[PATCH net 1/8] batman-adv: fix integer overflow on buff_pos

[PATCH net 1/8] batman-adv: fix integer overflow on buff_pos

[Simon Wunderlich]

From: Lyes Bourennani <lbourennani@fuzzinglabs.com>

Fixing an integer overflow present in batadv_iv_ogm_send_to_if. The size
check is done using the int type in batadv_iv_ogm_aggr_packet whereas the
buff_pos variable uses the s16 type. This could lead to an out-of-bound
read.

Cc: stable@vger.kernel.org
Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Signed-off-by: Lyes Bourennani <lbourennani@fuzzinglabs.com>
Signed-off-by: Alexis Pinson <apinson@fuzzinglabs.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
 net/batman-adv/bat_iv_ogm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index f28e9cbf8ad5f..618d1889c04e7 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -335,7 +335,7 @@ static void batadv_iv_ogm_send_to_if(struct batadv_forw_packet *forw_packet,
 	struct batadv_priv *bat_priv = netdev_priv(hard_iface->mesh_iface);
 	const char *fwd_str;
 	u8 packet_num;
-	s16 buff_pos;
+	int buff_pos;
 	struct batadv_ogm_packet *batadv_ogm_packet;
 	struct sk_buff *skb;
 	u8 *packet_pos;
-- 
2.47.3

Re: [PATCH net 1/8] batman-adv: fix integer overflow on buff_pos

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by Sven Eckelmann <sven@narfation.org>:

On Fri,  8 May 2026 17:43:07 +0200 you wrote:
> From: Lyes Bourennani <lbourennani@fuzzinglabs.com>
> 
> Fixing an integer overflow present in batadv_iv_ogm_send_to_if. The size
> check is done using the int type in batadv_iv_ogm_aggr_packet whereas the
> buff_pos variable uses the s16 type. This could lead to an out-of-bound
> read.
> 
> [...]

Here is the summary with links:
  - [net,1/8] batman-adv: fix integer overflow on buff_pos
    https://git.kernel.org/netdev/net/c/0799e5943611
  - [net,2/8] batman-adv: reject new tp_meter sessions during teardown
    https://git.kernel.org/netdev/net/c/324354359242
  - [net,3/8] batman-adv: stop tp_meter sessions during mesh teardown
    https://git.kernel.org/netdev/net/c/3d3cf6a7314a
  - [net,4/8] batman-adv: stop caching unowned originator pointers in BAT IV
    https://git.kernel.org/netdev/net/c/f03e85835329
  - [net,5/8] batman-adv: tp_meter: fix tp_num leak on kmalloc failure
    https://git.kernel.org/netdev/net/c/ce425dd05d0f
  - [net,6/8] batman-adv: bla: prevent use-after-free when deleting claims
    https://git.kernel.org/netdev/net/c/4ae1709a3140
  - [net,7/8] batman-adv: bla: only purge non-released claims
    https://git.kernel.org/netdev/net/c/cf6b60401159
  - [net,8/8] batman-adv: bla: put backbone reference on failed claim hash insert
    https://git.kernel.org/netdev/net/c/ba9d20ee9076

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html