summaryrefslogtreecommitdiffstats
path: root/net/batman-adv
diff options
context:
space:
mode:
authorSven Eckelmann <sven@narfation.org>2012-06-28 11:56:52 +0200
committerAntonio Quartulli <ordex@autistici.org>2012-07-01 22:47:24 +0200
commit162d549c6905485262635fe594db337efb2828b5 (patch)
tree85346674b2ff741ec9053470736ba2d034156190 /net/batman-adv
parent0c5e45b63d22c6efa6f829c617d8f36688e53c5d (diff)
downloadop-kernel-dev-162d549c6905485262635fe594db337efb2828b5.zip
op-kernel-dev-162d549c6905485262635fe594db337efb2828b5.tar.gz
batman-adv: Don't leak information through uninitialized packet fields
The reserved fields in batman-adv packets are not set to a constant value. The content of these memory regions is leaked unintentionally to the network. This regression was introduced in 3b27ffb00fbe9d9189715ea13ce8712e2f0cb0c5 Signed-off-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Antonio Quartulli <ordex@autistici.org>
Diffstat (limited to 'net/batman-adv')
-rw-r--r--net/batman-adv/soft-interface.c1
-rw-r--r--net/batman-adv/translation-table.c1
-rw-r--r--net/batman-adv/vis.c2
3 files changed, 4 insertions, 0 deletions
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index b7c655c..9e4bb61 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -214,6 +214,7 @@ static int batadv_interface_tx(struct sk_buff *skb,
/* batman packet type: broadcast */
bcast_packet->header.packet_type = BATADV_BCAST;
+ bcast_packet->reserved = 0;
/* hw address of first interface is the orig mac because only
* this mac is known throughout the mesh
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 245cc9a..a438f4b 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -2052,6 +2052,7 @@ static void batadv_send_roam_adv(struct batadv_priv *bat_priv, uint8_t *client,
roam_adv_packet->header.packet_type = BATADV_ROAM_ADV;
roam_adv_packet->header.version = BATADV_COMPAT_VERSION;
roam_adv_packet->header.ttl = BATADV_TTL;
+ roam_adv_packet->reserved = 0;
primary_if = batadv_primary_if_get_selected(bat_priv);
if (!primary_if)
goto out;
diff --git a/net/batman-adv/vis.c b/net/batman-adv/vis.c
index f09cc9a..2a2ea06 100644
--- a/net/batman-adv/vis.c
+++ b/net/batman-adv/vis.c
@@ -589,6 +589,7 @@ static int batadv_generate_vis_packet(struct batadv_priv *bat_priv)
packet->header.ttl = BATADV_TTL;
packet->seqno = htonl(ntohl(packet->seqno) + 1);
packet->entries = 0;
+ packet->reserved = 0;
skb_trim(info->skb_packet, sizeof(*packet));
if (packet->vis_type == BATADV_VIS_TYPE_CLIENT_UPDATE) {
@@ -890,6 +891,7 @@ int batadv_vis_init(struct batadv_priv *bat_priv)
packet->header.packet_type = BATADV_VIS;
packet->header.ttl = BATADV_TTL;
packet->seqno = 0;
+ packet->reserved = 0;
packet->entries = 0;
INIT_LIST_HEAD(&bat_priv->vis_send_list);
OpenPOWER on IntegriCloud