source: packages/net/batman-adv/patches/batman-adv_correctly_set_the_data_field_in_the_TT_REPONSE_packet.patch @ 28474

Last change on this file since 28474 was 28474, checked in by marek, 5 years ago

batman-adv: yet another critical bug fix

Forgot to add this one during the last round.

Signed-off-by: Marek Lindner <lindner_marek@…>

File size: 1.2 KB
  • translation-table.c

    From: Antonio Quartulli <ordex@autistici.org>
    
    In the TT_RESPONSE packet, the number of carried entries is not correctly set.
    This leads to a wrong interpretation of the packet payload on the receiver side
    causing random entries to be added to the global translation table. Therefore
    the latter gets always corrupted, triggering a table recovery all the time.
    
    Signed-off-by: Antonio Quartulli <ordex@autistici.org>
    ---
     translation-table.c |    5 ++++-
     1 files changed, 4 insertions(+), 1 deletions(-)
    
    a b static struct sk_buff *tt_response_fill_table(uint16_t tt_len, uint8_t ttvn, 
    10541054        tt_response = (struct tt_query_packet *)skb_put(skb, 
    10551055                                                     tt_query_size + tt_len); 
    10561056        tt_response->ttvn = ttvn; 
    1057         tt_response->tt_data = htons(tt_tot); 
    10581057 
    10591058        tt_change = (struct tt_change *)(skb->data + tt_query_size); 
    10601059        tt_count = 0; 
    static struct sk_buff *tt_response_fill_table(uint16_t tt_len, uint8_t ttvn, 
    10801079        } 
    10811080        rcu_read_unlock(); 
    10821081 
     1082        /* store in the message the number of entries we have successfully 
     1083         * copied */ 
     1084        tt_response->tt_data = htons(tt_count); 
     1085 
    10831086out: 
    10841087        return skb; 
    10851088} 
Note: See TracBrowser for help on using the repository browser.