kernel/linux.git/net/batman-adv/network-coding.c, branch v6.1.174

batman-adv: fix OOB read/write in network-coding decode

2025-09-09T16:54:18+00:00

commit d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087 upstream. batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write. Validate that coded_len fits within the payload area of both destination and source sk_buffs before XORing. Fixes: 2df5278b0267 ("batman-adv: network coding - receive coded packets and decode them") Cc: stable@vger.kernel.org Reported-by: Stanislav Fort Signed-off-by: Stanislav Fort Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich Signed-off-by: Greg Kroah-Hartman

batman-adv: Migrate to linux/container_of.h

2022-03-02T08:00:13+00:00

The commit d2a8ebbf8192 ("kernel.h: split out container_of() and typeof_member() macros") introduced a new header for the container_of related macros from (previously) linux/kernel.h. Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich

batman-adv: remove unneeded variable in batadv_nc_init

2021-12-10T07:52:52+00:00

Return status directly from function called. Reported-by: Zeal Robot Signed-off-by: Minghao Chi Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich

net: batman-adv: fix error handling

2021-10-26T13:47:12+00:00

Syzbot reported ODEBUG warning in batadv_nc_mesh_free(). The problem was in wrong error handling in batadv_mesh_init(). Before this patch batadv_mesh_init() was calling batadv_mesh_free() in case of any batadv_*_init() calls failure. This approach may work well, when there is some kind of indicator, which can tell which parts of batadv are initialized; but there isn't any. All written above lead to cleaning up uninitialized fields. Even if we hide ODEBUG warning by initializing bat_priv->nc.work, syzbot was able to hit GPF in batadv_nc_purge_paths(), because hash pointer in still NULL. [1] To fix these bugs we can unwind batadv_*_init() calls one by one. It is good approach for 2 reasons: 1) It fixes bugs on error handling path 2) It improves the performance, since we won't call unneeded batadv_*_free() functions. So, this patch makes all batadv_*_init() clean up all allocated memory before returning with an error to no call correspoing batadv_*_free() and open-codes batadv_mesh_free() with proper order to avoid touching uninitialized fields. Link: https://lore.kernel.org/netdev/000000000000c87fbd05cef6bcb0@google.com/ [1] Reported-and-tested-by: syzbot+28b0702ada0bf7381f58@syzkaller.appspotmail.com Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Signed-off-by: Pavel Skripkin Acked-by: Sven Eckelmann Signed-off-by: David S. Miller

batman-adv: Drop NULL check before dropping references

2021-08-08T18:21:40+00:00

batman-adv: Check ptr for NULL before reducing its refcnt

2021-08-08T18:21:40+00:00

The commit b37a46683739 ("netdevice: add the case if dev is NULL") changed the way how the NULL check for net_devices have to be handled when trying to reduce its reference counter. Before this commit, it was the responsibility of the caller to check whether the object is NULL or not. But it was changed to behave more like kfree. Now the callee has to handle the NULL-case. The batman-adv code was scanned via cocinelle for similar places. These were changed to use the paradigm @@ identifier E, T, R, C; identifier put; @@ void put(struct T *E) { + if (!E) + return; kref_put(&E->C, R); } Functions which were used in other sources files were moved to the header to allow the compiler to inline the NULL check and the kref_put call. Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich

batman-adv: Drop publication years from copyright info

2021-02-06T08:22:10+00:00

The batman-adv source code was using the year of publication (to net-next) as "last" year for the copyright statement. The whole source code mentioned in the MAINTAINERS "BATMAN ADVANCED" section was handled as a single entity regarding the publishing year. This avoided having outdated (in sense of year information - not copyright holder) publishing information inside several files. But since the simple "update copyright year" commit (without other changes) in the file was not well received in the upstream kernel, the option to not have a copyright year (for initial and last publication) in the files are chosen instead. More detailed information about the years can still be retrieved from the SCM system. Signed-off-by: Sven Eckelmann Acked-by: Marek Lindner Signed-off-by: Simon Wunderlich

batman-adv: Drop deprecated debugfs support

2020-12-04T07:40:52+00:00

The debugfs support in batman-adv was marked as deprecated by the commit 00caf6a2b318 ("batman-adv: Mark debugfs functionality as deprecated") and scheduled for removal in 2021. Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich

batman-adv: Migrate to linux/prandom.h

2020-08-18T17:39:54+00:00

The commit c0842fbc1b18 ("random32: move the pseudo-random 32-bit definitions to prandom.h") introduced a new header for the pseudo random functions from (previously) linux/random.h. One future goal of the prandom.h change is to make code to switch just the new header file and to avoid the implicit include. This would allow the removal of the implicit include from random.h Signed-off-by: Sven Eckelmann

batman-adv: Drop repeated words in comments

2020-08-18T17:39:54+00:00

checkpatch found various instances of "Possible repeated word" in various comments. Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich