From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0648B24E4AF; Mon, 13 Apr 2026 16:12:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776096736; cv=none; b=MnRXAPnGNyrPzZHKbjMy36e4cXORuN0zwC36qzDEefq8WjirnrRwstMhX+OQt1DhQu1GgVfqzKz11xmYX1aluihgcsV5dstwxc9nklWOKTNSaQYdhnOpmffCMjnDlqriyI+qh9a9IEE/dJCLHMA9Zy834/CvKy58G2532/X0KRY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776096736; c=relaxed/simple; bh=advguUAj4T3NEW4VbYFJO/LqVTyw5V6Axt0XwvN9X0U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=td1NFevtOKhGGTcaD63c8Nso/bMRUwT2PITW+EMMYbBKT77lJU29Z9H1AhmnD4NkoBNqV2jDaYD7t+kE/RvPjgxpR+ZZ/U8jUKBTDT4JwoVlZSVdsuRJiLtEXutFLjQFyLhQz6pshjAC/i/s8QEPq6IZFY7t7Fo5hTCUSMiY+4g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ybRgl3jT; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ybRgl3jT" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 91002C2BCAF; Mon, 13 Apr 2026 16:12:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1776096735; bh=advguUAj4T3NEW4VbYFJO/LqVTyw5V6Axt0XwvN9X0U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ybRgl3jT/56upbJdTdhoCm55PUwAzJS4cDm8MVpIsjj5+B9mPUZ2lhNSHL3Oho1tQ uaB996kI8kYRcwRmF6Gr7nMsK5aXQ0Jm37x6HvS4+zoa8/1RJK+XA7kZXpDyT2KXuI 1m6eSA6sNeTbvolu25dvYNZp+ATdMKpSYfTolz+E= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Yifan Wu , Juefei Pu , Yuan Tan , Xin Liu , Ren Wei , Ruide Cao , Ren Wei , Sven Eckelmann , Simon Wunderlich Subject: [PATCH 6.12 42/70] batman-adv: reject oversized global TT response buffers Date: Mon, 13 Apr 2026 18:00:37 +0200 Message-ID: <20260413155729.750232273@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260413155728.181580293@linuxfoundation.org> References: <20260413155728.181580293@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ruide Cao commit 3a359bf5c61d52e7f09754108309d637532164a6 upstream. batadv_tt_prepare_tvlv_global_data() builds the allocation length for a global TT response in 16-bit temporaries. When a remote originator advertises a large enough global TT, the TT payload length plus the VLAN header offset can exceed 65535 and wrap before kmalloc(). The full-table response path still uses the original TT payload length when it fills tt_change, so the wrapped allocation is too small and batadv_tt_prepare_tvlv_global_data() writes past the end of the heap object before the later packet-size check runs. Fix this by rejecting TT responses whose TVLV value length cannot fit in the 16-bit TVLV payload length field. Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific") Cc: stable@vger.kernel.org Reported-by: Yifan Wu Reported-by: Juefei Pu Co-developed-by: Yuan Tan Signed-off-by: Yuan Tan Suggested-by: Xin Liu Tested-by: Ren Wei Signed-off-by: Ruide Cao Signed-off-by: Ren Wei Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich Signed-off-by: Greg Kroah-Hartman --- net/batman-adv/translation-table.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -844,8 +844,8 @@ batadv_tt_prepare_tvlv_global_data(struc { u16 num_vlan = 0; u16 num_entries = 0; - u16 change_offset; - u16 tvlv_len; + u16 tvlv_len = 0; + unsigned int change_offset; struct batadv_tvlv_tt_vlan_data *tt_vlan; struct batadv_orig_node_vlan *vlan; u8 *tt_change_ptr; @@ -863,6 +863,11 @@ batadv_tt_prepare_tvlv_global_data(struc if (*tt_len < 0) *tt_len = batadv_tt_len(num_entries); + if (change_offset > U16_MAX || *tt_len > U16_MAX - change_offset) { + *tt_len = 0; + goto out; + } + tvlv_len = *tt_len; tvlv_len += change_offset;