Open-Mesh » batman-adv

If you send a mcast packet and add multiple trackers TVLVs, it is possible to create a packet storm because the TVLVs are processed independently. batadv_mcast_forw_packet goes through the currently selected tracker TVLV container and tries to send packets to the destination while only removing the destinations from the current tracker TVLV container. But the second, third, .... containers are untouched. But these containers will then processed next by batadv_tvlv_containers_process and also used for forwarding in batadv_mcast_forw_packet

For a scenario with two tracker TVLVs, it would therefore be possible easily duplicate the number the packets a destination are reached. The receiver will then for the first packet also duplicate the destinations + also send out a packets for all destinations in the second tracker TVLV. For 1:1 copies of the tracker with exactly one destination per hop:

• First hop: 1 packet with scrubbed first TVLV container and vanilla second TVLV container, 1 packet with scrubbed second container and scrubbed first container
• second hop: receives two packets:
  • 1. packet with first scrubbed TVLV: two packets: 1 packet with scrubbed first TVLV container and vanilla second TVLV container, 1 packet with scrubbed second container and scrubbed first container
  • 2. packet with second scrubbed TVLV: 1 packet with scrubbed first TVLV container and vanilla second TVLV container, 1 packet with scrubbed second container and scrubbed first container
• third hop: receives 4 packets
  • ...

You can increase the problem by adding more TVLV containers. I didn't invest time thinking about the consequences of the unscrubbed second TVLV container - I think you would then also send the packet back from the third hop to the second hop - but I might be wrong.