Project

General

Profile

Actions

Bug #470

open

bat_v: potential throughput overflow in batadv_v_neigh_cmp

Added by Sven Eckelmann 12 days ago.

Status:
New
Priority:
Normal
Target version:
-
Start date:
09/01/2026
Due date:
% Done:

0%

Estimated time:

Description

https://sashiko.dev/#/patchset/20260831135117.574836-1-sw%40simonwunderlich.de?part=3

This isn't a bug introduced by this patch, but does the throughput comparison
in batadv_v_neigh_cmp() overflow?

In batadv_v_neigh_cmp(), we have:

ret = ifinfo1->bat_v.throughput - ifinfo2->bat_v.throughput;

If an interface is provisioned with a throughput override via netlink that
exceeds the signed 32-bit maximum (2,147,483,647), subtracting a low or zero
throughput interface from it causes this unsigned subtraction to overflow.

The result is implicitly cast to a signed 32-bit integer, turning it negative.

Will returning a negative value here incorrectly signal to callers that the
optimal high-throughput path is worse, causing the mesh routing to prefer
suboptimal or zero-throughput paths instead?

No data to display

Actions

Also available in: Atom PDF