diff options
| author | Marek Lindner <[email protected]> | 2010-10-19 11:59:13 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <[email protected]> | 2010-10-19 10:04:16 -0700 |
| commit | 24fb009bae18f2ef712800ee9b2f52c177d9d3f9 (patch) | |
| tree | f34c7612e242c878ac09d20bde0ac773c8fccf4e | |
| parent | 3c45603024c8dd5321f9504b351df3cb825e5951 (diff) | |
Staging: batman-adv: protect against ogm packet overflow by checking table length
Reported-by: Sam Yeung <[email protected]>
Signed-off-by: Marek Lindner <[email protected]>
Signed-off-by: Sven Eckelmann <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
| -rw-r--r-- | drivers/staging/batman-adv/translation-table.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/drivers/staging/batman-adv/translation-table.c b/drivers/staging/batman-adv/translation-table.c index 12b23259c385..681ccbda3eac 100644 --- a/drivers/staging/batman-adv/translation-table.c +++ b/drivers/staging/batman-adv/translation-table.c @@ -59,6 +59,7 @@ void hna_local_add(struct net_device *soft_iface, uint8_t *addr) struct hna_global_entry *hna_global_entry; struct hashtable_t *swaphash; unsigned long flags; + int required_bytes; spin_lock_irqsave(&bat_priv->hna_lhash_lock, flags); hna_local_entry = @@ -74,8 +75,12 @@ void hna_local_add(struct net_device *soft_iface, uint8_t *addr) /* only announce as many hosts as possible in the batman-packet and space in batman_packet->num_hna That also should give a limit to MAC-flooding. */ - if ((bat_priv->num_local_hna + 1 > (ETH_DATA_LEN - BAT_PACKET_LEN) - / ETH_ALEN) || + required_bytes = (bat_priv->num_local_hna + 1) * ETH_ALEN; + required_bytes += BAT_PACKET_LEN; + + if ((required_bytes > ETH_DATA_LEN) || + (atomic_read(&bat_priv->aggregation_enabled) && + required_bytes > MAX_AGGREGATION_BYTES) || (bat_priv->num_local_hna + 1 > 255)) { bat_dbg(DBG_ROUTES, bat_priv, "Can't add new local hna entry (%pM): " |