From: Sven Eckelmann Date: Sun, 3 May 2026 20:46:15 +0000 (+0200) Subject: batman-adv: tt: replace open-coded overflow check with helper X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5ffd4dd8742586d1e7b80fe04340f56762960d9c;p=thirdparty%2Flinux.git batman-adv: tt: replace open-coded overflow check with helper The commit 6043a632dd06 ("batman-adv: reject oversized global TT response buffers") introduced an open-coded check to ensure that the allocated buffer size can be stored in a u16. The check_add_overflow() helper can perform the addition and overflow check in one step, so use that instead. Acked-by: Antonio Quartulli Signed-off-by: Sven Eckelmann --- diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index 8903b2f84f51..5e134d08a80f 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -799,10 +799,10 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node, { u16 num_vlan = 0; u16 tvlv_len = 0; - unsigned int change_offset; struct batadv_tvlv_tt_vlan_data *tt_vlan; struct batadv_orig_node_vlan *vlan; u16 total_entries = 0; + size_t change_offset; u8 *tt_change_ptr; int vlan_entries; u16 sum_entries; @@ -826,14 +826,11 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node, if (*tt_len < 0) *tt_len = batadv_tt_len(total_entries); - if (change_offset > U16_MAX || *tt_len > U16_MAX - change_offset) { + if (check_add_overflow(*tt_len, change_offset, &tvlv_len)) { *tt_len = 0; goto out; } - tvlv_len = *tt_len; - tvlv_len += change_offset; - *tt_data = kmalloc(tvlv_len, GFP_ATOMIC); if (!*tt_data) { *tt_len = 0;