From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from dvalin.narfation.org (dvalin.narfation.org [213.160.73.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 95FDC3FA5E7 for ; Fri, 26 Jun 2026 16:10:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=213.160.73.56 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782490214; cv=none; b=oDQTMCM9ztHuyv3bm6jEVT9aWih9IVet2hto6jGgM0/PGizshk3kLaONqGVFgJqurxSC5EiwKGxhR7/xG3gGpdg6/fh2/IriMT4QbVMUmQ08wanLMVeslMQYxjIEkmdLdtiig+RJVB15oNlF64fGrGSFDarRsTZT7xwbBaPkDDQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782490214; c=relaxed/simple; bh=EGMG3HPQXOErUNDchFzoyQugpIgdY8bam8zHrtbj85k=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GHK0P71cAOlohH5Lb2zROQ0l/cqBiqedanzY80x32+WJxD6oaXQ3O7i34pD1mRvDaYexGztvyy5e9Zoogsxr+In0c/db1KfjUZF0FcDgON4HLoKX5wHejLIp+uFvltLG7cix1E8JcivKKa51MS3azAe9yJ+5zK8+9ETb2GYvAXU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=narfation.org; spf=pass smtp.mailfrom=narfation.org; dkim=pass (1024-bit key) header.d=narfation.org header.i=@narfation.org header.b=1kSRIVPX; arc=none smtp.client-ip=213.160.73.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=narfation.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=narfation.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=narfation.org header.i=@narfation.org header.b="1kSRIVPX" Received: by dvalin.narfation.org (Postfix) id 9D5F920541; Fri, 26 Jun 2026 16:09:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=narfation.org; s=20121; t=1782490198; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=sv/Ssn22gr6wS8c42Pdc+1oQfH7EZQNLKcEmqiSMLt8=; b=1kSRIVPX1WVYBjQiXS7Y71g6O1qJDlHxrOYDPlgFeFC9ONylTp5ujNNpXB2QfiS1f+/TW+ xf+7A6UlUfxbli95Fv4PQ/fZ6Y2IsZnOAJbcXgAn4xJfYxfvn9fFZ+TeHOD4hqhX5VW5Tc 7W5VBNAVTN1YM53RkUYmfIDLLFf2KV4= From: Sven Eckelmann To: stable@vger.kernel.org Cc: Sven Eckelmann Subject: [PATCH 5.10 10/23] batman-adv: prevent ELP transmission interval underflow Date: Fri, 26 Jun 2026 18:09:39 +0200 Message-ID: <20260626160952.123713-11-sven@narfation.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260626160952.123713-1-sven@narfation.org> References: <20260626160952.123713-1-sven@narfation.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit commit 5e50d4b8ae3ea622122d3c6a38d7f6fe68dfddca upstream. batadv_v_elp_start_timer() enqeues a delayed work. The time when it starts is randomly chosen between (elp_interval - BATADV_JITTER) and (elp_interval + BATADV_JITTER). The configured elp_interval must therefore be larger or equal to BATADV_JITTER to avoid that it causes an underflow of the unsigned integer. If this would happen, then a "fast" ELP interval would turn into a "day long" delay. At the same time, it must not be larger than the maximum value the variable can store. Cc: stable@kernel.org Fixes: a10800829040 ("batman-adv: Add elp_interval hardif genl configuration") [ Context ] Signed-off-by: Sven Eckelmann --- net/batman-adv/netlink.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/batman-adv/netlink.c b/net/batman-adv/netlink.c index 0b5cb03859b25..0b10836d85c60 100644 --- a/net/batman-adv/netlink.c +++ b/net/batman-adv/netlink.c @@ -939,7 +939,13 @@ static int batadv_netlink_set_hardif(struct sk_buff *skb, #ifdef CONFIG_BATMAN_ADV_BATMAN_V if (info->attrs[BATADV_ATTR_ELP_INTERVAL]) { + u32 elp_interval; + attr = info->attrs[BATADV_ATTR_ELP_INTERVAL]; + elp_interval = nla_get_u32(attr); + + elp_interval = min_t(u32, elp_interval, INT_MAX); + elp_interval = max_t(u32, elp_interval, BATADV_JITTER); atomic_set(&hard_iface->bat_v.elp_interval, nla_get_u32(attr)); } -- 2.47.3