Re: [PATCH net v2] batman-adv: reject unrepresentable multicast TVLV offsets

> diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h                                                                                                                                                                
> index 22eda1d54a0e8..dbeceaf5c3b39 100644                                                                                                                                                                                   
> --- a/include/linux/skbuff.h                                                                                                                                                                                                
> +++ b/include/linux/skbuff.h                                                                                                                                                                                                
> @@ -3126,6 +3126,32 @@ static inline void skb_set_transport_header(struct sk_buff *skb
> [...]
> +static inline bool __must_check
> +skb_set_transport_header_careful(struct sk_buff *skb, const int offset)
> +{
> +	long transport_offset = skb->data - skb->head + offset;
> +
> +	if (unlikely(transport_offset !=
> +		     (typeof(skb->transport_header))transport_offset))
> +		return false;
> +
> +	if (unlikely(transport_offset ==
> +		     (typeof(skb->transport_header))~0U))
> +		return false;
> +
> +	skb->transport_header = transport_offset;
> +	return true;
> +}
> +

I personally don't like the way the lines are broken down. The 80 character
limit was replaced by a 100 character limit since commit bdc48fa11e46
("checkpatch/coding-style: deprecate 80-column warning"). And it seems like
there are already multiple lines in this file which are longer than 80
characters. So it should be possible not to add a line break right after a
comparison operator.

But I leave the judgement about this part to the netdev maintainers.

> diff --git a/net/batman-adv/tvlv.c b/net/batman-adv/tvlv.c
> index de907c07fa154..93492d393c347 100644
> --- a/net/batman-adv/tvlv.c
> +++ b/net/batman-adv/tvlv.c
> @@ -438,8 +438,11 @@ static int batadv_tvlv_call_handler(struct batadv_priv *bat_priv,
>  			return NET_RX_SUCCESS;
>  
>  		tvlv_offset = (unsigned char *)tvlv_value - skb->data;
> +		if (!skb_set_transport_header_careful(skb,
> +						      tvlv_offset + tvlv_value_len))
> +			return -EINVAL;
> +
>  		skb_set_network_header(skb, tvlv_offset);
> -		skb_set_transport_header(skb, tvlv_offset + tvlv_value_len);
>  
>  		return tvlv_handler->mcast_handler(bat_priv, skb);
>  	}

For the batman-adv part:

Acked-by: Sven Eckelmann <[email protected]>

-- 
Sven Eckelmann <[email protected]>