* [PATCH net 1/8] batman-adv: fix integer overflow on buff_pos [not found] <20260508154314.12817-1-sw@simonwunderlich.de> @ 2026-05-08 15:43 ` Simon Wunderlich 2026-05-10 17:10 ` patchwork-bot+netdevbpf 0 siblings, 1 reply; 2+ messages in thread From: Simon Wunderlich @ 2026-05-08 15:43 UTC (permalink / raw) To: netdev Cc: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman, b.a.t.m.a.n, Lyes Bourennani, stable, Alexis Pinson, Sven Eckelmann, Simon Wunderlich From: Lyes Bourennani <lbourennani@fuzzinglabs.com> Fixing an integer overflow present in batadv_iv_ogm_send_to_if. The size check is done using the int type in batadv_iv_ogm_aggr_packet whereas the buff_pos variable uses the s16 type. This could lead to an out-of-bound read. Cc: stable@vger.kernel.org Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Signed-off-by: Lyes Bourennani <lbourennani@fuzzinglabs.com> Signed-off-by: Alexis Pinson <apinson@fuzzinglabs.com> Signed-off-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de> --- net/batman-adv/bat_iv_ogm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c index f28e9cbf8ad5f..618d1889c04e7 100644 --- a/net/batman-adv/bat_iv_ogm.c +++ b/net/batman-adv/bat_iv_ogm.c @@ -335,7 +335,7 @@ static void batadv_iv_ogm_send_to_if(struct batadv_forw_packet *forw_packet, struct batadv_priv *bat_priv = netdev_priv(hard_iface->mesh_iface); const char *fwd_str; u8 packet_num; - s16 buff_pos; + int buff_pos; struct batadv_ogm_packet *batadv_ogm_packet; struct sk_buff *skb; u8 *packet_pos; -- 2.47.3 ^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net 1/8] batman-adv: fix integer overflow on buff_pos 2026-05-08 15:43 ` [PATCH net 1/8] batman-adv: fix integer overflow on buff_pos Simon Wunderlich @ 2026-05-10 17:10 ` patchwork-bot+netdevbpf 0 siblings, 0 replies; 2+ messages in thread From: patchwork-bot+netdevbpf @ 2026-05-10 17:10 UTC (permalink / raw) To: Simon Wunderlich Cc: netdev, davem, edumazet, kuba, pabeni, horms, b.a.t.m.a.n, lbourennani, stable, apinson, sven Hello: This series was applied to netdev/net.git (main) by Sven Eckelmann <sven@narfation.org>: On Fri, 8 May 2026 17:43:07 +0200 you wrote: > From: Lyes Bourennani <lbourennani@fuzzinglabs.com> > > Fixing an integer overflow present in batadv_iv_ogm_send_to_if. The size > check is done using the int type in batadv_iv_ogm_aggr_packet whereas the > buff_pos variable uses the s16 type. This could lead to an out-of-bound > read. > > [...] Here is the summary with links: - [net,1/8] batman-adv: fix integer overflow on buff_pos https://git.kernel.org/netdev/net/c/0799e5943611 - [net,2/8] batman-adv: reject new tp_meter sessions during teardown https://git.kernel.org/netdev/net/c/324354359242 - [net,3/8] batman-adv: stop tp_meter sessions during mesh teardown https://git.kernel.org/netdev/net/c/3d3cf6a7314a - [net,4/8] batman-adv: stop caching unowned originator pointers in BAT IV https://git.kernel.org/netdev/net/c/f03e85835329 - [net,5/8] batman-adv: tp_meter: fix tp_num leak on kmalloc failure https://git.kernel.org/netdev/net/c/ce425dd05d0f - [net,6/8] batman-adv: bla: prevent use-after-free when deleting claims https://git.kernel.org/netdev/net/c/4ae1709a3140 - [net,7/8] batman-adv: bla: only purge non-released claims https://git.kernel.org/netdev/net/c/cf6b60401159 - [net,8/8] batman-adv: bla: put backbone reference on failed claim hash insert https://git.kernel.org/netdev/net/c/ba9d20ee9076 You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-05-10 17:11 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20260508154314.12817-1-sw@simonwunderlich.de>
2026-05-08 15:43 ` [PATCH net 1/8] batman-adv: fix integer overflow on buff_pos Simon Wunderlich
2026-05-10 17:10 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox