From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4B39F3254B3; Sun, 7 Jun 2026 10:25:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780827955; cv=none; b=ICjt807e2Glt41hq2CxdgxCVxmN/4fvON9WFCTKrTlNXoXxzm3FHYuEchEWFWHz8cydIsRrAEja7S9yrQeOs7rrz5MMA1huN4+YUP5FqjMI0HjRQe7jZkx0jBelT49sTXVMEZtTT+qW+g5krVRRYPU7ywB7HU4y9Ysh1bzPESdY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780827955; c=relaxed/simple; bh=qCmoaQQBw2wipGsaBwzOC7ck2zBx5+Wo9V1NLuQNLSU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=N7sW23rFUjB9VX7A2rN5vSd1JRyRH/lKepOlXsIo/cyJGP0uZINf5PKULnBpCzXpdZm3/9vb+p3iQcOnEgXTJofLHhpAx9+08in49RLZrxomMCmwGubHz537hg7UUGDvaI22gzP6kkg8c4D7ebMmo7YHr4pm66lIw9N/iK1HVmY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=jj1eo1SW; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="jj1eo1SW" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9258C1F00893; Sun, 7 Jun 2026 10:25:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1780827954; bh=y+MVT1UW6XTBqhLr98/lbAHNGBoxqfgIk71DQD/Fm3I=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=jj1eo1SWqCaGh7htWDA5FHaeqQKWVaCMtOyzbVXOhhepGh4LPFZXT+kALgzAzAaTM 7EVh7SHTs3KtVIs/RXZKXfQyj7esf46N9ynCIfzFO5dnJbXCh+h/Xz/31yCSgoWbCo sLmxsBKucxT5jT3VVIAVKLUEUHEUgAQmNq9CuyJ0= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable@kernel.org, Sven Eckelmann , Sasha Levin Subject: [PATCH 6.12 099/307] batman-adv: tt: reject oversized local TVLV buffers Date: Sun, 7 Jun 2026 11:58:16 +0200 Message-ID: <20260607095731.419043241@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260607095727.647295505@linuxfoundation.org> References: <20260607095727.647295505@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sven Eckelmann commit 1e9fab756f8395096d5bba7be0c373c4c8f5d165 upstream. The commit 3a359bf5c61d ("batman-adv: reject oversized global TT response buffers") added a check to ensure that a global return buffer size can be stored in an u16. The same buffer handling also exists for the local data buffer but was not touched. A similar check should be also be in place for the local TVLV buffer. It doesn't have the similar attack surface because it is only generated from locally discovered MAC addresses but the dynamic nature could still cause temporarily to large buffers. Cc: stable@kernel.org Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific") [ Context ] Signed-off-by: Sven Eckelmann Signed-off-by: Sasha Levin --- net/batman-adv/translation-table.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index d830ccf016697b..8ffebece03c529 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -924,12 +924,12 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv, { struct batadv_tvlv_tt_vlan_data *tt_vlan; struct batadv_softif_vlan *vlan; + size_t change_offset; u16 num_vlan = 0; u16 vlan_entries = 0; u16 total_entries = 0; u16 tvlv_len; u8 *tt_change_ptr; - int change_offset; spin_lock_bh(&bat_priv->softif_vlan_list_lock); hlist_for_each_entry(vlan, &bat_priv->softif_vlan_list, list) { @@ -948,8 +948,10 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv, if (*tt_len < 0) *tt_len = batadv_tt_len(total_entries); - tvlv_len = *tt_len; - tvlv_len += change_offset; + if (check_add_overflow(*tt_len, change_offset, &tvlv_len)) { + tvlv_len = 0; + goto out; + } *tt_data = kmalloc(tvlv_len, GFP_ATOMIC); if (!*tt_data) { -- 2.53.0