Skip to content

Commit 5ffd4dd

Browse files
committed
batman-adv: tt: replace open-coded overflow check with helper
The commit 6043a632dd06 ("batman-adv: reject oversized global TT response buffers") introduced an open-coded check to ensure that the allocated buffer size can be stored in a u16. The check_add_overflow() helper can perform the addition and overflow check in one step, so use that instead. Acked-by: Antonio Quartulli <antonio@mandelbit.com> Signed-off-by: Sven Eckelmann <sven@narfation.org>
1 parent 4dd2055 commit 5ffd4dd

1 file changed

Lines changed: 2 additions & 5 deletions

File tree

net/batman-adv/translation-table.c

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -799,10 +799,10 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node,
799799
{
800800
u16 num_vlan = 0;
801801
u16 tvlv_len = 0;
802-
unsigned int change_offset;
803802
struct batadv_tvlv_tt_vlan_data *tt_vlan;
804803
struct batadv_orig_node_vlan *vlan;
805804
u16 total_entries = 0;
805+
size_t change_offset;
806806
u8 *tt_change_ptr;
807807
int vlan_entries;
808808
u16 sum_entries;
@@ -826,14 +826,11 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node,
826826
if (*tt_len < 0)
827827
*tt_len = batadv_tt_len(total_entries);
828828

829-
if (change_offset > U16_MAX || *tt_len > U16_MAX - change_offset) {
829+
if (check_add_overflow(*tt_len, change_offset, &tvlv_len)) {
830830
*tt_len = 0;
831831
goto out;
832832
}
833833

834-
tvlv_len = *tt_len;
835-
tvlv_len += change_offset;
836-
837834
*tt_data = kmalloc(tvlv_len, GFP_ATOMIC);
838835
if (!*tt_data) {
839836
*tt_len = 0;

0 commit comments

Comments
 (0)