From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from dvalin.narfation.org (dvalin.narfation.org [213.160.73.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C0418326D65 for ; Fri, 29 May 2026 20:12:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=213.160.73.56 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780085560; cv=none; b=lhsRx9RNIcYzSy7q3Zo+XRqnsZ+Ed2IMdEIy6jyAXxnkTdfCojrJiMDvYIiI9RoGDFHw1MK6EUnXC/e/+nzHGbX8fRDOGVsMzdhD4wMK/QwFQC4V1AdmPf02x2MWoXds8LJj9VgcAmtmRexkNnymzt7BPxaVgqYQqdoKhPxAsuM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780085560; c=relaxed/simple; bh=vKJucSH8FMV/7WFJpAYVZcQUaAoCYJUpTstVRQl2H1g=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DSeUUcTYM5TPiMgAfmxV61iS89Kut7VQZQY+F6uzXa7f7tD7Dm8oh5eWpAmhixiU2jxpC18iA7GLUDUiHXNJxa2oV2YWZkKiHnyB8no0TfROq0WlbQ06WGtlzAFtEszWo1k9LW9l/63FQ6D9bmiWOniu7jXSAgGaE/iPYmdcuns= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=narfation.org; spf=pass smtp.mailfrom=narfation.org; dkim=pass (1024-bit key) header.d=narfation.org header.i=@narfation.org header.b=cWbDA6wg; arc=none smtp.client-ip=213.160.73.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=narfation.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=narfation.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=narfation.org header.i=@narfation.org header.b="cWbDA6wg" Received: by dvalin.narfation.org (Postfix) id 60E061FE5D; Fri, 29 May 2026 20:12:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=narfation.org; s=20121; t=1780085558; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=lAsmM+QZCbtVr9J6vD/MMABNDVB3wrUYOvxzZv7OxZ0=; b=cWbDA6wgLPeK0WdrlRLO+dtinsCz2XOjJHAtS3yxiqPkRP+M6tN0rDwNY7sfS32lH1D7LF Fd67KAaJqTjv2Ab7Jg0VFXsFv9Qz7qdjVPHN+smOaplXfUqwXI9RqVgU9kMKy1uOycLyN9 wpSYl8EimOpfval98mcTpR7R2ftdBoA= From: Sven Eckelmann To: stable@vger.kernel.org Cc: Sven Eckelmann , stable@kernel.org Subject: [PATCH 5.10.y] batman-adv: tt: prevent TVLV entry number overflow Date: Fri, 29 May 2026 22:12:35 +0200 Message-ID: <20260529201235.479508-1-sven@narfation.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <2026052820-resurrect-heftiness-1b1c@gregkh> References: <2026052820-resurrect-heftiness-1b1c@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit commit 99d9958fa10fb684b2a8e2c48a8d704122721420 upstream. The helpers to prepare the buffers for the local and global TT based replies are trying to sum up all TT entries which can be found for each VLAN. In theory, this sum can be too big for an u16 and therefore overflow. A too small buffer would then be allocated for the TVLV. The too small buffer will be handled gracefully by batadv_tt_tvlv_generate() and is not causing a buffer overflow - just a truncated reply. But this overflow shouldn't have happened in the first and the too small buffer should never have been allocated when an overflow was detected. Cc: stable@kernel.org Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific") Signed-off-by: Sven Eckelmann --- net/batman-adv/translation-table.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index 7310392accb94..cbf9dc7fa47de 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -855,11 +855,18 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node, u16 total_entries = 0; u8 *tt_change_ptr; int vlan_entries; + u16 sum_entries; spin_lock_bh(&orig_node->vlan_list_lock); hlist_for_each_entry(vlan, &orig_node->vlan_list, list) { vlan_entries = atomic_read(&vlan->tt.num_entries); - total_entries += vlan_entries; + + if (check_add_overflow(vlan_entries, total_entries, &sum_entries)) { + *tt_len = 0; + goto out; + } + + total_entries = sum_entries; num_vlan++; } @@ -946,15 +953,22 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv, struct batadv_softif_vlan *vlan; size_t change_offset; u16 num_vlan = 0; - u16 vlan_entries = 0; u16 total_entries = 0; u16 tvlv_len; u8 *tt_change_ptr; + int vlan_entries; + u16 sum_entries; spin_lock_bh(&bat_priv->softif_vlan_list_lock); hlist_for_each_entry(vlan, &bat_priv->softif_vlan_list, list) { vlan_entries = atomic_read(&vlan->tt.num_entries); - total_entries += vlan_entries; + + if (check_add_overflow(vlan_entries, total_entries, &sum_entries)) { + tvlv_len = 0; + goto out; + } + + total_entries = sum_entries; num_vlan++; } -- 2.47.3