B.A.T.M.A.N February 2011

b.a.t.m.a.n@lists.open-mesh.org

20 participants
28 discussions

[B.A.T.M.A.N.] [PATCH] batman-adv: Fix possible buffer overflow in softif neigh list output

by Linus Lüssing

When printing the soft interface table the number of entries in the softif neigh list are first being counted and a fitting buffer allocated. After that the softif neigh list gets locked again and the buffer printed - which has the following two issues: For one thing, the softif neigh list might have grown when reacquiring the rcu lock, which results in writing outside of the allocated buffer. For another, only 30 Bytes per soft interface neighbor are allocated, but up to 31 Bytes get copied into the buffer which leads to a buffer overflow again if the vid needs more than one digit. Furthermore 31 Bytes are not enough for printing an entry with a vid of more than 2 digits. The manual buffering is unnecessary, we can safely print to the seq directly during the rcu_read_lock(). Signed-off-by: Linus Lüssing <linus.luessing(a)ascom.ch> --- soft-interface.c | 22 +--------------------- 1 files changed, 1 insertions(+), 21 deletions(-) diff --git a/soft-interface.c b/soft-interface.c index bd8b539..e543d09 100644 --- a/soft-interface.c +++ b/soft-interface.c @@ -173,8 +173,6 @@ int softif_neigh_seq_print_text(struct seq_file *seq, void *offset) struct bat_priv *bat_priv = netdev_priv(net_dev); struct softif_neigh *softif_neigh; struct hlist_node *node; - size_t buf_size, pos; - char *buff; if (!bat_priv->primary_if) { return seq_printf(seq, "BATMAN mesh %s disabled - " @@ -184,33 +182,15 @@ int softif_neigh_seq_print_text(struct seq_file *seq, void *offset) seq_printf(seq, "Softif neighbor list (%s)\n", net_dev->name); - buf_size = 1; - /* Estimate length for: " xx:xx:xx:xx:xx:xx\n" */ rcu_read_lock(); hlist_for_each_entry_rcu(softif_neigh, node, &bat_priv->softif_neigh_list, list) - buf_size += 30; - rcu_read_unlock(); - - buff = kmalloc(buf_size, GFP_ATOMIC); - if (!buff) - return -ENOMEM; - - buff[0] = '\0'; - pos = 0; - - rcu_read_lock(); - hlist_for_each_entry_rcu(softif_neigh, node, - &bat_priv->softif_neigh_list, list) { - pos += snprintf(buff + pos, 31, "%s %pM (vid: %d)\n", + seq_printf(seq, "%s %pM (vid: %d)\n", bat_priv->softif_neigh == softif_neigh ? "=>" : " ", softif_neigh->addr, softif_neigh->vid); - } rcu_read_unlock(); - seq_printf(seq, "%s", buff); - kfree(buff); return 0; } -- 1.7.2.3

12 years, 1 month

[B.A.T.M.A.N.] HNAs Announcements and Roaming management v2]

by Antonio Quartulli

Hello to everyone, This is the second version of the HNAs announcement mechanism/Roaming management paper. Please, consider it still a draft. A lot of things have changed since the previous version of this paper. As usual, feel free to comment it. I'll wait for your feedback :) Link: http://www.open-mesh.org/attachment/wiki/hna-improvements/handover.pdf Ragards, -- Antonio Quartulli ..each of us alone is worth nothing.. Ernesto "Che" Guevara

12 years, 1 month

[B.A.T.M.A.N.] Redundancy bonding mode patches, v1

by Linus Lüssing

Hi everyone, The following patches add a redundancy bonding mode to batman-adv: In case of multiple interfaces available towards a next hop node, instead of sending packets in interface alternating or round robin bonding fashion, packets get send redundantly on all available interfaces available for bonding. This mode increases the packet delivery ratio of unicast data transfers for the cost of throughput in multi interface mesh networks and is therefore aimed at high reliability mesh networks. It is especially useful if the main source of packet loss is not always reliably detectable by batman-adv's broadcast PDR measurements (i.e. bursty periods of interference on a single channel, which gets averaged out due to the windowing; different unicast bitrate; ...). Or if a fault tolerant packet forwarding scheme which is able to tolerate a sudden link failure with no impact on the user experience is required. The first eight patches are mainly some restructuring of the unicast sending code paths. Patches nine to 13 add the actual redandancy bonding mode. Please note, that this redundancy bonding mode is not yet compatible with batman-adv's link layer fragmentation feature. Cheers, Linus

12 years, 1 month

[B.A.T.M.A.N.] [PATCH][trivial] Batman: Remove two duplicate includes.

by Jesper Juhl

Remove duplicate inclusion of "send.h" and "routing.h" from net/batman-adv/soft-interface.c Patch is against linux-next as of today. Signed-off-by: Jesper Juhl <jj(a)chaosbits.net> --- soft-interface.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c index bd088f8..7e37077 100644 --- a/net/batman-adv/soft-interface.c +++ b/net/batman-adv/soft-interface.c @@ -29,14 +29,12 @@ #include "hash.h" #include "gateway_common.h" #include "gateway_client.h" -#include "send.h" #include "bat_sysfs.h" #include <linux/slab.h> #include <linux/ethtool.h> #include <linux/etherdevice.h> #include <linux/if_vlan.h> #include "unicast.h" -#include "routing.h" static int bat_get_settings(struct net_device *dev, struct ethtool_cmd *cmd); -- Jesper Juhl <jj(a)chaosbits.net> http://www.chaosbits.net/ Plain text mails only, please. Don't top-post http://www.catb.org/~esr/jargon/html/T/top-post.html

12 years, 1 month

[B.A.T.M.A.N.] [PATCH] batman-adv: else should follow close brace '}'

by Sven Eckelmann

Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- batman-adv/gateway_client.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/batman-adv/gateway_client.c b/batman-adv/gateway_client.c index 3486854..41eba8a 100644 --- a/batman-adv/gateway_client.c +++ b/batman-adv/gateway_client.c @@ -123,8 +123,7 @@ void gw_election(struct bat_priv *bat_priv) "Removing selected gateway - " "no gateway in range\n"); gw_deselect(bat_priv); - } - else + } else rcu_read_unlock(); return; -- 1.7.2.3

12 years, 1 month

[B.A.T.M.A.N.] Reordered rcu refcounting

by Sven Eckelmann

Hi, I told Linus and Marek that the implementation of some datastructures using reference counting and RCUs must be redesigned. The problem is that call_rcu should only be used when the reference count is zero because multiple call_rcu cannot be initiated at the same time. The next problem is that we may try to access an element with the refcount 0 when we try to traverse a rcu protected list. This problem cannot be solved by kref - thus we have to use atomic_t again to _not_ increase the reference count when it was already zero. Marek asked me what we must change - I try to summarize those things in the following patches. They aren't tested and should only be seen as suggestions what must be done to finish the "remove orig_hash lock"-patches. If you try these patches then please keep in mind that they will sell your soul to the next confectioner (for some cookies or a pie). More information can be found inside Documentation/RCU/rcuref.txt Btw, maybe I've found a bug inside the find_router with enabled bonding (see "BUG" in patch 4). Best regards, Sven

12 years, 1 month

[B.A.T.M.A.N.] pull request: batman-adv 2011-02-12

by Sven Eckelmann

Hi, I would like propose following changes for net-next-2.6.git. Two of them are minor code style changes and the other two change minor issues in the routing/fragmentation code. thanks, Sven The following changes since commit 091b948306d2628320e77977eb7ae4a757b12180: batman-adv: Merge README of v2011.0.0 release (2011-01-31 14:57:13 +0100) are available in the git repository at: git://git.open-mesh.org/ecsv/linux-merge.git batman-adv/next Linus Lüssing (2): batman-adv: Remove duplicate types.h inclusions batman-adv: Disallow originator addressing within mesh layer Marek Lindner (1): batman-adv: Split combined variable declarations Sven Eckelmann (1): batman-adv: Use successive sequence numbers for fragments net/batman-adv/icmp_socket.c | 1 - net/batman-adv/icmp_socket.h | 2 -- net/batman-adv/main.c | 1 - net/batman-adv/routing.c | 1 - net/batman-adv/routing.h | 2 -- net/batman-adv/send.c | 1 - net/batman-adv/send.h | 2 -- net/batman-adv/soft-interface.c | 1 - net/batman-adv/translation-table.c | 1 - net/batman-adv/translation-table.h | 2 -- net/batman-adv/unicast.c | 19 +++++++------------ 11 files changed, 7 insertions(+), 26 deletions(-)

12 years, 1 month

[B.A.T.M.A.N.] [PATCH] batman-adv: Use successive sequence numbers for fragments

by Sven Eckelmann

The two fragments of an unicast packet must have successive sequence numbers to allow the receiver side to detect matching fragments and merge them again. The current implementation doesn't provide that property because a sequence of two atomic_inc_return may be interleaved with another sequence which also changes the variable. The access to the fragment sequence number pool has either to be protected by correct locking or the access to the pool has to reserve two sequence numbers in a single access. The latter one can easily be done by increasing the value of the last used sequence number by 2 in a single access. The generated window of two currently unused sequence numbers can now be scattered across the two fragments. Reported-by: Linus Lüssing <linus.luessing(a)web.de> Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- batman-adv/unicast.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git a/batman-adv/unicast.c b/batman-adv/unicast.c index db62b66..29ad9b8 100644 --- a/batman-adv/unicast.c +++ b/batman-adv/unicast.c @@ -237,6 +237,7 @@ int frag_send_skb(struct sk_buff *skb, struct bat_priv *bat_priv, int ucf_hdr_len = sizeof(struct unicast_frag_packet); int data_len = skb->len - uc_hdr_len; int large_tail = 0; + uint16_t seqno; if (!bat_priv->primary_if) goto dropped; @@ -272,10 +273,9 @@ int frag_send_skb(struct sk_buff *skb, struct bat_priv *bat_priv, frag1->flags = UNI_FRAG_HEAD | large_tail; frag2->flags = large_tail; - frag1->seqno = htons((uint16_t)atomic_inc_return( - &batman_if->frag_seqno)); - frag2->seqno = htons((uint16_t)atomic_inc_return( - &batman_if->frag_seqno)); + seqno = atomic_add_return(2, &batman_if->frag_seqno); + frag1->seqno = htons(seqno - 1); + frag2->seqno = htons(seqno); send_skb_packet(skb, batman_if, dstaddr); send_skb_packet(frag_skb, batman_if, dstaddr); -- 1.7.2.3

12 years, 1 month

[B.A.T.M.A.N.] Connecting through Batman advanced interface

by Clemens John

Hi, I have a special question on confgurating our batman advanced setup. We have a Tinc VPN on tap0, and behind this VPN is a dhcp server and an internet gateway which is reachable trough the ip 10.18.0.1. On the router I have ath1, an adhoc wlan device, on which batman advanced is sending packagets. Now bat0 and tap0 are brindged to br-mesh. Like you can see in the configuration: root@Floh:~# cat /etc/config/network [...] config 'interface' 'mesh' option 'type' 'bridge' option 'ifname' 'bat0 tap0' option 'stp' '1' [...] root@Floh:~# cat /etc/config/batman-adv config 'mesh' 'bat0' option 'interfaces' 'ath1' option 'orig_interval' option 'log_level' [batman] [client]-->[adhoc ath1]-->[bat0][br-mesh][tap0]-->internet-->[gateway/dhcp] Other nodes running the same configuration but not connecting trought vpn can connect to the dhcp server through batman advanced and the adhoc device. If a client (laptop) without batman advanced tries to connect, it has no success because it does not get an I address. What can I do? I can not open a second wifi device in ap mode and add it to mesh. I know that this would be the best way but I´m trying this on an wrt54g and the b43 driver does not support multi essid. Regards Clemens

12 years, 1 month

[B.A.T.M.A.N.] [PATCH] batman-adv: Split combined variable declarations

by Sven Eckelmann

Multiple variable declarations in a single statements over multiple lines can be split into multiple variable declarations without changing the actual behavior. Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- batman-adv/unicast.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/batman-adv/unicast.c b/batman-adv/unicast.c index 52b52e3..db62b66 100644 --- a/batman-adv/unicast.c +++ b/batman-adv/unicast.c @@ -39,8 +39,8 @@ static struct sk_buff *frag_merge_packet(struct list_head *head, (struct unicast_frag_packet *)skb->data; struct sk_buff *tmp_skb; struct unicast_packet *unicast_packet; - int hdr_len = sizeof(struct unicast_packet), - uni_diff = sizeof(struct unicast_frag_packet) - hdr_len; + int hdr_len = sizeof(struct unicast_packet); + int uni_diff = sizeof(struct unicast_frag_packet) - hdr_len; /* set skb to the first part and tmp_skb to the second part */ if (up->flags & UNI_FRAG_HEAD) { -- 1.7.2.3

12 years, 1 month

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

B.A.T.M.A.N February 2011