On Mon, 11 May 2026 14:52:42 +0800, Ren Wei <[email protected]> wrote:
> diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
> index f4e45cc2..c6c25be7 100644
> --- a/net/batman-adv/fragmentation.c
> +++ b/net/batman-adv/fragmentation.c
> @@ -80,9 +80,9 @@ void batadv_frag_purge_orig(struct batadv_orig_node
> *orig_node,
> *
> * Return: the maximum size of payload that can be fragmented.
> */
> -static int batadv_frag_size_limit(void)
> +static u32 batadv_frag_size_limit(void)
> {
> - int limit = BATADV_FRAG_MAX_FRAG_SIZE;
> + u32 limit = BATADV_FRAG_MAX_FRAG_SIZE;
size_t
> @@ -141,8 +141,9 @@ static bool batadv_frag_insert_packet(struct
> batadv_orig_node *orig_node,
> struct batadv_frag_list_entry *frag_entry_new = NULL, *frag_entry_curr;
> struct batadv_frag_list_entry *frag_entry_last = NULL;
> struct batadv_frag_packet *frag_packet;
> - u8 bucket;
> + u32 data_len;
size_t
> @@ -188,7 +190,7 @@ static bool batadv_frag_insert_packet(struct
> batadv_orig_node *orig_node,
> if (frag_entry_curr->no < frag_entry_new->no) {
> hlist_add_before(&frag_entry_new->list,
> &frag_entry_curr->list);
> - chain->size += skb->len - hdr_size;
> + chain->size += data_len;
Let us ignore for the moment the reality of wifi/ethernet an widen our scope:
The sk_buff len is an unsigned int (equal to u32 for all we care). To make the
"non-truncating type" true, you would need to use a much larger type. Or you
can add a check for the overflow:
bool overflow = false;
...
if (check_add_overflow(chain->size, data_len, &chain->size)) {
overflow = true;
goto out;
}
...
if (overflow || chain->size > batadv_frag_size_limit() ||
...
/* Clear chain if total size of either the list or the packet
...
Don't forget to include linux/overflow.h
> @@ -201,7 +203,7 @@ static bool batadv_frag_insert_packet(struct
> batadv_orig_node *orig_node,
> /* Reached the end of the list, so insert after 'frag_entry_last'. */
> if (likely(frag_entry_last)) {
> hlist_add_behind(&frag_entry_new->list, &frag_entry_last->list);
> - chain->size += skb->len - hdr_size;
> + chain->size += data_len;
See above
>
> diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
> index 8fc5fe0e..96ea4c70 100644
> --- a/net/batman-adv/types.h
> +++ b/net/batman-adv/types.h
> @@ -300,7 +300,7 @@ struct batadv_frag_table_entry {
> u16 seqno;
>
> /** @size: accumulated size of packets in list */
> - u16 size;
> + u32 size;
size_t
--
Sven Eckelmann <[email protected]>
