batman-adv: fix (m|b)cast csum after decrementing TTL

The broadcast and multicast packets can be received at the same time by the
local system and forwarded to other nodes. Both are simply decrementing the
TTL at the beginning of the receive path - independent of chosen paths
(receive/forward). But such a modification of the data conflicts with the
hw csum. This is not a problem when the packet is directly forwarded but
can cause errors in the local receive path.

Such a problem can then trigger a "hw csum failure". The receiver path must
therefore ensure that the csum is fixed for each modification of the
payload before batadv_interface_rx() is reached.

Since all batman-adv packet types with a ttl have it as u8 at offset 2, a
helper can be used for all of them. But it is only used at the moment for
batadv_bcast_packet and batadv_mcast_packet because they are the only ones
which deliver the packet locally but unconditionally modify the TTL.

Cc: stable@kernel.org
Fixes: 3f69339068f9 ("batman-adv: bcast: queue per interface, if needed")
Fixes: 07afe1ba288c ("batman-adv: mcast: implement multicast packet reception and forwarding")
Signed-off-by: Sven Eckelmann <sven@narfation.org>

diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 7b4acd1ad991aa8f2f459d3bcac33e47a10a60d7..8786b66c8a924e55216199e4df26a672b5e64ed0 100644 (file)
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -8,6 +8,7 @@
 #include "main.h"
 
 #include <linux/atomic.h>
+#include <linux/build_bug.h>
 #include <linux/byteorder/generic.h>
 #include <linux/compiler.h>
 #include <linux/errno.h>
@@ -204,6 +205,59 @@ bool batadv_check_management_packet(struct sk_buff *skb,
        return true;
 }
 
+/**
+ * batadv_skb_decrement_ttl() - decrement ttl in a batman-adv header, csum-safe
+ * @skb: the received packet with @skb->data pointing to the batman-adv header
+ *
+ * Supports the following packet types, all of which carry the TTL at offset 2:
+ *
+ * - batadv_ogm_packet
+ * - batadv_ogm2_packet
+ * - batadv_icmp_header
+ * - batadv_icmp_packet
+ * - batadv_icmp_tp_packet
+ * - batadv_icmp_packet_rr
+ * - batadv_unicast_packet
+ * - batadv_frag_packet
+ * - batadv_bcast_packet
+ * - batadv_mcast_packet
+ * - batadv_coded_packet
+ * - batadv_unicast_tvlv_packet
+ *
+ * Return: true if the packet may be forwarded (ttl decremented),
+ *  false if it must be dropped (ttl would expire)
+ */
+static bool batadv_skb_decrement_ttl(struct sk_buff *skb)
+{
+       static const size_t ttl_offset = 2;
+       u8 *ttl_pos;
+
+       BUILD_BUG_ON(offsetof(struct batadv_ogm_packet, ttl) != ttl_offset);
+       BUILD_BUG_ON(offsetof(struct batadv_ogm2_packet, ttl) != ttl_offset);
+       BUILD_BUG_ON(offsetof(struct batadv_icmp_header, ttl) != ttl_offset);
+       BUILD_BUG_ON(offsetof(struct batadv_icmp_packet, ttl) != ttl_offset);
+       BUILD_BUG_ON(offsetof(struct batadv_icmp_tp_packet, ttl) != ttl_offset);
+       BUILD_BUG_ON(offsetof(struct batadv_icmp_packet_rr, ttl) != ttl_offset);
+       BUILD_BUG_ON(offsetof(struct batadv_unicast_packet, ttl) != ttl_offset);
+       BUILD_BUG_ON(offsetof(struct batadv_frag_packet, ttl) != ttl_offset);
+       BUILD_BUG_ON(offsetof(struct batadv_bcast_packet, ttl) != ttl_offset);
+       BUILD_BUG_ON(offsetof(struct batadv_mcast_packet, ttl) != ttl_offset);
+       BUILD_BUG_ON(offsetof(struct batadv_coded_packet, ttl) != ttl_offset);
+       BUILD_BUG_ON(offsetof(struct batadv_unicast_tvlv_packet, ttl) != ttl_offset);
+
+       ttl_pos = skb->data + ttl_offset;
+
+       /* would expire on this hop -> drop, leave header + csum untouched */
+       if (*ttl_pos < 2)
+               return false;
+
+       skb_postpull_rcsum(skb, ttl_pos, 1);
+       (*ttl_pos)--;
+       skb_postpush_rcsum(skb, ttl_pos, 1);
+
+       return true;
+}
+
 /**
  * batadv_recv_my_icmp_packet() - receive an icmp packet locally
  * @bat_priv: the bat priv with all the mesh interface information
@@ -1197,7 +1251,7 @@ int batadv_recv_bcast_packet(struct sk_buff *skb,
 
        bcast_packet = (struct batadv_bcast_packet *)skb->data;
 
-       if (bcast_packet->ttl-- < 2)
+       if (!batadv_skb_decrement_ttl(skb))
                goto free_skb;
 
        orig_node = batadv_orig_hash_find(bat_priv, bcast_packet->orig);
@@ -1304,7 +1358,7 @@ int batadv_recv_mcast_packet(struct sk_buff *skb,
                goto free_skb;
 
        mcast_packet = (struct batadv_mcast_packet *)skb->data;
-       if (mcast_packet->ttl-- < 2)
+       if (!batadv_skb_decrement_ttl(skb))
                goto free_skb;
 
        tvlv_buff = (unsigned char *)(skb->data + hdr_size);