kernel/linux.git/net/batman-adv, branch v6.18.22

batman-adv: avoid OGM aggregation when skb tailroom is insufficient

2026-03-25T10:10:31+00:00

commit 0d4aef630be9d5f9c1227d07669c26c4383b5ad0 upstream. When OGM aggregation state is toggled at runtime, an existing forwarded packet may have been allocated with only packet_len bytes, while a later packet can still be selected for aggregation. Appending in this case can hit skb_put overflow conditions. Reject aggregation when the target skb tailroom cannot accommodate the new packet. The caller then falls back to creating a new forward packet instead of appending. Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Cc: stable@vger.kernel.org Reported-by: Yifan Wu Reported-by: Juefei Pu Signed-off-by: Yuan Tan Signed-off-by: Xin Liu Signed-off-by: Ao Zhou Signed-off-by: Yang Yang Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich Signed-off-by: Greg Kroah-Hartman

batman-adv: Avoid double-rtnl_lock ELP metric worker

2026-03-19T15:08:37+00:00

commit cfc83a3c71517b59c1047db57da31e26a9dc2f33 upstream. batadv_v_elp_get_throughput() might be called when the RTNL lock is already held. This could be problematic when the work queue item is cancelled via cancel_delayed_work_sync() in batadv_v_elp_iface_disable(). In this case, an rtnl_lock() would cause a deadlock. To avoid this, rtnl_trylock() was used in this function to skip the retrieval of the ethtool information in case the RTNL lock was already held. But for cfg80211 interfaces, batadv_get_real_netdev() was called - which also uses rtnl_lock(). The approach for __ethtool_get_link_ksettings() must also be used instead and the lockless version __batadv_get_real_netdev() has to be called. Cc: stable@vger.kernel.org Fixes: 8c8ecc98f5c6 ("batman-adv: Drop unmanaged ELP metric worker") Reported-by: Christian Schmidbauer Signed-off-by: Sven Eckelmann Tested-by: Sören Skaarup Signed-off-by: Simon Wunderlich Signed-off-by: Greg Kroah-Hartman

Merge tag 'batadv-net-pullrequest-20251024' of https://git.open-mesh.org/linux-merge

2025-10-28T01:00:54+00:00

Simon Wunderlich says: ==================== Here is a batman-adv bugfix: - release references to inactive interfaces, by Sven Eckelmann * tag 'batadv-net-pullrequest-20251024' of https://git.open-mesh.org/linux-merge: batman-adv: Release references to inactive interfaces ==================== Link: https://patch.msgid.link/20251024091150.231141-1-sw@simonwunderlich.de Signed-off-by: Jakub Kicinski

batman-adv: Release references to inactive interfaces

2025-09-27T17:59:49+00:00

Trying to dump the originators or the neighbors via netlink for a meshif with an inactive primary interface is not allowed. The dump functions were checking this correctly but they didn't handle non-existing primary interfaces and existing _inactive_ interfaces differently. (Primary) batadv_hard_ifaces hold a references to a net_device. And accessing them is only allowed when either being in a RCU/spinlock protected section or when holding a valid reference to them. The netlink dump functions use the latter. But because the missing specific error handling for inactive primary interfaces, the reference was never dropped. This reference counting error was only detected when the interface should have been removed from the system: unregister_netdevice: waiting for batadv_slave_0 to become free. Usage count = 2 Cc: stable@vger.kernel.org Fixes: 6ecc4fd6c2f4 ("batman-adv: netlink: reduce duplicate code by returning interfaces") Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com Reported-by: Tetsuo Handa Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich

batman-adv: remove includes for extern declarations

2025-09-05T13:11:02+00:00

It is not necessary to include the header for the struct definition for an "extern " declaration. It can simply be dropped from the headers to reduce the number of includes the preprocessor has to process. If needed, it can be added to the actual C source file. Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich

batman-adv: keep skb crc32 helper local in BLA

2025-09-05T13:11:02+00:00

The batadv_skb_crc32() helper was shared between Bridge Loop Avoidance and Network Coding. With the removal of the network coding feature, it is possible to just move this helper directly to Bridge Loop Avoidance. Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich

batman-adv: remove network coding support

2025-09-05T13:11:00+00:00

The Network Coding feature, introduced in 2013, is based on the master thesis "Inter-Flow Network Coding for Wireless Mesh Networks". It relies on the assumption that neighboring mesh nodes can reliably overhear each other's transmissions in promiscuous mode, allowing packets to be combined to reduce forwarding overhead. This assumption no longer holds for modern wireless mesh networks, which are heterogeneous and make overhearing increasingly unreliable. Factors such as multiple spatial streams, varying data rates, beamforming, and OFDMA all prevent nodes from consistently overhearing each other. The current implementation in batman-adv is not able to detect these conditions and would require a more complex layer beyond its neighbor discovery process to do so. In addition, the feature has been unmaintained for years and is discouraged for use. None of the current maintainers have the required test setup to verify its functionality, and known issues remain in its data structures (reference counting, RCU usage, and cleanup handling). Its continued presence also blocks necessary refactoring of the core originator infrastructure. Remove this obsolete and unmaintained feature. Signed-off-by: Sven Eckelmann Acked-by: Martin Hundebøll Acked-by: Marek Lindner Signed-off-by: Simon Wunderlich

batman-adv: Start new development cycle

2025-09-05T13:10:47+00:00

This version will contain all the (major or even only minor) changes for Linux 6.18. The version number isn't a semantic version number with major and minor information. It is just encoding the year of the expected publishing as Linux -rc1 and the number of published versions this year (starting at 0). Signed-off-by: Simon Wunderlich

batman-adv: fix OOB read/write in network-coding decode

2025-08-31T15:01:35+00:00

batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write. Validate that coded_len fits within the payload area of both destination and source sk_buffs before XORing. Fixes: 2df5278b0267 ("batman-adv: network coding - receive coded packets and decode them") Cc: stable@vger.kernel.org Reported-by: Stanislav Fort Signed-off-by: Stanislav Fort Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich

Merge tag 'batadv-next-pullrequest-20250710' of git://git.open-mesh.org/linux-merge

2025-07-12T00:50:27+00:00

Simon Wunderlich says: ==================== This cleanup patchset includes the following patches: - bump version strings, by Simon Wunderlich - batman-adv: store hard_iface as iflink private data, by Matthias Schiffer * tag 'batadv-next-pullrequest-20250710' of git://git.open-mesh.org/linux-merge: batman-adv: store hard_iface as iflink private data batman-adv: Start new development cycle ==================== Link: https://patch.msgid.link/20250710164501.153872-1-sw@simonwunderlich.de Signed-off-by: Jakub Kicinski