batadv_tvlv_call_handler(struct batadv_priv *bat_priv,
return NET_RX_SUCCESS;
tvlv_offset = (unsigned char *)tvlv_value - skb->data;
if (!skb_set_transport_header_careful(skb,
tvlv_offset + tvlv_value_len))
return -EINVAL;
skb_set_network_header(skb, tvlv_offset);
skb_set_transport_header(skb, tvlv_offset + tvlv_value_len);
return tvlv_handler->mcast_handler(bat_priv, skb);
}