linux-toradex.git/net/batman-adv, branch master

Merge tag 'batadv-net-pullrequest-20260408' of https://git.open-mesh.org/linux-merge

2026-04-09T01:50:27+00:00

Simon Wunderlich says:

====================
Here are two batman-adv bugfixes:

 - reject oversized global TT response buffers, by Ruide Cao

 - hold claim backbone gateways by reference, by Haoze Xie

* tag 'batadv-net-pullrequest-20260408' of https://git.open-mesh.org/linux-merge:
  batman-adv: hold claim backbone gateways by reference
  batman-adv: reject oversized global TT response buffers
====================

Link: https://patch.msgid.link/20260408110255.976389-1-sw@simonwunderlich.de
Signed-off-by: Jakub Kicinski

batman-adv: hold claim backbone gateways by reference

2026-04-06T13:42:29+00:00

batadv_bla_add_claim() can replace claim->backbone_gw and drop the old
gateway's last reference while readers still follow the pointer.

The netlink claim dump path dereferences claim->backbone_gw->orig and
takes claim->backbone_gw->crc_lock without pinning the underlying
backbone gateway. batadv_bla_check_claim() still has the same naked
pointer access pattern.

Reuse batadv_bla_claim_get_backbone_gw() in both readers so they operate
on a stable gateway reference until the read-side work is complete.
This keeps the dump and claim-check paths aligned with the lifetime
rules introduced for the other BLA claim readers.

Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code")
Fixes: 04f3f5bf1883 ("batman-adv: add B.A.T.M.A.N. Dump BLA claims via netlink")
Cc: stable@vger.kernel.org
Reported-by: Yifan Wu 
Reported-by: Juefei Pu 
Co-developed-by: Yuan Tan 
Signed-off-by: Yuan Tan 
Suggested-by: Xin Liu 
Signed-off-by: Haoze Xie 
Signed-off-by: Ao Zhou 
Signed-off-by: Sven Eckelmann 
Signed-off-by: Simon Wunderlich

batman-adv: reject oversized global TT response buffers

2026-04-02T15:32:55+00:00

batadv_tt_prepare_tvlv_global_data() builds the allocation length for a
global TT response in 16-bit temporaries. When a remote originator
advertises a large enough global TT, the TT payload length plus the VLAN
header offset can exceed 65535 and wrap before kmalloc().

The full-table response path still uses the original TT payload length when
it fills tt_change, so the wrapped allocation is too small and
batadv_tt_prepare_tvlv_global_data() writes past the end of the heap object
before the later packet-size check runs.

Fix this by rejecting TT responses whose TVLV value length cannot fit in
the 16-bit TVLV payload length field.

Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific")
Cc: stable@vger.kernel.org
Reported-by: Yifan Wu 
Reported-by: Juefei Pu 
Co-developed-by: Yuan Tan 
Signed-off-by: Yuan Tan 
Suggested-by: Xin Liu 
Tested-by: Ren Wei 
Signed-off-by: Ruide Cao 
Signed-off-by: Ren Wei 
Signed-off-by: Sven Eckelmann 
Signed-off-by: Simon Wunderlich

Merge tag 'batadv-net-pullrequest-20260317' of https://git.open-mesh.org/linux-merge

2026-03-19T00:41:00+00:00

Simon Wunderlich says:

====================
Here is a batman-adv bugfix:

- avoid OGM aggregation when skb tailroom is insufficient, by Yang Yang

* tag 'batadv-net-pullrequest-20260317' of https://git.open-mesh.org/linux-merge:
  batman-adv: avoid OGM aggregation when skb tailroom is insufficient
====================

Link: https://patch.msgid.link/20260317160002.1869478-1-sw@simonwunderlich.de
Signed-off-by: Jakub Kicinski

batman-adv: avoid OGM aggregation when skb tailroom is insufficient

2026-03-14T07:29:47+00:00

When OGM aggregation state is toggled at runtime, an existing forwarded
packet may have been allocated with only packet_len bytes, while a later
packet can still be selected for aggregation. Appending in this case can
hit skb_put overflow conditions.

Reject aggregation when the target skb tailroom cannot accommodate the new
packet. The caller then falls back to creating a new forward packet
instead of appending.

Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Cc: stable@vger.kernel.org
Reported-by: Yifan Wu 
Reported-by: Juefei Pu 
Signed-off-by: Yuan Tan 
Signed-off-by: Xin Liu 
Signed-off-by: Ao Zhou 
Signed-off-by: Yang Yang 
Signed-off-by: Sven Eckelmann 
Signed-off-by: Simon Wunderlich

Merge tag 'batadv-net-pullrequest-20260225' of https://git.open-mesh.org/linux-merge

2026-02-27T03:15:09+00:00

Simon Wunderlich says:

====================
Here is a batman-adv bugfix:

 - Avoid double-rtnl_lock ELP metric worker, by Sven Eckelmann

* tag 'batadv-net-pullrequest-20260225' of https://git.open-mesh.org/linux-merge:
  batman-adv: Avoid double-rtnl_lock ELP metric worker
====================

Link: https://patch.msgid.link/20260225084614.229077-1-sw@simonwunderlich.de
Signed-off-by: Jakub Kicinski

batman-adv: Avoid double-rtnl_lock ELP metric worker

2026-02-21T12:01:55+00:00

batadv_v_elp_get_throughput() might be called when the RTNL lock is already
held. This could be problematic when the work queue item is cancelled via
cancel_delayed_work_sync() in batadv_v_elp_iface_disable(). In this case,
an rtnl_lock() would cause a deadlock.

To avoid this, rtnl_trylock() was used in this function to skip the
retrieval of the ethtool information in case the RTNL lock was already
held.

But for cfg80211 interfaces, batadv_get_real_netdev() was called - which
also uses rtnl_lock(). The approach for __ethtool_get_link_ksettings() must
also be used instead and the lockless version __batadv_get_real_netdev()
has to be called.

Cc: stable@vger.kernel.org
Fixes: 8c8ecc98f5c6 ("batman-adv: Drop unmanaged ELP metric worker")
Reported-by: Christian Schmidbauer 
Signed-off-by: Sven Eckelmann 
Tested-by: Sören Skaarup 
Signed-off-by: Simon Wunderlich

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from
scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to
avoid scalar types (which need careful case-by-case checking), and
instead replace kmalloc-family calls that allocate struct or union
object instances:

Single allocations:	kmalloc(sizeof(TYPE), ...)
are replaced with:	kmalloc_obj(TYPE, ...)

Array allocations:	kmalloc_array(COUNT, sizeof(TYPE), ...)
are replaced with:	kmalloc_objs(TYPE, COUNT, ...)

Flex array allocations:	kmalloc(struct_size(PTR, FAM, COUNT), ...)
are replaced with:	kmalloc_flex(*PTR, FAM, COUNT, ...)

(where TYPE may also be *VAR)

The resulting allocations no longer return "void *", instead returning
"TYPE *".

Signed-off-by: Kees Cook

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2025-10-31T13:46:03+00:00

Cross-merge networking fixes after downstream PR (net-6.18-rc4).

No conflicts, adjacent changes:

drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
  ded9813d17d3 ("net: stmmac: Consider Tx VLAN offload tag length for maxSDU")
  26ab9830beab ("net: stmmac: replace has_xxxx with core_type")

Signed-off-by: Jakub Kicinski

Merge tag 'batadv-net-pullrequest-20251024' of https://git.open-mesh.org/linux-merge

2025-10-28T01:00:54+00:00

Simon Wunderlich says:

====================
Here is a batman-adv bugfix:

 - release references to inactive interfaces, by Sven Eckelmann

* tag 'batadv-net-pullrequest-20251024' of https://git.open-mesh.org/linux-merge:
  batman-adv: Release references to inactive interfaces
====================

Link: https://patch.msgid.link/20251024091150.231141-1-sw@simonwunderlich.de
Signed-off-by: Jakub Kicinski