Hi,
just looked through some ICMP code in icmp_socket.c and found a little bit
weird TTL:
218 if (icmp_packet->version != COMPAT_VERSION) {
219 icmp_packet->msg_type = PARAMETER_PROBLEM;
220 icmp_packet->ttl = COMPAT_VERSION;
221 bat_socket_add_packet(socket_client, icmp_packet,
packet_len);
222 goto free_skb;
223 }
It was introduced by dba95eb270ff9674326865a20d25921c69c04d6c. My guess is
that TTL should be used.
Kind regards,
Sven
Hi David,
we have 3 more bugfixes for you which we would like to see getting
merged into net-next/linux-3.2. They fix refcounting, a crash on
module unload and a protocol handling bug.
Thanks,
Marek
The following changes since commit 9d8523931f7f5eb8900077f0da0fbe6b8ad0010b:
batman-adv: correctly set the data field in the TT_REPONSE packet (2011-10-18 22:45:10 +0200)
are available in the git repository at:
git://git.open-mesh.org/linux-merge.git batman-adv/maint
Antonio Quartulli (1):
batman-adv: unify hash_entry field position in tt_local/global_entry
Simon Wunderlich (2):
batman-adv: remove references for global tt entries
batman-adv: add sanity check when removing global tts
net/batman-adv/translation-table.c | 17 ++++++++++++++++-
net/batman-adv/types.h | 4 ++--
2 files changed, 18 insertions(+), 3 deletions(-)
Currently the counter of tt_local_entry structures (tt_local_num) is incremented
each time the tt_local_reset_flags() is invoked causing the node to send wrong
TT_REPONSE packets containing a copy of non-initialised memory thus corrupting
other nodes global translation table and making higher level communication
impossible.
Reported-by: Junkeun Song <jun361(a)gmail.com>
Signed-off-by: Antonio Quartulli <ordex(a)autistici.org>
Acked-by: Junkeun Song <jun361(a)gmail.com>
Signed-off-by: Marek Lindner <lindner_marek(a)yahoo.de>
---
David S. Miller already merged this patch as
31901264511cf20c5ed33b8649a3ca9ce28df60b in his net-next tree
net/batman-adv/translation-table.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index fb6931d..f599db9 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -1668,6 +1668,8 @@ static void tt_local_reset_flags(struct bat_priv *bat_priv, uint16_t flags)
rcu_read_lock();
hlist_for_each_entry_rcu(tt_local_entry, node,
head, hash_entry) {
+ if (!(tt_local_entry->flags & flags))
+ continue;
tt_local_entry->flags &= ~flags;
atomic_inc(&bat_priv->num_local_tt);
}
--
1.7.3.4
The TT_RESPONSE skb has to be linearised only if the node plans to access the
packet payload (so only if the message is directed to that node). In all the
other cases the node can avoid this memory operation
Signed-off-by: Antonio Quartulli <ordex(a)autistici.org>
---
routing.c | 11 ++++++-----
1 files changed, 6 insertions(+), 5 deletions(-)
diff --git a/routing.c b/routing.c
index 60ce407..e0e7b7b 100644
--- a/routing.c
+++ b/routing.c
@@ -616,13 +616,14 @@ int recv_tt_query(struct sk_buff *skb, struct hard_iface *recv_if)
}
break;
case TT_RESPONSE:
- /* packet needs to be linearized to access the TT changes */
- if (skb_linearize(skb) < 0)
- goto out;
+ if (is_my_mac(tt_query->dst)) {
+ /* packet needs to be linearized to access the TT
+ * changes */
+ if (skb_linearize(skb) < 0)
+ goto out;
- if (is_my_mac(tt_query->dst))
handle_tt_response(bat_priv, tt_query);
- else {
+ } else {
bat_dbg(DBG_TT, bat_priv,
"Routing TT_RESPONSE to %pM [%c]\n",
tt_query->dst,
--
1.7.3.4
Function tt_response_fill_table() actually uses a tt_local_entry pointer to
iterate either over the local or the global table entries (it depends on the
what hash table is passed as argument). To iterate over such entries the
hlist_for_each_entry_rcu() macro has to access their "hash_entry" field which
MUST be at the same position in both the tt_global/local_entry structures.
Reported-by: Simon Wunderlich <siwu(a)hrz.tu-chemnitz.de>
Signed-off-by: Antonio Quartulli <ordex(a)autistici.org>
---
types.h | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/types.h b/types.h
index 1ae3557..ab8d0fe 100644
--- a/types.h
+++ b/types.h
@@ -224,22 +224,22 @@ struct socket_packet {
struct tt_local_entry {
uint8_t addr[ETH_ALEN];
+ struct hlist_node hash_entry;
unsigned long last_seen;
uint16_t flags;
atomic_t refcount;
struct rcu_head rcu;
- struct hlist_node hash_entry;
};
struct tt_global_entry {
uint8_t addr[ETH_ALEN];
+ struct hlist_node hash_entry; /* entry in the global table */
struct orig_node *orig_node;
uint8_t ttvn;
uint16_t flags; /* only TT_GLOBAL_ROAM is used */
unsigned long roam_at; /* time at which TT_GLOBAL_ROAM was set */
atomic_t refcount;
struct rcu_head rcu;
- struct hlist_node hash_entry; /* entry in the global table */
};
struct tt_change_node {
--
1.7.3.4
After removing the batman-adv module, the hash may be already gone
when tt_global_del_orig() tries to clean the hash. This patch adds
a sanity check to avoid this.
Signed-off-by: Simon Wunderlich <siwu(a)hrz.tu-chemnitz.de>
---
translation-table.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/translation-table.c b/translation-table.c
index c2af2b1..ffa846c 100644
--- a/translation-table.c
+++ b/translation-table.c
@@ -712,6 +712,9 @@ void tt_global_del_orig(struct bat_priv *bat_priv,
struct hlist_head *head;
spinlock_t *list_lock; /* protects write access to the hash lists */
+ if (!hash)
+ return;
+
for (i = 0; i < hash->size; i++) {
head = &hash->table[i];
list_lock = &hash->list_locks[i];
--
1.7.7