]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
batman-adv: tt: prevent TVLV entry number overflow
authorSven Eckelmann <sven@narfation.org>
Sat, 2 May 2026 19:25:19 +0000 (21:25 +0200)
committerSven Eckelmann <sven@narfation.org>
Tue, 12 May 2026 06:33:53 +0000 (08:33 +0200)
commit99d9958fa10fb684b2a8e2c48a8d704122721420
treebbdfe7350d0c00a2f2767cb02ba1ccf06081d1d0
parentfa1bd704940b5bcbc32c0b28db9167405c8ee5e0
batman-adv: tt: prevent TVLV entry number overflow

The helpers to prepare the buffers for the local and global TT based
replies are trying to sum up all TT entries which can be found for each
VLAN. In theory, this sum can be too big for an u16 and therefore overflow.
A too small buffer would then be allocated for the TVLV.

The too small buffer will be handled gracefully by
batadv_tt_tvlv_generate() and is not causing a buffer overflow - just a
truncated reply. But this overflow shouldn't have happened in the first and
the too small buffer should never have been allocated when an overflow was
detected.

Cc: stable@kernel.org
Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
net/batman-adv/translation-table.c