diff options
| author | Matthias Schiffer <mschiffer@universe-factory.net> | 2020-10-19 22:09:34 +0200 |
|---|---|---|
| committer | Matthias Schiffer <mschiffer@universe-factory.net> | 2020-10-19 22:16:14 +0200 |
| commit | a72e95a2f450a42f59984135ce6239289d1d3a5a (patch) | |
| tree | 42f541b587b5e4ec4846787f04c899c1e1cab709 | |
| parent | 34353f2e8ba8c82b5672761081e202af9b80aa90 (diff) | |
fastd: fix buffer leak when receiving invalid packets
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
| -rw-r--r-- | net/fastd/Makefile | 2 | ||||
| -rw-r--r-- | net/fastd/patches/0003-receive-fix-buffer-leak-when-receiving-invalid-packe.patch | 42 |
2 files changed, 43 insertions, 1 deletions
diff --git a/net/fastd/Makefile b/net/fastd/Makefile index 2686c7fb9..70df5c20a 100644 --- a/net/fastd/Makefile +++ b/net/fastd/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=fastd PKG_VERSION:=18 -PKG_RELEASE:=2.1 +PKG_RELEASE:=2.2 PKG_MAINTAINER:=Matthias Schiffer <mschiffer@universe-factory.net> PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz diff --git a/net/fastd/patches/0003-receive-fix-buffer-leak-when-receiving-invalid-packe.patch b/net/fastd/patches/0003-receive-fix-buffer-leak-when-receiving-invalid-packe.patch new file mode 100644 index 000000000..b67a85c4e --- /dev/null +++ b/net/fastd/patches/0003-receive-fix-buffer-leak-when-receiving-invalid-packe.patch @@ -0,0 +1,42 @@ +From f6a2651fa91c472d04cb34264718f761669c8aa1 Mon Sep 17 00:00:00 2001 +Message-Id: <f6a2651fa91c472d04cb34264718f761669c8aa1.1603136280.git.mschiffer@universe-factory.net> +From: Matthias Schiffer <mschiffer@universe-factory.net> +Date: Mon, 19 Oct 2020 21:08:16 +0200 +Subject: [PATCH] receive: fix buffer leak when receiving invalid packets + +For fastd versions before v20, this was just a memory leak (which could +still be used for DoS, as it's remotely triggerable). With the new +buffer management of fastd v20, this will trigger an assertion failure +instead as soon as the buffer pool is empty. + +(cherry picked from commit 737925113363b6130879729cdff9ccc46c33eaea) +--- + src/receive.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/src/receive.c ++++ b/src/receive.c +@@ -186,6 +186,11 @@ static inline void handle_socket_receive + + case PACKET_HANDSHAKE: + fastd_handshake_handle(sock, local_addr, remote_addr, peer, buffer); ++ break; ++ ++ default: ++ fastd_buffer_free(buffer); ++ pr_debug("received packet with invalid type from %P[%I]", peer, remote_addr); + } + } + +@@ -211,6 +216,11 @@ static inline void handle_socket_receive + + case PACKET_HANDSHAKE: + fastd_handshake_handle(sock, local_addr, remote_addr, NULL, buffer); ++ break; ++ ++ default: ++ fastd_buffer_free(buffer); ++ pr_debug("received packet with invalid type from unknown address %I", remote_addr); + } + } + |