batman-adv: tvlv: enforce 2-byte alignment

The fields of an aggregated OGM(v2) are accessed assuming (at least) 2-byte
alignment, so a following OGM must start at an even offset. As the header
length is even, an odd tvlv_len would misalign it and trigger unaligned
accesses on strict-alignment architectures.

Such a misaligned TVLV/OGM/OGMv2 is not created by a normal participant in
the mesh. Therefore, reject such malformed packets.

Cc: stable@kernel.org
Fixes: ef26157747d4 ("batman-adv: tvlv - basic infrastructure")
Signed-off-by: Sven Eckelmann <sven@narfation.org>

diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 7588e64e7ba6f4f5bea437c0c6223294d3a9bd38..bb2f012b454ea467d85d455849a2ad82dc0ce270 100644 (file)
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -316,14 +316,23 @@ batadv_iv_ogm_aggr_packet(int buff_pos, int packet_len,
                          const struct batadv_ogm_packet *ogm_packet)
 {
        int next_buff_pos = 0;
+       u16 tvlv_len;
 
        /* check if there is enough space for the header */
        next_buff_pos += buff_pos + sizeof(*ogm_packet);
        if (next_buff_pos > packet_len)
                return false;
 
+       tvlv_len = ntohs(ogm_packet->tvlv_len);
+
+       /* the fields of an aggregated OGM are accessed assuming (at least)
+        * 2-byte alignment, so a following OGM must start at an even offset.
+        */
+       if (tvlv_len & 1)
+               return false;
+
        /* check if there is enough space for the optional TVLV */
-       next_buff_pos += ntohs(ogm_packet->tvlv_len);
+       next_buff_pos += tvlv_len;
 
        return next_buff_pos <= packet_len;
 }

diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c
index 95efd8a43c79ddf7e90babcb439daaf905c72f99..037921aad35d584365cd704bd1ee70fea24d8c6b 100644 (file)
--- a/net/batman-adv/bat_v_ogm.c
+++ b/net/batman-adv/bat_v_ogm.c
@@ -849,14 +849,23 @@ batadv_v_ogm_aggr_packet(int buff_pos, int packet_len,
                         const struct batadv_ogm2_packet *ogm2_packet)
 {
        int next_buff_pos = 0;
+       u16 tvlv_len;
 
        /* check if there is enough space for the header */
        next_buff_pos += buff_pos + sizeof(*ogm2_packet);
        if (next_buff_pos > packet_len)
                return false;
 
+       tvlv_len = ntohs(ogm2_packet->tvlv_len);
+
+       /* the fields of an aggregated OGMv2 are accessed assuming (at least)
+        * 2-byte alignment, so a following OGMv2 must start at an even offset.
+        */
+       if (tvlv_len & 1)
+               return false;
+
        /* check if there is enough space for the optional TVLV */
-       next_buff_pos += ntohs(ogm2_packet->tvlv_len);
+       next_buff_pos += tvlv_len;
 
        return next_buff_pos <= packet_len;
 }

diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 9db57fd36e7d4bbe8a4814ad05343c357e554b30..c05fcc9241adda443eda9db809d8fcf85549543c 100644 (file)
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -1366,6 +1366,12 @@ int batadv_recv_mcast_packet(struct sk_buff *skb,
        if (tvlv_buff_len > skb->len - hdr_size)
                goto free_skb;
 
+       /* the fields of an multicast payload are accessed assuming (at least)
+        * 2-byte alignment, so a following packet must start at an even offset.
+        */
+       if (tvlv_buff_len & 1)
+               goto free_skb;
+
        ret = batadv_tvlv_containers_process(bat_priv, BATADV_MCAST, NULL, skb,
                                             tvlv_buff, tvlv_buff_len);
        if (ret >= 0) {

diff --git a/net/batman-adv/tvlv.c b/net/batman-adv/tvlv.c
index 403c8545687048ebd8dad1af5d3bee4bc4b6a24e..a957555d8958d1be83be86d971f004fa03a1d42e 100644 (file)
--- a/net/batman-adv/tvlv.c
+++ b/net/batman-adv/tvlv.c
@@ -477,6 +477,12 @@ int batadv_tvlv_containers_process(struct batadv_priv *bat_priv,
                if (tvlv_value_cont_len > tvlv_value_len)
                        break;
 
+               /* the next tvlv header is accessed assuming (at least) 2-byte
+                * alignment, so it must start at an even offset.
+                */
+               if (tvlv_value_cont_len & 1)
+                       break;
+
                tvlv_handler = batadv_tvlv_handler_get(bat_priv,
                                                       tvlv_hdr->type,
                                                       tvlv_hdr->version);