Re: [PATCH net v3] batman-adv: reject unrepresentable multicast TVLV offsets

[Sven Eckelmann]

> The network and transport header fields in struct sk_buff are 16-bit
> offsets from skb->head, and U16_MAX is reserved as the unset transport
> header value. batadv_tvlv_call_handler() sets both fields from a received
> multicast TVLV without checking whether the TVLV end is representable.
> 
> If the end offset exceeds the field's range, skb_set_transport_header()
> truncates it so that the transport header precedes the network header.
> The negative difference is then returned by skb_network_header_len() as
> a large u32. batadv_mcast_forw_packet() consequently accepts an oversized
> multicast tracker and accesses memory beyond the skb data.

[...] 

> ---
> Changes in v3:
> - Rename transport_offset to thoff so the comparisons fit on one line.
> 
> v2: https://lore.kernel.org/netdev/20260810145754.828936-1-david.lee@xxxxxxxxxxxxxxx/

Looks to me like you've also dropped the
Suggested-by: Sven Eckelmann <sven@xxxxxxxxxxxxx>

b4 diff -v2  20260817084955.944189-1-david.lee@xxxxxxxxxxxxxxx

Acked-by: Sven Eckelmann <sven@xxxxxxxxxxxxx>

-- 
Sven Eckelmann <sven@xxxxxxxxxxxxx>