[PATCH batadv] batman-adv: tt: prevent TVLV OOB check overflow

A TT unicast TVLV contains the number of VLANs stored in it. This number is
an u16 and gets multiplied by the size of the struct
batadv_tvlv_tt_vlan_data (8 bytes). The size can therefore overflow the u16
used to store the tt_vlan_len. All additional safety checks to prevent
out-of-bounds access of the TVLV buffer are invalid due to this overflow.

Using size_t prevents this overflow and ensures that the safety checks
compare against the actual buffer requirements.

Fixes: 21a57f6e7a3b ("batman-adv: make the TT CRC logic VLAN specific")
Signed-off-by: Sven Eckelmann <[email protected]>
---
 net/batman-adv/translation-table.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 6a132e23..3b70e9d7 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -4352,7 +4352,7 @@ static int batadv_tt_tvlv_unicast_handler_v1(struct batadv_priv *bat_priv,
 {
 	struct batadv_tvlv_tt_data *tt_data;
 	u16 tt_num_entries;
-	u16 tt_vlan_len;
+	size_t tt_vlan_len;
 	char tt_flag;
 	bool ret;
 

---
base-commit: 22b12d005035f37f898e5bf80480719fe1ef4fba
change-id: 20260703-tt-tvlv-handler-len-overflow-8d5479026292

Best regards,
--  
Sven Eckelmann <[email protected]>