linux/net/batman-adv
Sven Eckelmann 73fb6df4e6 batman-adv: Don't accept TT entries for out-of-spec VIDs
commit 537a350d14 upstream.

The internal handling of VLAN IDs in batman-adv is only specified for
following encodings:

* VLAN is used
  - bit 15 is 1
  - bit 11 - bit 0 is the VLAN ID (0-4095)
  - remaining bits are 0
* No VLAN is used
  - bit 15 is 0
  - remaining bits are 0

batman-adv was only preparing new translation table entries (based on its
soft interface information) using this encoding format. But the receive
path was never checking if entries in the roam or TT TVLVs were also
following this encoding.

It was therefore possible to create more than the expected maximum of 4096
+ 1 entries in the originator VLAN list. Simply by setting the "remaining
bits" to "random" values in corresponding TVLV.

Cc: stable@vger.kernel.org
Fixes: 7ea7b4a142 ("batman-adv: make the TT CRC logic VLAN specific")
Reported-by: Linus Lüssing <linus.luessing@c0d3.blue>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-07-05 09:34:04 +02:00
..
bat_algo.c batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
bat_algo.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
bat_iv_ogm.c batman-adv: Drop per algo GW section class code 2023-08-14 18:01:21 +02:00
bat_iv_ogm.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
bat_v_elp.c batman-adv: Do not get eth header before batadv_check_management_packet 2023-07-28 15:39:38 +02:00
bat_v_elp.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
bat_v_ogm.c batman-adv: Fix batadv_v_ogm_aggr_send memory leak 2023-08-09 17:33:03 +02:00
bat_v_ogm.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
bat_v.c batman-adv: Drop per algo GW section class code 2023-08-14 18:01:21 +02:00
bat_v.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
bitarray.c batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
bitarray.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
bridge_loop_avoidance.c batman-adv: remove unnecessary type castings 2022-04-22 11:23:46 +02:00
bridge_loop_avoidance.h batman-adv: Remove the repeated declaration 2021-05-30 13:38:27 +02:00
distributed-arp-table.c batman-adv: Broken sync while rescheduling delayed work 2023-05-26 23:14:49 +02:00
distributed-arp-table.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
fragmentation.c batman-adv: Don't skb_split skbuffs with frag_list 2022-04-17 23:41:44 +02:00
fragmentation.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
gateway_client.c batman-adv: Migrate to linux/container_of.h 2022-03-02 09:00:13 +01:00
gateway_client.h batman-adv: Check ptr for NULL before reducing its refcnt 2021-08-08 20:21:40 +02:00
gateway_common.c batman-adv: Drop per algo GW section class code 2023-08-14 18:01:21 +02:00
gateway_common.h batman-adv: Drop per algo GW section class code 2023-08-14 18:01:21 +02:00
hard-interface.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-08-24 10:51:39 -07:00
hard-interface.h batman-adv: Check ptr for NULL before reducing its refcnt 2021-08-08 20:21:40 +02:00
hash.c batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
hash.h batman-adv: Fix spelling mistakes 2021-06-02 08:46:03 +02:00
Kconfig This feature/cleanup patchset is an updated version of the pull request 2021-02-08 11:32:40 -08:00
log.c isystem: ship and use stdarg.h 2021-08-19 09:02:55 +09:00
log.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
main.c batman-adv: Migrate to linux/container_of.h 2022-03-02 09:00:13 +01:00
main.h batman-adv: Start new development cycle 2023-08-03 21:11:42 +02:00
Makefile batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
multicast.c batman-adv: tvlv: prepare for tvlv enabled multicast packet type 2023-01-21 19:01:59 +01:00
multicast.h batman-adv: mcast: remove now redundant single ucast forwarding 2023-01-21 19:01:59 +01:00
netlink.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-08-24 10:51:39 -07:00
netlink.h batman-adv: Keep batadv_netlink_notify_* static 2023-08-14 18:01:21 +02:00
network-coding.c batman-adv: tvlv: prepare for tvlv enabled multicast packet type 2023-01-21 19:01:59 +01:00
network-coding.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
originator.c batman-adv: Don't accept TT entries for out-of-spec VIDs 2024-07-05 09:34:04 +02:00
originator.h batman-adv: Check ptr for NULL before reducing its refcnt 2021-08-08 20:21:40 +02:00
routing.c batman-adv: tvlv: prepare for tvlv enabled multicast packet type 2023-01-21 19:01:59 +01:00
routing.h batman-adv: Remove unused declarations 2023-08-03 21:11:42 +02:00
send.c batman-adv: Migrate to linux/container_of.h 2022-03-02 09:00:13 +01:00
send.h batman-adv: bcast: queue per interface, if needed 2021-05-17 12:00:44 +02:00
soft-interface.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-08-24 10:51:39 -07:00
soft-interface.h batman-adv: Check ptr for NULL before reducing its refcnt 2021-08-08 20:21:40 +02:00
tp_meter.c batman-adv: Migrate to linux/container_of.h 2022-03-02 09:00:13 +01:00
tp_meter.h batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
trace.c batman-adv: Drop publication years from copyright info 2021-02-06 09:22:10 +01:00
trace.h batman-adv: Drop unused headers in trace.h 2022-08-17 12:10:43 +02:00
translation-table.c batman-adv: Avoid infinite loop trying to resize local TT 2024-04-17 11:19:25 +02:00
translation-table.h batman-adv: Check ptr for NULL before reducing its refcnt 2021-08-08 20:21:40 +02:00
tvlv.c batman-adv: tvlv: prepare for tvlv enabled multicast packet type 2023-01-21 19:01:59 +01:00
tvlv.h batman-adv: tvlv: prepare for tvlv enabled multicast packet type 2023-01-21 19:01:59 +01:00
types.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-08-24 10:51:39 -07:00