batman-adv: Do not send uninitialized TT changes

The number of TT changes can be less than initially expected in
batadv_tt_tvlv_container_update() (changes can be removed by
batadv_tt_local_event() in ADD+DEL sequence between reading
tt_diff_entries_num and actually iterating the change list under lock).

Thus tt_diff_len could be bigger than the actual changes size that need
to be sent. Because batadv_send_my_tt_response sends the whole
packet, uninitialized data can be interpreted as TT changes on other
nodes leading to weird TT global entries on those nodes such as:

 * 00:00:00:00:00:00   -1 [....] (  0) 88:12:4e:ad:7e:ba (179) (0x45845380)
 * 00:00:00:00:78:79 4092 [.W..] (  0) 88:12:4e:ad:7e:3c (145) (0x8ebadb8b)

All of the above also applies to OGM tvlv container buffer's tvlv_len.

Remove the extra allocated space to avoid sending uninitialized TT
changes in batadv_send_my_tt_response() and batadv_v_ogm_send_softif().

Fixes: e1bf0c14096f ("batman-adv: tvlv - convert tt data sent within OGMs")
Signed-off-by: Remi Pommarel <repk@triplefau.lt>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>

diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index b44c382226a11b63984f294445b9081828fed1d3..996d1f01171ad6ea9afd4ee525ba42aa5952d37c 100644 (file)
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -948,6 +948,7 @@ static void batadv_tt_tvlv_container_update(struct batadv_priv *bat_priv)
        int tt_diff_len, tt_change_len = 0;
        int tt_diff_entries_num = 0;
        int tt_diff_entries_count = 0;
+       size_t tt_extra_len = 0;
        u16 tvlv_len;
 
        tt_diff_entries_num = atomic_read(&bat_priv->tt.local_changes);
@@ -985,6 +986,9 @@ static void batadv_tt_tvlv_container_update(struct batadv_priv *bat_priv)
        }
        spin_unlock_bh(&bat_priv->tt.changes_list_lock);
 
+       tt_extra_len = batadv_tt_len(tt_diff_entries_num -
+                                    tt_diff_entries_count);
+
        /* Keep the buffer for possible tt_request */
        spin_lock_bh(&bat_priv->tt.last_changeset_lock);
        kfree(bat_priv->tt.last_changeset);
@@ -993,6 +997,7 @@ static void batadv_tt_tvlv_container_update(struct batadv_priv *bat_priv)
        tt_change_len = batadv_tt_len(tt_diff_entries_count);
        /* check whether this new OGM has no changes due to size problems */
        if (tt_diff_entries_count > 0) {
+               tt_diff_len -= tt_extra_len;
                /* if kmalloc() fails we will reply with the full table
                 * instead of providing the diff
                 */
@@ -1005,6 +1010,8 @@ static void batadv_tt_tvlv_container_update(struct batadv_priv *bat_priv)
        }
        spin_unlock_bh(&bat_priv->tt.last_changeset_lock);
 
+       /* Remove extra packet space for OGM */
+       tvlv_len -= tt_extra_len;
 container_register:
        batadv_tvlv_container_register(bat_priv, BATADV_TVLV_TT, 1, tt_data,
                                       tvlv_len);