Re: [PATCH net v2] batman-adv: reject unrepresentable multicast TVLV offsets
From: Sven Eckelmann <sven@narfation.org>
Date: 2026-08-11 15:33:50
Also in:
batman, lkml, stable
quoted hunk ↗ jump to hunk
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 22eda1d54a0e8..dbeceaf5c3b39 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h@@ -3126,6 +3126,32 @@ static inline void skb_set_transport_header(struct sk_buff *skb[...] +static inline bool __must_check +skb_set_transport_header_careful(struct sk_buff *skb, const int offset) +{ + long transport_offset = skb->data - skb->head + offset; + + if (unlikely(transport_offset != + (typeof(skb->transport_header))transport_offset)) + return false; + + if (unlikely(transport_offset == + (typeof(skb->transport_header))~0U)) + return false; + + skb->transport_header = transport_offset; + return true; +} +
I personally don't like the way the lines are broken down. The 80 character
limit was replaced by a 100 character limit since commit bdc48fa11e46
("checkpatch/coding-style: deprecate 80-column warning"). And it seems like
there are already multiple lines in this file which are longer than 80
characters. So it should be possible not to add a line break right after a
comparison operator.
But I leave the judgement about this part to the netdev maintainers.
quoted hunk ↗ jump to hunk
diff --git a/net/batman-adv/tvlv.c b/net/batman-adv/tvlv.c index de907c07fa154..93492d393c347 100644 --- a/net/batman-adv/tvlv.c +++ b/net/batman-adv/tvlv.c@@ -438,8 +438,11 @@ static int batadv_tvlv_call_handler(struct batadv_priv *bat_priv, return NET_RX_SUCCESS; tvlv_offset = (unsigned char *)tvlv_value - skb->data; + if (!skb_set_transport_header_careful(skb, + tvlv_offset + tvlv_value_len)) + return -EINVAL; + skb_set_network_header(skb, tvlv_offset); - skb_set_transport_header(skb, tvlv_offset + tvlv_value_len); return tvlv_handler->mcast_handler(bat_priv, skb); }
For the batman-adv part: Acked-by: Sven Eckelmann <sven@narfation.org> -- Sven Eckelmann [off-list ref]