[PATCH] batman-adv: mcast: validate tracker padding before forwarding

[PATCH] batman-adv: mcast: validate tracker padding before forwarding

[Kyle Zeng]

A multicast tracker with an even number of destinations needs two
padding bytes after its destination list. batadv_mcast_forw_packet()
currently only checks that the count field and the addresses fit in
the tracker TVLV.

If an unpadded even tracker is compacted to an odd number of
destinations, batadv_mcast_forw_shrink_update_headers() includes those
missing padding bytes in the amount to remove. The subsequent memmove
can then write two bytes past the old packet tail. With no tailroom,
this corrupts skb_shared_info.

Include the required padding in the existing tracker length check.
This rejects the malformed tracker before either received or locally
generated packets can reach the compactor.

Fixes: 2dfe644a1ce0 ("batman-adv: mcast: shrink tracker packet after scrubbing")
Cc: stable@vger.kernel.org
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
I have a reproducer for this issue and can share via DM

 net/batman-adv/multicast_forw.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/batman-adv/multicast_forw.c b/net/batman-adv/multicast_forw.c
index ac97cd8b81dc..9ffed1f237b6 100644
--- a/net/batman-adv/multicast_forw.c
+++ b/net/batman-adv/multicast_forw.c
@@ -950,8 +950,11 @@ static int batadv_mcast_forw_packet(struct batadv_priv *bat_priv,
 
 	dest = (u8 *)mcast_tracker + sizeof(*mcast_tracker);
 
-	/* check if full tracker tvlv is within skb length */
+	/* check if full tracker tvlv, including padding, is within skb length */
 	tvlv_len = sizeof(*mcast_tracker) + ETH_ALEN * num_dests;
+	if (!(num_dests % 2))
+		tvlv_len += 2;
+
 	if (tvlv_len > skb_network_header_len(skb))
 		return -EINVAL;
 

base-commit: d89e1d186ec9271bf78e62771779e9fc03bf0fc3
-- 
2.56.0

Re: [PATCH] batman-adv: mcast: validate tracker padding before forwarding

[Sven Eckelmann]

On Thu, 29 Oct 2026 21:21:46 -0700, Kyle Zeng wrote:
> batman-adv: mcast: validate tracker padding before forwarding

Applied, thanks!

[1/1] batman-adv: mcast: validate tracker padding before forwarding
      https://git.open-mesh.org/batadv/c/ea01fff30f63

Just two minor nitpicks:

Please add 'batadv' to the subject prefix '[PATCH batadv]' to make it more
clear what tree is the target. In this case, it was clear because this (single)
patch series only went to the linux-kernel and the b.a.t.m.a.n mailing list.
And no one picks patches from the former.

The other one: d89e1d186ec9271bf78e62771779e9fc03bf0fc3 is here the base
commit. But it is not even in our tree. Please try to use a recent version of
the target tree to make sure that it applies cleanly and that you are actually
testing against the correct source code. The other patch which came in today
had for example conflicts. Yours luckily not.

Best regards,
-- 
Sven Eckelmann <sven@narfation.org>