[24.10] batman-adv: merge bugfixes from 2026.2

[ecsv]

Maintainer: @simonwunderlich
Compile tested: x86-64
Run tested: x86-64

Description:

batman-adv

• fix integer overflow on buff_pos
• reject new tp_meter sessions during teardown
• stop tp_meter sessions during mesh teardown
• tp_meter: add missing completion header
• stop caching unowned originator pointers in BAT IV
• iv: avoid bonding logic for outgoing OGM
• tp_meter: fix tp_num leak on kmalloc failure
• bla: prevent use-after-free when deleting claims
• bla: only purge non-released claims
• bla: put backbone reference on failed claim hash insert
• tt: reject oversized local TVLV buffers
• tt: fix negative tt_buff_len
• tt: fix negative last_changeset_len
• tt: fix TOCTOU race for reported vlans
• tt: avoid empty VLAN responses
• tt: prevent TVLV entry number overflow
• tp_meter: fix tp_vars reference leak in receiver shutdown
• fix tp_meter counter underflow during shutdown
• fix fragment reassembly length accounting
• clear current gateway during teardown
• dat: handle forward allocation error
• tp_meter: avoid use of uninit sender vars
• frag: disallow unicast fragment in fragment
• tp_meter: directly shut down timer on cleanup
• fix batadv_skb_is_frag() kernel-doc
• v: stop OGMv2 on disabled interface
• tvlv: abort OGM send on tvlv append failure
• tvlv: reject oversized TVLV packets
• tp_meter: fix race condition in send error reporting
• tp_meter: avoid role confusion in tp_list
• mcast: fix use-after-free in orig_node RCU release
• iv: recover OGM scheduling after forward packet error
• bla: fix report_work leak on backbone_gw purge
• bla: avoid double decrement of bla.num_requests
• bla: avoid NULL-ptr deref for claim via dropped interface
• tp_meter: keep unacked list in ascending ordered
• tp_meter: initialize dup_acks explicitly
• tp_meter: initialize dec_cwnd explicitly
• tp_meter: avoid window underflow
• tp_meter: avoid divide-by-zero for dec_cwnd
• tp_meter: fix fast recovery precondition
• tp_meter: handle seqno wrap-around for fast recovery detection
• tp_meter: add only finished tp_vars to lists
• bla: annotate lasttime access with READ/WRITE_ONCE
• prevent ELP transmission interval underflow
• tp_meter: initialize last_recv_time during init