Merge tag 'batadv-net-pullrequest-20250901' of https://git.open-mesh.org/linux-merge

Simon Wunderlich says:

====================
Here is a batman-adv bugfix:

 - fix OOB read/write in network-coding decode, by Stanislav Fort

* tag 'batadv-net-pullrequest-20250901' of https://git.open-mesh.org/linux-merge:
  batman-adv: fix OOB read/write in network-coding decode
====================

Link: https://patch.msgid.link/
Signed-off-by: Jakub Kicinski <[email protected]>

Author: kuba-moo

net/batman-adv/network-coding.c

@@ -1687,7 +1687,12 @@ batadv_nc_skb_decode_packet(struct batadv_priv *bat_priv, struct sk_buff *skb,
 
 	coding_len = ntohs(coded_packet_tmp.coded_len);
 
-	if (coding_len > skb->len)
+	/* ensure dst buffer is large enough (payload only) */
+	if (coding_len + h_size > skb->len)
+		return NULL;
+
+	/* ensure src buffer is large enough (payload only) */
+	if (coding_len + h_size > nc_packet->skb->len)
 		return NULL;
 
 	/* Here the magic is reversed: