Re: [PATCH net 10/10] batman-adv: tt: limit local table to single TVLV response size

[netdev-bot+sashiko@kernel.org]

Thank you for your contribution! Sashiko AI review found more severe
issue(s) in other patches of this series. This mail is only an FYI, in case
you want to address the nit picks below when you respin.

Low priority / nit picks for your consideration:

- [Low] The Fixes: tag points at 85fb027f611b ("batman-adv: tt: reject
  VLAN/TT entries before reaching size limit"), but that commit did not…

--

batman-adv: tt: limit local table to single TVLV response size

This patch caps the reservation of local TT entries and VLANs at the
smaller of packet_size_max and the largest full table response that fits
in one unicast TVLV packet, since tvlv_len is only 16 bits wide. A new
helper, batadv_tt_local_transmit_size_max(), computes that limit. The
helper is used in batadv_tt_local_reserve(), in the related log messages
and in batadv_tt_local_resize_to_mtu().

Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260930094558.3723766-2-sw%40simonwunderlich.de?part=8

> Fixes: 85fb027f611b ("batman-adv: tt: reject VLAN/TT entries before reaching size limit")

[Severity: Low]

Does this Fixes: tag point at the commit that introduced the problem?

85fb027f611b removed a check from batadv_tt_local_create() that already
limited the table by packet_size_max only:

-	/* Ignore the client if we cannot send it in a full table response. */
-	table_size = batadv_tt_local_table_transmit_size(bat_priv);
-	table_size += batadv_tt_len(1);
-	packet_size_max = READ_ONCE(bat_priv->packet_size_max);
-	if (table_size > packet_size_max) {

That older check had no cap at the 16-bit tvlv_len either. So the missing
limit seems to predate 85fb027f611b.

Blame on the parent of 85fb027f611b points at defa87f5ce75fe
("batman-adv: tt: extract allocation of new local entries"). That commit
only moved this code, so the check is older still. The original commit
was not identified.

Kernels without 85fb027f611b can still let the local table grow past what
one unicast TVLV full table response can carry. This happens with
fragmentation disabled and a hard interface MTU above
sizeof(struct batadv_unicast_tvlv_packet) + U16_MAX. In that case,
batadv_tt_prepare_tvlv_local_data() hits its check_add_overflow() path and
returns 0, so no response is sent.

With the current tag, stable tooling would only pick this fix for trees
that contain 85fb027f611b. Could the tag name the commit that first added
the packet_size_max-only check? Or could the commit message say that
older trees are affected too?

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261026085309.1074911-2-sw%40simonwunderlich.de