Re: [PATCH net v3] batman-adv: reject unrepresentable multicast TVLV offsets

The network and transport header fields in struct sk_buff are 16-bit
offsets from skb->head, and U16_MAX is reserved as the unset transport
header value. batadv_tvlv_call_handler() sets both fields from a received
multicast TVLV without checking whether the TVLV end is representable.

If the end offset exceeds the field's range, skb_set_transport_header()
truncates it so that the transport header precedes the network header.
The negative difference is then returned by skb_network_header_len() as
a large u32. batadv_mcast_forw_packet() consequently accepts an oversized
multicast tracker and accesses memory beyond the skb data.

[...] 

---
Changes in v3:
- Rename transport_offset to thoff so the comparisons fit on one line.

v2: https://lore.kernel.org/netdev/20260810145754.828936-1-david.lee@trailofbits.com/ (local)

Looks to me like you've also dropped the
Suggested-by: Sven Eckelmann <sven@narfation.org>

b4 diff -v2  20260817084955.944189-1-david.lee@trailofbits.com

Acked-by: Sven Eckelmann <sven@narfation.org>

-- 
Sven Eckelmann [off-list ref]