[PATCH batadv 0/3] batman-adv: mcast header creation bugs

[PATCH batadv 0/3] batman-adv: mcast header creation bugs

[Sven Eckelmann]

The code which introduced the mcast packet format was expanding the skbuff
header in various places. But this broke the priority extraction and was
requiring various skb properties (linearized, unshared) but only in some
paths (forwarding of TVLV) ensured that this is actually the case while
forgetting in others (initial creation of an mcast packet).

Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
Sven Eckelmann (3):
      batman-adv: fix TX priority extraction for BATADV_FORW_MCAST
      batman-adv: mcast: ensure unshared skb for multicast packets
      batman-adv: mcast: linearize skbuff for packet generation

 net/batman-adv/mesh-interface.c | 7 +++++--
 net/batman-adv/multicast_forw.c | 9 +++++----
 2 files changed, 10 insertions(+), 6 deletions(-)
---
base-commit: 6628ab4bc899bff39637008ebb5ef89372efd9d3
change-id: 20260709-mcast-header-generation-bugs-bed17c85a6ba

Best regards,
--  
Sven Eckelmann <sven@narfation.org>

[PATCH batadv 1/3] batman-adv: fix TX priority extraction for BATADV_FORW_MCAST

[Sven Eckelmann]

batadv_mcast_forw_mode_by_count() pushs the skb->data for BATADV_FORW_MCAST
forwarding via batadv_mcast_forw_mcsend(). But the
batadv_skb_set_priority() expects the ethernet header directly before
(skb->data + offset). With the moved skb->data, just some random data would
be accessed to get the priority data.

Move the batadv_skb_set_priority() before the decision about the handling
multicast packets and potential header modifications.

Fixes: be9b0169c840 ("batman-adv: mcast: implement multicast packet generation")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
 net/batman-adv/mesh-interface.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/batman-adv/mesh-interface.c b/net/batman-adv/mesh-interface.c
index b2c8febe..20582fe0 100644
--- a/net/batman-adv/mesh-interface.c
+++ b/net/batman-adv/mesh-interface.c
@@ -300,6 +300,8 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
 	if (batadv_compare_eth(ethhdr->h_dest, ectp_addr))
 		goto dropped;
 
+	batadv_skb_set_priority(skb, 0);
+
 	gw_mode = READ_ONCE(bat_priv->gw.mode);
 	if (is_multicast_ether_addr(ethhdr->h_dest)) {
 		/* if gw mode is off, broadcast every packet */
@@ -333,6 +335,9 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
 
 send:
 		if (do_bcast && !is_broadcast_ether_addr(ethhdr->h_dest)) {
+			/* WARNING batadv_mcast_forw_mode might add more headers
+			 * in front of the skb. and might even reallocate the skb
+			 */
 			forw_mode = batadv_mcast_forw_mode(bat_priv, skb, vid,
 							   &mcast_is_routable);
 			switch (forw_mode) {
@@ -350,8 +355,6 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
 		}
 	}
 
-	batadv_skb_set_priority(skb, 0);
-
 	/* ethernet packet should be broadcasted */
 	if (do_bcast) {
 		primary_if = batadv_primary_if_get_selected(bat_priv);

-- 
2.47.3

[PATCH batadv 2/3] batman-adv: mcast: ensure unshared skb for multicast packets

[Sven Eckelmann]

When a packet is transmitted via a batman-adv interface and has already
enough room for the header then the nothing will make sure that the skbuff
is unshared. But it is now allowed to modify a currently shared skbuff.

Always make sure that the pskb_expand_head() is not only called for a too
small header but also for shared skbuffs.

Fixes: be9b0169c840 ("batman-adv: mcast: implement multicast packet generation")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
 net/batman-adv/multicast_forw.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/batman-adv/multicast_forw.c b/net/batman-adv/multicast_forw.c
index 60ad3a55..c5b8e2e3 100644
--- a/net/batman-adv/multicast_forw.c
+++ b/net/batman-adv/multicast_forw.c
@@ -1100,8 +1100,7 @@ static int batadv_mcast_forw_expand_head(struct batadv_priv *bat_priv,
 		return -EINVAL;
 	}
 
-	if (skb_headroom(skb) < hdr_size &&
-	    pskb_expand_head(skb, hdr_size, 0, GFP_ATOMIC) < 0)
+	if (skb_cow(skb, hdr_size) < 0)
 		return -ENOMEM;
 
 	return 0;

-- 
2.47.3

[PATCH batadv 3/3] batman-adv: mcast: linearize skbuff for packet generation

[Sven Eckelmann]

batadv_mcast_forw_packet() is not only called by the unsharing+linearizing
batadv_recv_mcast_packet() handler. When it is called by
batadv_mcast_forw_mcsend() then it will be unshared but not linearized. The
SKB_LINEAR_ASSERT() can therefore cause a fatal BUG().

The batadv_mcast_forw_packet() must handle the linearization itself.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: 8ed36122d709 ("batman-adv: mcast: implement multicast packet reception and forwarding")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
 net/batman-adv/multicast_forw.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/batman-adv/multicast_forw.c b/net/batman-adv/multicast_forw.c
index c5b8e2e3..9fbd2876 100644
--- a/net/batman-adv/multicast_forw.c
+++ b/net/batman-adv/multicast_forw.c
@@ -937,8 +937,10 @@ static int batadv_mcast_forw_packet(struct batadv_priv *bat_priv,
 	u8 *dest;
 	int ret;
 
-	/* (at least) TVLV part needs to be linearized */
-	SKB_LINEAR_ASSERT(skb);
+	/* packet needs to be linearized to access the tvlv content */
+	ret = skb_linearize(skb);
+	if (ret < 0)
+		return -ENOMEM;
 
 	/* check if batadv_tvlv_mcast_tracker header is within skb length */
 	if (sizeof(*mcast_tracker) > skb_network_header_len(skb))

-- 
2.47.3

Re: [PATCH batadv 3/3] batman-adv: mcast: linearize skbuff for packet generation

[Sven Eckelmann]

[-- Attachment #1: Type: text/plain, Size: 1857 bytes --]

On Thursday, 9 July 2026 21:45:57 CEST Sven Eckelmann wrote:
> batadv_mcast_forw_packet() is not only called by the unsharing+linearizing
> batadv_recv_mcast_packet() handler. When it is called by
> batadv_mcast_forw_mcsend() then it will be unshared but not linearized. The
> SKB_LINEAR_ASSERT() can therefore cause a fatal BUG().
> 
> The batadv_mcast_forw_packet() must handle the linearization itself.
> 
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Fixes: 8ed36122d709 ("batman-adv: mcast: implement multicast packet reception and forwarding")
> Signed-off-by: Sven Eckelmann <sven@narfation.org>
> ---
>  net/batman-adv/multicast_forw.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/net/batman-adv/multicast_forw.c b/net/batman-adv/multicast_forw.c
> index c5b8e2e3..9fbd2876 100644
> --- a/net/batman-adv/multicast_forw.c
> +++ b/net/batman-adv/multicast_forw.c
> @@ -937,8 +937,10 @@ static int batadv_mcast_forw_packet(struct batadv_priv *bat_priv,
>  	u8 *dest;
>  	int ret;
>  
> -	/* (at least) TVLV part needs to be linearized */
> -	SKB_LINEAR_ASSERT(skb);
> +	/* packet needs to be linearized to access the tvlv content */
> +	ret = skb_linearize(skb);
> +	if (ret < 0)
> +		return -ENOMEM;
>  
>  	/* check if batadv_tvlv_mcast_tracker header is within skb length */
>  	if (sizeof(*mcast_tracker) > skb_network_header_len(skb))
> 
> 

We might move this to the same place as the skb_cow fix (see patch 2) because 
batadv_mcast_forw_scrape() has also this assert and following unlinearized-skb 
callchain exists:


batadv_interface_tx
batadv_mcast_forw_mode
batadv_mcast_forw_mode_by_count
batadv_mcast_forw_push
batadv_mcast_forw_push_tvlvs
batadv_mcast_forw_push_dests
batadv_mcast_forw_push_adjust_padding
batadv_mcast_forw_scrape


And this is called before batadv_mcast_forw_packet

Regards,
	Sven

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 228 bytes --]