Re: [PATCH batadv 1/1] batman-adv: fix fragment reassembly length accounting

On Mon, 11 May 2026 14:52:42 +0800, Ren Wei <[email protected]> wrote:
> diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
> index f4e45cc2..c6c25be7 100644
> --- a/net/batman-adv/fragmentation.c
> +++ b/net/batman-adv/fragmentation.c
> @@ -80,9 +80,9 @@ void batadv_frag_purge_orig(struct batadv_orig_node *orig_node,
>   *
>   * Return: the maximum size of payload that can be fragmented.
>   */
> -static int batadv_frag_size_limit(void)
> +static u32 batadv_frag_size_limit(void)
>  {
> -	int limit = BATADV_FRAG_MAX_FRAG_SIZE;
> +	u32 limit = BATADV_FRAG_MAX_FRAG_SIZE;

size_t

> @@ -141,8 +141,9 @@ static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node,
>  	struct batadv_frag_list_entry *frag_entry_new = NULL, *frag_entry_curr;
>  	struct batadv_frag_list_entry *frag_entry_last = NULL;
>  	struct batadv_frag_packet *frag_packet;
> -	u8 bucket;
> +	u32 data_len;

size_t

> @@ -188,7 +190,7 @@ static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node,
>  		if (frag_entry_curr->no < frag_entry_new->no) {
>  			hlist_add_before(&frag_entry_new->list,
>  					 &frag_entry_curr->list);
> -			chain->size += skb->len - hdr_size;
> +			chain->size += data_len;

Let us ignore for the moment the reality of wifi/ethernet an widen our scope:
The sk_buff len is an unsigned int (equal to u32 for all we care). To make the
"non-truncating type" true, you would need to use a much larger type. Or you
can add a check for the overflow:

bool overflow = false;
...

if (check_add_overflow(chain->size, data_len, &chain->size)) {
	overflow = true;
	goto out;
}

...

if (overflow || chain->size > batadv_frag_size_limit() ||
	...
	/* Clear chain if total size of either the list or the packet
	...


Don't forget to include linux/overflow.h

> @@ -201,7 +203,7 @@ static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node,
>  	/* Reached the end of the list, so insert after 'frag_entry_last'. */
>  	if (likely(frag_entry_last)) {
>  		hlist_add_behind(&frag_entry_new->list, &frag_entry_last->list);
> -		chain->size += skb->len - hdr_size;
> +		chain->size += data_len;

See above

>
> diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
> index 8fc5fe0e..96ea4c70 100644
> --- a/net/batman-adv/types.h
> +++ b/net/batman-adv/types.h
> @@ -300,7 +300,7 @@ struct batadv_frag_table_entry {
>  	u16 seqno;
>  
>  	/** @size: accumulated size of packets in list */
> -	u16 size;
> +	u32 size;

size_t

-- 
Sven Eckelmann <[email protected]>