]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
batman-adv: mcast: avoid OOB read of num_dests header
authorSven Eckelmann <sven@narfation.org>
Fri, 3 Jul 2026 18:47:45 +0000 (20:47 +0200)
committerSven Eckelmann <sven@narfation.org>
Mon, 6 Jul 2026 05:18:59 +0000 (07:18 +0200)
commit38eaed28e250895d56f4b7989bd65479a511c5c3
treec3e7456d58062d710956adeead778f5985884298
parent353d2c1d5492e53ae34f490a84494124dc3d3531
batman-adv: mcast: avoid OOB read of num_dests header

Before the access to struct batadv_tvlv_mcast_tracker's num_dests, it is
attempted to check whether enough space is actually in the network header.
But instead of using offsetofend() to check for the whole size (2) which
must be accessible, offsetof() of is called. The latter is always returning
0. The comparison with the network header length will always return that
enough data is available - even when only 1 or 0 bytes are accessible.

Instead of using offsetofend(), use the more common check for the whole
header.

Cc: stable@vger.kernel.org
Fixes: 07afe1ba288c ("batman-adv: mcast: implement multicast packet reception and forwarding")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
net/batman-adv/multicast_forw.c