batman-adv/patches/0046-batman-adv-Avoid-probe-ELP-information-leak.patch

   1 From: Sven Eckelmann <sven@narfation.org>
   2 Date: Fri, 31 Aug 2018 15:08:44 +0200
   3 Subject: batman-adv: Avoid probe ELP information leak
   4
   5 The probe ELPs for WiFi interfaces are expanded to contain at least
   6 BATADV_ELP_MIN_PROBE_SIZE bytes. This is usually a lot more than the
   7 number of bytes which the template ELP packet requires.
   8
   9 These extra padding bytes were not initialized and thus could contain data
  10 which were previously stored at the same location. It is therefore required
  11 to set it to some predefined or random values to avoid leaking private
  12 information from the system transmitting these kind of packets.
  13
  14 Fixes: bedcadfaa92b ("batman-adv: ELP - send unicast ELP packets for throughput sampling")
  15 Signed-off-by: Sven Eckelmann <sven@narfation.org>
  16 Acked-by: Antonio Quartulli <a@unstable.cc>
  17
  18 Origin: upstream, https://git.open-mesh.org/batman-adv.git/commit/6c876e572f592c31132a55b5fb8427e168e5fb3c
  19
  20 diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
  21 index 06b2924f4cb7dde54bab97ad2d28aecd9b1a4ceb..e988a14f3eb01de1f52fe6dcaa91af898060140e 100644
  22 --- a/net/batman-adv/bat_v_elp.c
  23 +++ b/net/batman-adv/bat_v_elp.c
  24 @@ -227,7 +227,7 @@ batadv_v_elp_wifi_neigh_probe(struct batadv_hardif_neigh_node *neigh)
  25                  * the packet to be exactly of that size to make the link
  26                  * throughput estimation effective.
  27                  */
  28 -               skb_put(skb, probe_len - hard_iface->bat_v.elp_skb->len);
  29 +               skb_put_zero(skb, probe_len - hard_iface->bat_v.elp_skb->len);
  30
  31                 batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
  32                            "Sending unicast (probe) ELP packet on interface %s to %pM\n",