diff options
| author | Sven Eckelmann <sven@narfation.org> | 2026-05-03 22:46:15 +0200 |
|---|---|---|
| committer | Sven Eckelmann <sven@narfation.org> | 2026-06-01 14:22:02 +0200 |
| commit | 5ffd4dd8742586d1e7b80fe04340f56762960d9c (patch) | |
| tree | 046c8a7e78c26a24c5eac54a4de3622a93e69c77 | |
| parent | 4dd2055046c4295c30ed552b4c2fd280b8d36317 (diff) | |
| download | linux-5ffd4dd8742586d1e7b80fe04340f56762960d9c.tar.gz linux-5ffd4dd8742586d1e7b80fe04340f56762960d9c.zip | |
batman-adv: tt: replace open-coded overflow check with helper
The commit 6043a632dd06 ("batman-adv: reject oversized global TT response
buffers") introduced an open-coded check to ensure that the allocated
buffer size can be stored in a u16. The check_add_overflow() helper can
perform the addition and overflow check in one step, so use that instead.
Acked-by: Antonio Quartulli <antonio@mandelbit.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
| -rw-r--r-- | net/batman-adv/translation-table.c | 7 |
1 files changed, 2 insertions, 5 deletions
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index 8903b2f84f51..5e134d08a80f 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -799,10 +799,10 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node, { u16 num_vlan = 0; u16 tvlv_len = 0; - unsigned int change_offset; struct batadv_tvlv_tt_vlan_data *tt_vlan; struct batadv_orig_node_vlan *vlan; u16 total_entries = 0; + size_t change_offset; u8 *tt_change_ptr; int vlan_entries; u16 sum_entries; @@ -826,14 +826,11 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node, if (*tt_len < 0) *tt_len = batadv_tt_len(total_entries); - if (change_offset > U16_MAX || *tt_len > U16_MAX - change_offset) { + if (check_add_overflow(*tt_len, change_offset, &tvlv_len)) { *tt_len = 0; goto out; } - tvlv_len = *tt_len; - tvlv_len += change_offset; - *tt_data = kmalloc(tvlv_len, GFP_ATOMIC); if (!*tt_data) { *tt_len = 0; |