public inbox for netdev@vger.kernel.org
 help / color / mirror / Atom feed
From: Sven Eckelmann <sven@narfation.org>
To: Marek Lindner <marek.lindner@mailbox.org>,
	 Simon Wunderlich <sw@simonwunderlich.de>,
	 Antonio Quartulli <antonio@mandelbit.com>,
	 "David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	 Jakub Kicinski <kuba@kernel.org>,
	Paolo Abeni <pabeni@redhat.com>,  Simon Horman <horms@kernel.org>
Cc: b.a.t.m.a.n@lists.open-mesh.org, netdev@vger.kernel.org,
	 linux-kernel@vger.kernel.org, Ao Zhou <n05ec@lzu.edu.cn>,
	 Haoze Xie <royenheart@gmail.com>,
	Jiexun Wang <wangjiexun2025@gmail.com>,
	 Juefei Pu <tomapufckgml@gmail.com>,
	Luxing Yin <tr0jan@lzu.edu.cn>,  Ren Wei <n05ec@lzu.edu.cn>,
	Ruide Cao <caoruide123@gmail.com>,  Xin Liu <bird@lzu.edu.cn>,
	Yifan Wu <yifanwucs@gmail.com>,  Yuan Tan <yuantan098@gmail.com>,
	Sven Eckelmann <sven@narfation.org>,
	 stable@kernel.org
Subject: [PATCH batadv 7/8] batman-adv: tt: avoid empty VLAN responses
Date: Sun, 03 May 2026 14:22:40 +0200	[thread overview]
Message-ID: <20260503-fixes-followup-v1-7-4313278918d3@narfation.org> (raw)
In-Reply-To: <20260503-fixes-followup-v1-0-4313278918d3@narfation.org>

The commit 16116dac2339 ("batman-adv: prevent TT request storms by not
sending inconsistent TT TLVLs") added checks to the local (direct) TT
response code. But the response can also be done indirectly by another node
using the global TT state. To avoid such inconsistency states reported in
the original fix, also avoid sending empty VLANs for replies from the
global TT state.

Cc: stable@kernel.org
Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
 net/batman-adv/translation-table.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index f5b9143c803a..5a005d4e6cc6 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -797,24 +797,26 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node,
 				   s32 *tt_len)
 {
 	u16 num_vlan = 0;
-	u16 num_entries = 0;
 	u16 tvlv_len = 0;
 	unsigned int change_offset;
 	struct batadv_tvlv_tt_vlan_data *tt_vlan;
 	struct batadv_orig_node_vlan *vlan;
+	u16 total_entries = 0;
 	u8 *tt_change_ptr;
+	int vlan_entries;
 
 	spin_lock_bh(&orig_node->vlan_list_lock);
 	hlist_for_each_entry(vlan, &orig_node->vlan_list, list) {
+		vlan_entries = atomic_read(&vlan->tt.num_entries);
+		total_entries += vlan_entries;
 		num_vlan++;
-		num_entries += atomic_read(&vlan->tt.num_entries);
 	}
 
 	change_offset = struct_size(*tt_data, vlan_data, num_vlan);
 
 	/* if tt_len is negative, allocate the space needed by the full table */
 	if (*tt_len < 0)
-		*tt_len = batadv_tt_len(num_entries);
+		*tt_len = batadv_tt_len(total_entries);
 
 	if (change_offset > U16_MAX || *tt_len > U16_MAX - change_offset) {
 		*tt_len = 0;
@@ -832,17 +834,28 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node,
 
 	(*tt_data)->flags = BATADV_NO_FLAGS;
 	(*tt_data)->ttvn = atomic_read(&orig_node->last_ttvn);
-	(*tt_data)->num_vlan = htons(num_vlan);
 
 	tt_vlan = (*tt_data)->vlan_data;
+	num_vlan = 0;
 	hlist_for_each_entry(vlan, &orig_node->vlan_list, list) {
+		vlan_entries = atomic_read(&vlan->tt.num_entries);
+		if (vlan_entries < 1)
+			continue;
+
 		tt_vlan->vid = htons(vlan->vid);
 		tt_vlan->crc = htonl(vlan->tt.crc);
 		tt_vlan->reserved = 0;
 
 		tt_vlan++;
+		num_vlan++;
 	}
 
+	/* recalculate in case number of VLANs reduced */
+	change_offset = struct_size(*tt_data, vlan_data, num_vlan);
+	tvlv_len = *tt_len + change_offset;
+
+	(*tt_data)->num_vlan = htons(num_vlan);
+
 	tt_change_ptr = (u8 *)*tt_data + change_offset;
 	*tt_change = (struct batadv_tvlv_tt_change *)tt_change_ptr;
 

-- 
2.47.3


  parent reply	other threads:[~2026-05-03 12:23 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-05-03 12:22 [PATCH batadv 0/8] batman-adv: follow up fixes Sven Eckelmann
2026-05-03 12:22 ` [PATCH batadv 1/8] batman-adv: tp_meter: fix tp_num leak on kmalloc failure Sven Eckelmann
2026-05-03 12:22 ` [PATCH batadv 2/8] batman-adv: bla: prevent use-after-free when deleting claims Sven Eckelmann
2026-05-03 12:22 ` [PATCH batadv 3/8] batman-adv: bla: only purge non-released claims Sven Eckelmann
2026-05-03 12:22 ` [PATCH batadv 4/8] batman-adv: tt: fix negative tt_buff_len Sven Eckelmann
2026-05-03 12:22 ` [PATCH batadv 5/8] batman-adv: tt: reject oversized local TVLV buffers Sven Eckelmann
2026-05-03 12:22 ` [PATCH batadv 6/8] batman-adv: tt: fix TOCTOU race for reported vlans Sven Eckelmann
2026-05-03 12:22 ` Sven Eckelmann [this message]
2026-05-03 12:22 ` [PATCH batadv 8/8] batman-adv: tt: prevent TVLV entry number overflow Sven Eckelmann
2026-05-05  0:10 ` [PATCH batadv 0/8] batman-adv: follow up fixes Jakub Kicinski
2026-05-05  4:46   ` Sven Eckelmann
2026-05-05  5:00     ` Sven Eckelmann
2026-05-05  5:21       ` Matthieu Baerts
2026-05-05  7:20         ` Sven Eckelmann
2026-05-05 23:02           ` Yuan Tan
2026-05-06  0:20     ` Jakub Kicinski

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260503-fixes-followup-v1-7-4313278918d3@narfation.org \
    --to=sven@narfation.org \
    --cc=antonio@mandelbit.com \
    --cc=b.a.t.m.a.n@lists.open-mesh.org \
    --cc=bird@lzu.edu.cn \
    --cc=caoruide123@gmail.com \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=horms@kernel.org \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=marek.lindner@mailbox.org \
    --cc=n05ec@lzu.edu.cn \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=royenheart@gmail.com \
    --cc=stable@kernel.org \
    --cc=sw@simonwunderlich.de \
    --cc=tomapufckgml@gmail.com \
    --cc=tr0jan@lzu.edu.cn \
    --cc=wangjiexun2025@gmail.com \
    --cc=yifanwucs@gmail.com \
    --cc=yuantan098@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox