Bug #470
openbat_v: potential throughput overflow in batadv_v_neigh_cmp
0%
Description
https://sashiko.dev/#/patchset/20260831135117.574836-1-sw%40simonwunderlich.de?part=3
This isn't a bug introduced by this patch, but does the throughput comparison
in batadv_v_neigh_cmp() overflow?In batadv_v_neigh_cmp(), we have:
ret = ifinfo1->bat_v.throughput - ifinfo2->bat_v.throughput;
If an interface is provisioned with a throughput override via netlink that
exceeds the signed 32-bit maximum (2,147,483,647), subtracting a low or zero
throughput interface from it causes this unsigned subtraction to overflow.The result is implicitly cast to a signed 32-bit integer, turning it negative.
Will returning a negative value here incorrectly signal to callers that the
optimal high-throughput path is worse, causing the mesh routing to prefer
suboptimal or zero-throughput paths instead?
No data to display