From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f177.google.com (mail-qk1-f177.google.com [209.85.222.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 388F32F5A12 for ; Fri, 31 Jul 2026 13:52:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785505946; cv=none; b=p0zp1EoeTfzZYq3tCrBoi2YSnwdp3w8d/Ojmr33E3UcQSR0OVVbqDyj8iRKe754dJygJSGqKqnPtX0T0kcfaHvbkzfGrVUr16drc691j071f01i7vo+Yiu7ef8751Iyhh3X22hWju2M0ITG4f9MDFshQ0XHKuK2EebMv32HPfoE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785505946; c=relaxed/simple; bh=Wn0OMA41IQ145dpZZTp9frCisuzPDCZJLRvn3xeQajs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=KKevzXUFPLgkjb3m+LDHgxtOL32jNZCBWt6qOvv4G2HmxJKg7EYwvY2NEVDiUKSrdNZjFPzbovkqpHcSqJ0ad0wIa081rAPap6Qdc5LCAlAlhNAmJnvleayx1tJdEUSXNkYtTwwTTJRrsADLCNBGQTRJyst1TYm2k5WPnhh82g4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com; spf=pass smtp.mailfrom=trailofbits.com; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b=hsM3nbcf; arc=none smtp.client-ip=209.85.222.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b="hsM3nbcf" Received: by mail-qk1-f177.google.com with SMTP id af79cd13be357-92e65e18969so55752385a.1 for ; Fri, 31 Jul 2026 06:52:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trailofbits.com; s=google; t=1785505944; x=1786110744; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=TEXe4kmCb7pLmHb4F7zY2/M7kyesau+t7W0UeieXcXE=; b=hsM3nbcfEeCVA9J/nod1O1ygpL7KRC2Ydb858mqgSAoiGJaaUbJ8kwO+vNYVTvQ4EI kfVtnY4QowX+hUNlwR5Wpy4vIP8kWbQhd5mdH8hzf6semRGUI1rf8hnoot2+5euBq0sP en0THHS1CM+vibxI/To6h1hafP9kqeR+7hQh6HAaXf+iRuhuOP33Au6Y4c04iEwd3uOF 15YvTzx5/uZT1hROspZJzhLaOFa62W3Oo1f8vlTPPGyZoX/wRpklc8WjHS3o79HNzUZZ fcoN1gghkNrPHR8xkrotTD4UuIJbCvTt7sIm82housN+emjYwXpDq6UHld7do/6QuB/7 L7DA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785505944; x=1786110744; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=TEXe4kmCb7pLmHb4F7zY2/M7kyesau+t7W0UeieXcXE=; b=FnNz8piVpKLAVdrrgLIaRcmpufdVjTT7IbilBOch1mSF/ANCja/bYYcIf+EC/GqCEP /2SSHK18WgYq7yy01rUSJHOtij92nlvnP2qGfoYDuUkX7ASuHmSSgIpXQvx6wQfeQ1Ay G/ZOfRwetwCAq73xe9FK8mFnCFO49xM4WAdrtaOiXnImdJU5VY6UZ5myUKe1JHlf7grm Ra4tb9xkf8rkzhmib1YaSn0hB+KolkAKUM3S3Nr/Pl05PQN1AMTze9DuRJotH9tAz5kq bE/QNmZsReMnm3Q4swlH0JVAb7gzVf6coP6henLTRTIB1cmKoiXTa0Go1pkLiD14CC6B 1oAg== X-Forwarded-Encrypted: i=1; AHgh+Rop/Wl63LppXv7h+2aP2TK0/1KWCvmJZxcuY/DqK5GrW+DfIRKTk3YDaAlb/IL97moyeDv2FpBa0bhQAvQ=@vger.kernel.org X-Gm-Message-State: AOJu0Yx3fiUjjCdOKY5QVnNZlCx5kROZ8Z9z1OlF733DD2HVN7tc92Pg ad9cG1ogyUA4FXDzz3lXPCFnRNGBqSpaGgq7euDfi2PV/euIxEZQnjVmKSPvlBZ51p4= X-Gm-Gg: AR+sD13HIaGCsDFg7z9S9JYrQ9vSWtZAD1ClKod37793hrVi3y82Dl6dZKpzopUUXBF 6nalvu5KzN8qZ+WsCakdWrn04pHwWGnkVoD+1J65WfCkA6XbILDrZ5MWbZX2h+vI1wshBuwkS8d hCWyvXoKy0mUYf9ikXiLumpOxkCE+VjpqVJblQLS14Wmw0ieVSugM4IXG5XblMf8u9WdU3hDiVl Z9+DD1fKeOAXEJk2hMQtgwFPavikCxwNLGERg07GKCjBSuGYenQ4baSOf8KMPFrSKzq+KJF6ysO 70HcXuR61q2cf1MMLb9/mkuQZZNJ+za7k81cb6FTMc8Yd8k0EgFVmU0pU19V+XZx4fhaOeJUKks LoMc1Ot144PibUONJTfpPT9Zh0S/GrbaI1nCLaKiFdSTN7uxUKsFwGKO3r9GgMej89belqb7ilQ S/otIGwjvsfIdOFiK2xB6k8ZFINk2KW+n8qNXkeW6iZkm22iV/PNZCCZaPqVOd6Il56g== X-Received: by 2002:a05:620a:a109:b0:92e:eed7:91a9 with SMTP id af79cd13be357-93497b92eb8mr219009685a.7.1785505943898; Fri, 31 Jul 2026 06:52:23 -0700 (PDT) Received: from localhost ([146.190.222.192]) by smtp.gmail.com with UTF8SMTPSA id af79cd13be357-9349c199c2asm58681685a.28.2026.07.31.06.52.23 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 31 Jul 2026 06:52:23 -0700 (PDT) From: David Lee To: marek.lindner@mailbox.org, sw@simonwunderlich.de, antonio@mandelbit.com, sven@narfation.org Cc: David Lee , Kyle Zeng , Dominik 'Disconnect3d' Czarnota , b.a.t.m.a.n@lists.open-mesh.org, linux-kernel@vger.kernel.org Subject: [PATCH] batman-adv: reject unrepresentable multicast TVLV offsets Date: Fri, 31 Jul 2026 13:52:22 +0000 Message-ID: <20260731135222.566367-1-david.lee@trailofbits.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The network and transport header fields in struct sk_buff are 16-bit offsets from skb->head, and U16_MAX is reserved as the unset transport header value. batadv_tvlv_call_handler() sets both fields without checking that the end of a received multicast TVLV is representable. A sufficiently large TVLV therefore wraps the transport header offset. skb_network_header_len() then returns a bogus large length, allowing batadv_mcast_forw_packet() to access memory beyond the skb data. Reject multicast TVLVs whose absolute end offset cannot be represented before changing either header field. Fixes: 07afe1ba288c ("batman-adv: mcast: implement multicast packet reception and forwarding") Bug found and triaged by OpenAI Security Research and validated by Trail of Bits. Assisted-by: Codex:gpt-5.6-sol gpt-5.5-cyber Signed-off-by: Kyle Zeng --- Trail of Bits has a reproducer for this bug that triggers a KASAN use-after-free and can share if needed. net/batman-adv/tvlv.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/batman-adv/tvlv.c b/net/batman-adv/tvlv.c index 1c9fb2198..5e9d0e2dd 100644 --- a/net/batman-adv/tvlv.c +++ b/net/batman-adv/tvlv.c @@ -433,6 +433,9 @@ static int batadv_tvlv_call_handler(struct batadv_priv *bat_priv, return NET_RX_SUCCESS; tvlv_offset = (unsigned char *)tvlv_value - skb->data; + if (skb_headroom(skb) + tvlv_offset + tvlv_value_len >= U16_MAX) + return -EINVAL; + skb_set_network_header(skb, tvlv_offset); skb_set_transport_header(skb, tvlv_offset + tvlv_value_len); -- 2.53.0