Open-Mesh » batman-adv

Doe batadv_tp_handle_out_of_order() lack a size limit on the out-of-order packet queue?

Looking at batadv_tp_handle_out_of_order():

        new = kmalloc_obj(*new, GFP_ATOMIC);
        if (unlikely(!new))
                return false;
[ ... ]
        spin_lock_bh(&tp_vars->unacked_lock);
        /* if the list is empty immediately attach this new object */
        if (list_empty(&tp_vars->unacked_list)) {
                list_add(&new->list, &tp_vars->unacked_list);
                goto out;
        }

Because new batadv_tp_unacked nodes are unconditionally allocated and queued into unacked_list without checking any receive window limits, could a remote attacker establish a session and flood the node with future sequence numbers?

Since batadv_tp_recv_msg() resets the inactivity timer for any matching packet, this could lead to unbounded memory allocation and an out-of-memory panic.

See https://sashiko.dev/#/patchset/20260531-tp-reason-missing-v4-0-5d2556e00128%40narfation.org?part=2 for details