FuzzingLabs fuzzed batman-adv, the Linux kernel’s mesh networking module, and found three bugs. The fix for one of them was merged into the Linux mainline.12
Method
The researchers used Syzkaller with a custom grammar targeting batman-adv’s packet receive path. Syzbot, Google’s continuous kernel fuzzer, had 0% coverage of routing.c, the file that handles it.1
Findings
- An integer overflow in OGM fragmentation, caused by a signed 16-bit buffer position. Fixed in commit
0799e594. - A use-after-free in the throughput meter, already known.
- A size truncation in the translation table TVLV handler.12