linux-stable.git/net/batman-adv, branch linux-rolling-stable

batman-adv: hold claim backbone gateways by reference

2026-04-18T08:46:45+00:00

commit 82d8701b2c930d0e96b0dbc9115a218d791cb0d2 upstream.

batadv_bla_add_claim() can replace claim->backbone_gw and drop the old
gateway's last reference while readers still follow the pointer.

The netlink claim dump path dereferences claim->backbone_gw->orig and
takes claim->backbone_gw->crc_lock without pinning the underlying
backbone gateway. batadv_bla_check_claim() still has the same naked
pointer access pattern.

Reuse batadv_bla_claim_get_backbone_gw() in both readers so they operate
on a stable gateway reference until the read-side work is complete.
This keeps the dump and claim-check paths aligned with the lifetime
rules introduced for the other BLA claim readers.

Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code")
Fixes: 04f3f5bf1883 ("batman-adv: add B.A.T.M.A.N. Dump BLA claims via netlink")
Cc: stable@vger.kernel.org
Reported-by: Yifan Wu 
Reported-by: Juefei Pu 
Co-developed-by: Yuan Tan 
Signed-off-by: Yuan Tan 
Suggested-by: Xin Liu 
Signed-off-by: Haoze Xie 
Signed-off-by: Ao Zhou 
Signed-off-by: Sven Eckelmann 
Signed-off-by: Simon Wunderlich 
Signed-off-by: Greg Kroah-Hartman

batman-adv: reject oversized global TT response buffers

2026-04-18T08:46:44+00:00

commit 3a359bf5c61d52e7f09754108309d637532164a6 upstream.

batadv_tt_prepare_tvlv_global_data() builds the allocation length for a
global TT response in 16-bit temporaries. When a remote originator
advertises a large enough global TT, the TT payload length plus the VLAN
header offset can exceed 65535 and wrap before kmalloc().

The full-table response path still uses the original TT payload length when
it fills tt_change, so the wrapped allocation is too small and
batadv_tt_prepare_tvlv_global_data() writes past the end of the heap object
before the later packet-size check runs.

Fix this by rejecting TT responses whose TVLV value length cannot fit in
the 16-bit TVLV payload length field.

Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific")
Cc: stable@vger.kernel.org
Reported-by: Yifan Wu 
Reported-by: Juefei Pu 
Co-developed-by: Yuan Tan 
Signed-off-by: Yuan Tan 
Suggested-by: Xin Liu 
Tested-by: Ren Wei 
Signed-off-by: Ruide Cao 
Signed-off-by: Ren Wei 
Signed-off-by: Sven Eckelmann 
Signed-off-by: Simon Wunderlich 
Signed-off-by: Greg Kroah-Hartman

batman-adv: avoid OGM aggregation when skb tailroom is insufficient

2026-03-25T10:13:16+00:00

commit 0d4aef630be9d5f9c1227d07669c26c4383b5ad0 upstream.

When OGM aggregation state is toggled at runtime, an existing forwarded
packet may have been allocated with only packet_len bytes, while a later
packet can still be selected for aggregation. Appending in this case can
hit skb_put overflow conditions.

Reject aggregation when the target skb tailroom cannot accommodate the new
packet. The caller then falls back to creating a new forward packet
instead of appending.

Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Cc: stable@vger.kernel.org
Reported-by: Yifan Wu 
Reported-by: Juefei Pu 
Signed-off-by: Yuan Tan 
Signed-off-by: Xin Liu 
Signed-off-by: Ao Zhou 
Signed-off-by: Yang Yang 
Signed-off-by: Sven Eckelmann 
Signed-off-by: Simon Wunderlich 
Signed-off-by: Greg Kroah-Hartman

batman-adv: Avoid double-rtnl_lock ELP metric worker

2026-03-19T15:15:19+00:00

commit cfc83a3c71517b59c1047db57da31e26a9dc2f33 upstream.

batadv_v_elp_get_throughput() might be called when the RTNL lock is already
held. This could be problematic when the work queue item is cancelled via
cancel_delayed_work_sync() in batadv_v_elp_iface_disable(). In this case,
an rtnl_lock() would cause a deadlock.

To avoid this, rtnl_trylock() was used in this function to skip the
retrieval of the ethtool information in case the RTNL lock was already
held.

But for cfg80211 interfaces, batadv_get_real_netdev() was called - which
also uses rtnl_lock(). The approach for __ethtool_get_link_ksettings() must
also be used instead and the lockless version __batadv_get_real_netdev()
has to be called.

Cc: stable@vger.kernel.org
Fixes: 8c8ecc98f5c6 ("batman-adv: Drop unmanaged ELP metric worker")
Reported-by: Christian Schmidbauer 
Signed-off-by: Sven Eckelmann 
Tested-by: Sören Skaarup 
Signed-off-by: Simon Wunderlich 
Signed-off-by: Greg Kroah-Hartman

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2025-10-31T13:46:03+00:00

Cross-merge networking fixes after downstream PR (net-6.18-rc4).

No conflicts, adjacent changes:

drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
  ded9813d17d3 ("net: stmmac: Consider Tx VLAN offload tag length for maxSDU")
  26ab9830beab ("net: stmmac: replace has_xxxx with core_type")

Signed-off-by: Jakub Kicinski

Merge tag 'batadv-net-pullrequest-20251024' of https://git.open-mesh.org/linux-merge

2025-10-28T01:00:54+00:00

Simon Wunderlich says:

====================
Here is a batman-adv bugfix:

 - release references to inactive interfaces, by Sven Eckelmann

* tag 'batadv-net-pullrequest-20251024' of https://git.open-mesh.org/linux-merge:
  batman-adv: Release references to inactive interfaces
====================

Link: https://patch.msgid.link/20251024091150.231141-1-sw@simonwunderlich.de
Signed-off-by: Jakub Kicinski

batman-adv: use skb_crc32c() instead of skb_seq_read()

2025-10-17T14:30:43+00:00

Make batadv_bla_check_duplist() just use the new function skb_crc32c(),
instead of calling skb_seq_read() with crc32c(). This is faster and
simpler.

Suggested-by: Eric Biggers 
Signed-off-by: Sven Eckelmann 
Signed-off-by: Simon Wunderlich

batman-adv: Start new development cycle

2025-10-17T14:30:43+00:00

This version will contain all the (major or even only minor) changes for
Linux 6.19.

The version number isn't a semantic version number with major and minor
information. It is just encoding the year of the expected publishing as
Linux -rc1 and the number of published versions this year (starting at 0).

Signed-off-by: Simon Wunderlich

batman-adv: Release references to inactive interfaces

2025-09-27T17:59:49+00:00

Trying to dump the originators or the neighbors via netlink for a meshif
with an inactive primary interface is not allowed. The dump functions were
checking this correctly but they didn't handle non-existing primary
interfaces and existing _inactive_ interfaces differently.

(Primary) batadv_hard_ifaces hold a references to a net_device. And
accessing them is only allowed when either being in a RCU/spinlock
protected section or when holding a valid reference to them. The netlink
dump functions use the latter.

But because the missing specific error handling for inactive primary
interfaces, the reference was never dropped. This reference counting error
was only detected when the interface should have been removed from the
system:

  unregister_netdevice: waiting for batadv_slave_0 to become free. Usage count = 2

Cc: stable@vger.kernel.org
Fixes: 6ecc4fd6c2f4 ("batman-adv: netlink: reduce duplicate code by returning interfaces")
Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com
Reported-by: Tetsuo Handa 
Signed-off-by: Sven Eckelmann 
Signed-off-by: Simon Wunderlich

batman-adv: remove includes for extern declarations

2025-09-05T13:11:02+00:00

It is not necessary to include the header for the struct definition for an
"extern " declaration. It can simply be dropped from the headers to reduce
the number of includes the preprocessor has to process. If needed, it can
be added to the actual C source file.

Signed-off-by: Sven Eckelmann 
Signed-off-by: Simon Wunderlich