Commit 162d549c authored by Sven Eckelmann's avatar Sven Eckelmann Committed by Antonio Quartulli

batman-adv: Don't leak information through uninitialized packet fields

The reserved fields in batman-adv packets are not set to a constant value. The
content of these memory regions is leaked unintentionally to the network.

This regression was introduced in 3b27ffb0Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
Signed-off-by: default avatarAntonio Quartulli <ordex@autistici.org>
parent 0c5e45b6
...@@ -214,6 +214,7 @@ static int batadv_interface_tx(struct sk_buff *skb, ...@@ -214,6 +214,7 @@ static int batadv_interface_tx(struct sk_buff *skb,
/* batman packet type: broadcast */ /* batman packet type: broadcast */
bcast_packet->header.packet_type = BATADV_BCAST; bcast_packet->header.packet_type = BATADV_BCAST;
bcast_packet->reserved = 0;
/* hw address of first interface is the orig mac because only /* hw address of first interface is the orig mac because only
* this mac is known throughout the mesh * this mac is known throughout the mesh
......
...@@ -2052,6 +2052,7 @@ static void batadv_send_roam_adv(struct batadv_priv *bat_priv, uint8_t *client, ...@@ -2052,6 +2052,7 @@ static void batadv_send_roam_adv(struct batadv_priv *bat_priv, uint8_t *client,
roam_adv_packet->header.packet_type = BATADV_ROAM_ADV; roam_adv_packet->header.packet_type = BATADV_ROAM_ADV;
roam_adv_packet->header.version = BATADV_COMPAT_VERSION; roam_adv_packet->header.version = BATADV_COMPAT_VERSION;
roam_adv_packet->header.ttl = BATADV_TTL; roam_adv_packet->header.ttl = BATADV_TTL;
roam_adv_packet->reserved = 0;
primary_if = batadv_primary_if_get_selected(bat_priv); primary_if = batadv_primary_if_get_selected(bat_priv);
if (!primary_if) if (!primary_if)
goto out; goto out;
......
...@@ -589,6 +589,7 @@ static int batadv_generate_vis_packet(struct batadv_priv *bat_priv) ...@@ -589,6 +589,7 @@ static int batadv_generate_vis_packet(struct batadv_priv *bat_priv)
packet->header.ttl = BATADV_TTL; packet->header.ttl = BATADV_TTL;
packet->seqno = htonl(ntohl(packet->seqno) + 1); packet->seqno = htonl(ntohl(packet->seqno) + 1);
packet->entries = 0; packet->entries = 0;
packet->reserved = 0;
skb_trim(info->skb_packet, sizeof(*packet)); skb_trim(info->skb_packet, sizeof(*packet));
if (packet->vis_type == BATADV_VIS_TYPE_CLIENT_UPDATE) { if (packet->vis_type == BATADV_VIS_TYPE_CLIENT_UPDATE) {
...@@ -890,6 +891,7 @@ int batadv_vis_init(struct batadv_priv *bat_priv) ...@@ -890,6 +891,7 @@ int batadv_vis_init(struct batadv_priv *bat_priv)
packet->header.packet_type = BATADV_VIS; packet->header.packet_type = BATADV_VIS;
packet->header.ttl = BATADV_TTL; packet->header.ttl = BATADV_TTL;
packet->seqno = 0; packet->seqno = 0;
packet->reserved = 0;
packet->entries = 0; packet->entries = 0;
INIT_LIST_HEAD(&bat_priv->vis_send_list); INIT_LIST_HEAD(&bat_priv->vis_send_list);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment