From: Sven Eckelmann The commit 6043a632dd06 ("batman-adv: reject oversized global TT response buffers") introduced an open-coded check to ensure that the allocated buffer size can be stored in a u16. The check_add_overflow() helper can perform the addition and overflow check in one step, so use that instead. Acked-by: Antonio Quartulli Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich --- net/batman-adv/translation-table.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index 8903b2f84f512..5e134d08a80fd 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -799,10 +799,10 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node, { u16 num_vlan = 0; u16 tvlv_len = 0; - unsigned int change_offset; struct batadv_tvlv_tt_vlan_data *tt_vlan; struct batadv_orig_node_vlan *vlan; u16 total_entries = 0; + size_t change_offset; u8 *tt_change_ptr; int vlan_entries; u16 sum_entries; @@ -826,14 +826,11 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node, if (*tt_len < 0) *tt_len = batadv_tt_len(total_entries); - if (change_offset > U16_MAX || *tt_len > U16_MAX - change_offset) { + if (check_add_overflow(*tt_len, change_offset, &tvlv_len)) { *tt_len = 0; goto out; } - tvlv_len = *tt_len; - tvlv_len += change_offset; - *tt_data = kmalloc(tvlv_len, GFP_ATOMIC); if (!*tt_data) { *tt_len = 0; -- 2.47.3