Re: [PATCH 5.10 10/23] batman-adv: prevent ELP transmission interval underflow

[Sven Eckelmann <sven@narfation.org>]

[-- Attachment #1: Type: text/plain, Size: 2482 bytes --]

Hi Sasha,

On Saturday, 27 June 2026 13:26:17 CEST Sasha Levin wrote:
> > @@ -939,7 +939,13 @@ static int batadv_netlink_set_hardif(struct sk_buff *skb,
> >  #ifdef CONFIG_BATMAN_ADV_BATMAN_V
> >  
> >  	if (info->attrs[BATADV_ATTR_ELP_INTERVAL]) {
> > +		u32 elp_interval;
> > +
> >  		attr = info->attrs[BATADV_ATTR_ELP_INTERVAL];
> > +		elp_interval = nla_get_u32(attr);
> > +
> > +		elp_interval = min_t(u32, elp_interval, INT_MAX);
> > +		elp_interval = max_t(u32, elp_interval, BATADV_JITTER);
> >  
> >  		atomic_set(&hard_iface->bat_v.elp_interval, nla_get_u32(attr));
> >  	}
> 
> The backport computes the clamped elp_interval but then stores the raw
> nla_get_u32(attr) again, so the min_t()/max_t() clamping is dead code and
> the underflow this patch is meant to prevent is still reachable. The store
> should use the clamped local, matching the sibling orig_interval block just
> above it in the same function:
> 
> 		atomic_set(&hard_iface->bat_v.elp_interval, elp_interval);

You are correct. I copied basically this backporting error from 7.1 up until 
5.10. This makes this specific patch invalid in each patch series from yesterday.

Correct one (as you already wrote) should have looked like this in each stable 
kernel version:

--- a/net/batman-adv/netlink.c
+++ b/net/batman-adv/netlink.c
@@ -939,9 +939,15 @@ static int batadv_netlink_set_hardif(struct sk_buff *skb,
 #ifdef CONFIG_BATMAN_ADV_BATMAN_V
 
 	if (info->attrs[BATADV_ATTR_ELP_INTERVAL]) {
-		attr = info->attrs[BATADV_ATTR_ELP_INTERVAL];
+		u32 elp_interval;
 
-		atomic_set(&hard_iface->bat_v.elp_interval, nla_get_u32(attr));
+		attr = info->attrs[BATADV_ATTR_ELP_INTERVAL];
+		elp_interval = nla_get_u32(attr);
+
+		elp_interval = min_t(u32, elp_interval, INT_MAX);
+		elp_interval = max_t(u32, elp_interval, BATADV_JITTER);
+
+		atomic_set(&hard_iface->bat_v.elp_interval, elp_interval);
 	}
 
 	if (info->attrs[BATADV_ATTR_THROUGHPUT_OVERRIDE]) {

Do you just want to drop this from each patchset and we deal separately with 
it? Or do you propose a different approach?


Btw. If anyone wants to do range-diffs of these patchsets against the upstream 
patches:

git checkout -B reference 1e2fa2b10c234578d3c98c70f89c04a7aba4db92
git cherry-pick df97a7107b16375a10a36d7a63e9b4291a8ac680~1..edb557b2ba38fea2c5eb710cf366c797e187218c

# here just my own batadv/lts/7.1 branch:
git range-diff stable/linux-7.1.y..batadv/lts/7.1 3bd64ca11d9a1672d67d3130a7264c2cf7f93cdf..reference

Regards,
	Sven

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 228 bytes --]