From ea01fff30f631e67ee5f0a2b97855d772b3a35fc Mon Sep 17 00:00:00 2001 From: Kyle Zeng Date: Thu, 29 Oct 2026 21:21:46 -0700 Subject: [PATCH] batman-adv: mcast: validate tracker padding before forwarding A multicast tracker with an even number of destinations needs two padding bytes after its destination list. batadv_mcast_forw_packet() currently only checks that the count field and the addresses fit in the tracker TVLV. If an unpadded even tracker is compacted to an odd number of destinations, batadv_mcast_forw_shrink_update_headers() includes those missing padding bytes in the amount to remove. The subsequent memmove can then write two bytes past the old packet tail. With no tailroom, this corrupts skb_shared_info. Include the required padding in the existing tracker length check. This rejects the malformed tracker before either received or locally generated packets can reach the compactor. Fixes: 2dfe644a1ce0 ("batman-adv: mcast: shrink tracker packet after scrubbing") Cc: stable@vger.kernel.org Signed-off-by: Kyle Zeng Signed-off-by: Sven Eckelmann --- net/batman-adv/multicast_forw.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/batman-adv/multicast_forw.c b/net/batman-adv/multicast_forw.c index ac97cd8b81dc..9ffed1f237b6 100644 --- a/net/batman-adv/multicast_forw.c +++ b/net/batman-adv/multicast_forw.c @@ -950,8 +950,11 @@ static int batadv_mcast_forw_packet(struct batadv_priv *bat_priv, dest = (u8 *)mcast_tracker + sizeof(*mcast_tracker); - /* check if full tracker tvlv is within skb length */ + /* check if full tracker tvlv, including padding, is within skb length */ tvlv_len = sizeof(*mcast_tracker) + ETH_ALEN * num_dests; + if (!(num_dests % 2)) + tvlv_len += 2; + if (tvlv_len > skb_network_header_len(skb)) return -EINVAL;