raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 18:09:56 +00:00
Code Issues Projects Releases Wiki Activity

batman-adv: fix OOB read/write in network-coding decode

Browse Source 
commit d77b6ff0ce upstream.

batadv_nc_skb_decode_packet() trusts coded_len and checks only against
skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing
payload headroom, and the source skb length is not verified, allowing an
out-of-bounds read and a small out-of-bounds write.

Validate that coded_len fits within the payload area of both destination
and source sk_buffs before XORing.

Fixes: 2df5278b02 ("batman-adv: network coding - receive coded packets and decode them")
Cc: stable@vger.kernel.org
Reported-by: Stanislav Fort <disclosure@aisle.com>
Signed-off-by: Stanislav Fort <stanislav.fort@aisle.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Stanislav Fort
2025-08-31 16:56:23 +02:00
committed by Greg Kroah-Hartman
parent 367cb5ffd8
commit 2008070945
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
net/batman-adv/network-coding.c
View File

@@ -1687,7 +1687,12 @@ batadv_nc_skb_decode_packet(struct batadv_priv *bat_priv, struct sk_buff *skb,
coding_len = ntohs(coded_packet_tmp.coded_len); coding_len = ntohs(coded_packet_tmp.coded_len);
if (coding_len > skb->len) /* ensure dst buffer is large enough (payload only) */
if (coding_len + h_size > skb->len)
return NULL;
/* ensure src buffer is large enough (payload only) */
if (coding_len + h_size > nc_packet->skb->len)
return NULL; return NULL;
/* Here the magic is reversed: /* Here the magic is reversed: