FAILED: patch "[PATCH] batman-adv: tt: prevent TVLV entry number overflow" failed to apply to 6.12-stable tree

FAILED: patch "[PATCH] batman-adv: tt: prevent TVLV entry number overflow" failed to apply to 6.12-stable tree

[gregkh]

The patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
git checkout FETCH_HEAD
git cherry-pick -x 99d9958fa10fb684b2a8e2c48a8d704122721420
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026052818-robust-suffrage-fac4@gregkh' --subject-prefix 'PATCH 6.12.y' HEAD^..

Possible dependencies:



thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 99d9958fa10fb684b2a8e2c48a8d704122721420 Mon Sep 17 00:00:00 2001
From: Sven Eckelmann <sven@narfation.org>
Date: Sat, 2 May 2026 21:25:19 +0200
Subject: [PATCH] batman-adv: tt: prevent TVLV entry number overflow

The helpers to prepare the buffers for the local and global TT based
replies are trying to sum up all TT entries which can be found for each
VLAN. In theory, this sum can be too big for an u16 and therefore overflow.
A too small buffer would then be allocated for the TVLV.

The too small buffer will be handled gracefully by
batadv_tt_tvlv_generate() and is not causing a buffer overflow - just a
truncated reply. But this overflow shouldn't have happened in the first and
the too small buffer should never have been allocated when an overflow was
detected.

Cc: stable@kernel.org
Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific")
Signed-off-by: Sven Eckelmann <sven@narfation.org>

diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 2259b241e0b5..9f6e67771ffa 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -804,11 +804,18 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node,
 	u16 total_entries = 0;
 	u8 *tt_change_ptr;
 	int vlan_entries;
+	u16 sum_entries;
 
 	spin_lock_bh(&orig_node->vlan_list_lock);
 	hlist_for_each_entry(vlan, &orig_node->vlan_list, list) {
 		vlan_entries = atomic_read(&vlan->tt.num_entries);
-		total_entries += vlan_entries;
+
+		if (check_add_overflow(vlan_entries, total_entries, &sum_entries)) {
+			*tt_len = 0;
+			goto out;
+		}
+
+		total_entries = sum_entries;
 		num_vlan++;
 	}
 
@@ -893,15 +900,22 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv,
 	struct batadv_meshif_vlan *vlan;
 	size_t change_offset;
 	u16 num_vlan = 0;
-	u16 vlan_entries = 0;
 	u16 total_entries = 0;
 	u16 tvlv_len;
 	u8 *tt_change_ptr;
+	int vlan_entries;
+	u16 sum_entries;
 
 	spin_lock_bh(&bat_priv->meshif_vlan_list_lock);
 	hlist_for_each_entry(vlan, &bat_priv->meshif_vlan_list, list) {
 		vlan_entries = atomic_read(&vlan->tt.num_entries);
-		total_entries += vlan_entries;
+
+		if (check_add_overflow(vlan_entries, total_entries, &sum_entries)) {
+			tvlv_len = 0;
+			goto out;
+		}
+
+		total_entries = sum_entries;
 		num_vlan++;
 	}
 

[PATCH 6.12.y] batman-adv: tt: prevent TVLV entry number overflow

[Sven Eckelmann]

commit 99d9958fa10fb684b2a8e2c48a8d704122721420 upstream.

The helpers to prepare the buffers for the local and global TT based
replies are trying to sum up all TT entries which can be found for each
VLAN. In theory, this sum can be too big for an u16 and therefore overflow.
A too small buffer would then be allocated for the TVLV.

The too small buffer will be handled gracefully by
batadv_tt_tvlv_generate() and is not causing a buffer overflow - just a
truncated reply. But this overflow shouldn't have happened in the first and
the too small buffer should never have been allocated when an overflow was
detected.

Cc: stable@kernel.org
Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
 net/batman-adv/translation-table.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 4045ddefc29b4..7041cd69e2007 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -850,11 +850,18 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node,
 	u16 total_entries = 0;
 	u8 *tt_change_ptr;
 	int vlan_entries;
+	u16 sum_entries;
 
 	spin_lock_bh(&orig_node->vlan_list_lock);
 	hlist_for_each_entry(vlan, &orig_node->vlan_list, list) {
 		vlan_entries = atomic_read(&vlan->tt.num_entries);
-		total_entries += vlan_entries;
+
+		if (check_add_overflow(vlan_entries, total_entries, &sum_entries)) {
+			*tt_len = 0;
+			goto out;
+		}
+
+		total_entries = sum_entries;
 		num_vlan++;
 	}
 
@@ -941,15 +948,22 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv,
 	struct batadv_softif_vlan *vlan;
 	size_t change_offset;
 	u16 num_vlan = 0;
-	u16 vlan_entries = 0;
 	u16 total_entries = 0;
 	u16 tvlv_len;
 	u8 *tt_change_ptr;
+	int vlan_entries;
+	u16 sum_entries;
 
 	spin_lock_bh(&bat_priv->softif_vlan_list_lock);
 	hlist_for_each_entry(vlan, &bat_priv->softif_vlan_list, list) {
 		vlan_entries = atomic_read(&vlan->tt.num_entries);
-		total_entries += vlan_entries;
+
+		if (check_add_overflow(vlan_entries, total_entries, &sum_entries)) {
+			tvlv_len = 0;
+			goto out;
+		}
+
+		total_entries = sum_entries;
 		num_vlan++;
 	}
 
-- 
2.47.3

Re: [PATCH 6.12.y] batman-adv: tt: prevent TVLV entry number overflow

[Sasha Levin]

> [PATCH 6.12.y] batman-adv: tt: prevent TVLV entry number overflow
> commit 99d9958fa10fb684b2a8e2c48a8d704122721420 upstream.

Thanks Sven. This one doesn't apply to the stable trees as submitted.

-- 
Thanks,
Sasha

Re: [PATCH 6.12.y] batman-adv: tt: prevent TVLV entry number overflow

[Sven Eckelmann]

[-- Attachment #1: Type: text/plain, Size: 2965 bytes --]

On Wednesday, 3 June 2026 17:13:57 CEST Sasha Levin wrote:
> > [PATCH 6.12.y] batman-adv: tt: prevent TVLV entry number overflow
> > commit 99d9958fa10fb684b2a8e2c48a8d704122721420 upstream.
> 
> Thanks Sven. This one doesn't apply to the stable trees as submitted.

This is odd. It was from here (were it applies): 
https://git.open-mesh.org/batadv.git/log/?h=batadv/lts/6.12

Also tested it now on 
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/ 
branch queue/6.12:

b4 shazam 20260529180300.412724-1-sven@narfation.org
b4 shazam 20260528205744.636746-1-sven@narfation.org
b4 shazam 20260529180450.413317-1-sven@narfation.org
b4 shazam 20260529180618.413634-1-sven@narfation.org # this is the relevant one
b4 shazam 20260528202135.443823-1-sven@narfation.org
b4 shazam 20260528192733.76065-1-sven@narfation.org
b4 shazam 20260528194602.258724-1-sven@narfation.org
b4 shazam 20260529180804.414401-1-sven@narfation.org
b4 shazam 20260529180905.414737-1-sven@narfation.org
b4 shazam 20260529181000.415087-1-sven@narfation.org
b4 shazam 20260529181042.415322-1-sven@narfation.org
b4 shazam 20260529181125.415543-1-sven@narfation.org


This applied fine for me. Or here the patches I've just applied on queue/6.12 
(in my local branch) with the "b4 shazam" commands:

$ git log --pretty=oneline stable-rc/queue/6.12..queue/6.12
4569694c4f2a053cd2964cad24af604ae4ec2047 (HEAD -> queue/6.12) batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
d32927f478de78eb5224ed73432aa4a41d3bdbfb batman-adv: bla: avoid double decrement of bla.num_requests
ceab9caf4a4da8ee47e4e238b5f416d49cf170a9 batman-adv: iv: recover OGM scheduling after forward packet error
8b27c099491f34e3e2050e298852295eff0a4a91 batman-adv: tp_meter: avoid role confusion in tp_list
46f3587c0deaa3fee91d38ffb517a3b597758cb2 batman-adv: tvlv: reject oversized TVLV packets
8cb77976278ae5aa212908a7392188f7ff042ba0 batman-adv: tvlv: abort OGM send on tvlv append failure
ecd5b0eaf6fbcdeec2ad328aeeabd39e9c7b8f24 batman-adv: v: stop OGMv2 on disabled interface
b2fe2f8b69154de1fb8aff110743966f5ebf2293 batman-adv: tp_meter: directly shut down timer on cleanup
4420ab1d1ee86b11393a3f561a78edbc220395fa batman-adv: tt: prevent TVLV entry number overflow
09964daa253a0b7427f01ff3b67f396d24caf928 batman-adv: tt: avoid empty VLAN responses
7829b033f053aafe66080f20b68b4a60c4f58db7 batman-adv: tt: fix TOCTOU race for reported vlans
f547e2d9c2a51405f256238558699d40449483bc batman-adv: tt: reject oversized local TVLV buffers

I am guessing that some different ordering was used while trying to apply the 
patches. Just ping me in case I should rebase the patches from my lts branches
on queue/6.12 (or another stable queue) and submit the missing ones in a 
single patchset. But I should most likely only do this after you published the 
stable-rc for these stable versions - otherwise i would also post patches 
which you already have in your queue.

Regards,
	Sven

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH 6.12.y] batman-adv: tt: prevent TVLV entry number overflow

[Sasha Levin]

On Wed, Jun 03, 2026 at 05:44:05PM +0200, Sven Eckelmann wrote:
>On Wednesday, 3 June 2026 17:13:57 CEST Sasha Levin wrote:
>> > [PATCH 6.12.y] batman-adv: tt: prevent TVLV entry number overflow
>> > commit 99d9958fa10fb684b2a8e2c48a8d704122721420 upstream.
>>
>> Thanks Sven. This one doesn't apply to the stable trees as submitted.
>
>This is odd. It was from here (were it applies):
>https://git.open-mesh.org/batadv.git/log/?h=batadv/lts/6.12
>
>Also tested it now on
>https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/
>branch queue/6.12:
>
>b4 shazam 20260529180300.412724-1-sven@narfation.org
>b4 shazam 20260528205744.636746-1-sven@narfation.org
>b4 shazam 20260529180450.413317-1-sven@narfation.org
>b4 shazam 20260529180618.413634-1-sven@narfation.org # this is the relevant one
>b4 shazam 20260528202135.443823-1-sven@narfation.org
>b4 shazam 20260528192733.76065-1-sven@narfation.org
>b4 shazam 20260528194602.258724-1-sven@narfation.org
>b4 shazam 20260529180804.414401-1-sven@narfation.org
>b4 shazam 20260529180905.414737-1-sven@narfation.org
>b4 shazam 20260529181000.415087-1-sven@narfation.org
>b4 shazam 20260529181042.415322-1-sven@narfation.org
>b4 shazam 20260529181125.415543-1-sven@narfation.org
>
>
>This applied fine for me. Or here the patches I've just applied on queue/6.12
>(in my local branch) with the "b4 shazam" commands:
>
>$ git log --pretty=oneline stable-rc/queue/6.12..queue/6.12
>4569694c4f2a053cd2964cad24af604ae4ec2047 (HEAD -> queue/6.12) batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface
>d32927f478de78eb5224ed73432aa4a41d3bdbfb batman-adv: bla: avoid double decrement of bla.num_requests
>ceab9caf4a4da8ee47e4e238b5f416d49cf170a9 batman-adv: iv: recover OGM scheduling after forward packet error
>8b27c099491f34e3e2050e298852295eff0a4a91 batman-adv: tp_meter: avoid role confusion in tp_list
>46f3587c0deaa3fee91d38ffb517a3b597758cb2 batman-adv: tvlv: reject oversized TVLV packets
>8cb77976278ae5aa212908a7392188f7ff042ba0 batman-adv: tvlv: abort OGM send on tvlv append failure
>ecd5b0eaf6fbcdeec2ad328aeeabd39e9c7b8f24 batman-adv: v: stop OGMv2 on disabled interface
>b2fe2f8b69154de1fb8aff110743966f5ebf2293 batman-adv: tp_meter: directly shut down timer on cleanup
>4420ab1d1ee86b11393a3f561a78edbc220395fa batman-adv: tt: prevent TVLV entry number overflow
>09964daa253a0b7427f01ff3b67f396d24caf928 batman-adv: tt: avoid empty VLAN responses
>7829b033f053aafe66080f20b68b4a60c4f58db7 batman-adv: tt: fix TOCTOU race for reported vlans
>f547e2d9c2a51405f256238558699d40449483bc batman-adv: tt: reject oversized local TVLV buffers
>
>I am guessing that some different ordering was used while trying to apply the
>patches. Just ping me in case I should rebase the patches from my lts branches
>on queue/6.12 (or another stable queue) and submit the missing ones in a
>single patchset. But I should most likely only do this after you published the
>stable-rc for these stable versions - otherwise i would also post patches
>which you already have in your queue.

Yup, looks like an ordering issue. Thanks for clearing it up!

-- 
Thanks,
Sasha