On Wed, May 13, 2026 at 12:01 AM Sven Eckelmann <[email protected]> wrote: > > batadv_tvlv_container_ogm_append() builds a TVLV packet section from > the tvlv.container_list. The total size of this section is computed by > batadv_tvlv_container_list_size(), which sums the sizes of all registered > containers. > > The return type and accumulator in batadv_tvlv_container_list_size() were > u16. If the accumulated size exceeds U16_MAX, the value wraps around, > causing the subsequent allocation in batadv_tvlv_container_ogm_append() > to be undersized. The memcpy-style copy that follows would then write > beyond the end of the allocated buffer, corrupting kernel memory. > > Fix this by widening the return type of batadv_tvlv_container_list_size() > to size_t. In batadv_tvlv_container_ogm_append(), check the computed length > against U16_MAX before proceeding, and bail out as if the allocation had > failed when the limit is exceeded. > > Cc: [email protected] > Fixes: ef26157747d4 ("batman-adv: tvlv - basic infrastructure") > Reported-by: Yuan Tan <[email protected]> > Reported-by: Yifan Wu <[email protected]> > Reported-by: Juefei Pu <[email protected]> > Reported-by: Xin Liu <[email protected]> > Signed-off-by: Sven Eckelmann <[email protected]> > --- > net/batman-adv/tvlv.c | 9 ++++++--- > 1 file changed, 6 insertions(+), 3 deletions(-) > > diff --git a/net/batman-adv/tvlv.c b/net/batman-adv/tvlv.c > index 8129a3f9..4e2a9ec7 100644 > --- a/net/batman-adv/tvlv.c > +++ b/net/batman-adv/tvlv.c > @@ -12,6 +12,7 @@ > #include <linux/gfp.h> > #include <linux/if_ether.h> > #include <linux/kref.h> > +#include <linux/limits.h> > #include <linux/list.h> > #include <linux/lockdep.h> > #include <linux/netdevice.h> > @@ -159,10 +160,10 @@ batadv_tvlv_container_get(struct batadv_priv *bat_priv, > u8 type, u8 version) > * > * Return: size of all currently registered tvlv containers in bytes. > */ > -static u16 batadv_tvlv_container_list_size(struct batadv_priv *bat_priv) > +static size_t batadv_tvlv_container_list_size(struct batadv_priv *bat_priv) > { > struct batadv_tvlv_container *tvlv; > - u16 tvlv_len = 0; > + size_t tvlv_len = 0; > > lockdep_assert_held(&bat_priv->tvlv.container_list_lock); > > @@ -314,12 +315,14 @@ u16 batadv_tvlv_container_ogm_append(struct batadv_priv > *bat_priv, > { > struct batadv_tvlv_container *tvlv; > struct batadv_tvlv_hdr *tvlv_hdr; > - u16 tvlv_value_len; > + size_t tvlv_value_len; > void *tvlv_value; > bool ret; > > spin_lock_bh(&bat_priv->tvlv.container_list_lock); > tvlv_value_len = batadv_tvlv_container_list_size(bat_priv); > + if (tvlv_value_len > U16_MAX) > + goto end; > > ret = batadv_tvlv_realloc_packet_buff(packet_buff, packet_buff_len, > packet_min_len, tvlv_value_len); > > -- > 2.47.3 >
Reviewed-by: Yuan Tan <[email protected]>
