B.A.T.M.A.N November 2015

b.a.t.m.a.n@lists.open-mesh.org

18 participants
45 discussions

[B.A.T.M.A.N.] [PATCH] batman-adv: use batadv_compare_eth when possible
by Antonio Quartulli 10 Mar '16

10 Mar '16

When comparing Ethernet address it is better to use the more generic batadv_compare_eth. The latter is also optimised for architectures having a fast unaligned access. Signed-off-by: Antonio Quartulli <antonio(a)meshcoding.com> --- network-coding.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/network-coding.c b/network-coding.c index f1b604d..0049e7a 100644 --- a/network-coding.c +++ b/network-coding.c @@ -481,12 +481,10 @@ static int batadv_nc_hash_compare(const struct hlist_node *node, nc_path2 = data2; /* Return 1 if the two keys are identical */ - if (memcmp(nc_path1->prev_hop, nc_path2->prev_hop, - sizeof(nc_path1->prev_hop)) != 0) + if (!batadv_compare_eth(nc_path1->prev_hop, nc_path2->prev_hop)) return 0; - if (memcmp(nc_path1->next_hop, nc_path2->next_hop, - sizeof(nc_path1->next_hop)) != 0) + if (!batadv_compare_eth(nc_path1->next_hop, nc_path2->next_hop)) return 0; return 1; -- 1.8.5.2

2 2

[B.A.T.M.A.N.] [PATCH] batman-adv: fix debuginfo macro style issue
by Simon Wunderlich 10 Mar '16

10 Mar '16

From: Simon Wunderlich <simon(a)open-mesh.com> Structure initialization within the macros should follow the general coding style used in the kernel: put the initialization of the first variable and the closing brace on a separate line. Reported-by: Antonio Quartulli <antonio(a)meshcoding.com> Signed-off-by: Simon Wunderlich <simon(a)open-mesh.com> --- debugfs.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/debugfs.c b/debugfs.c index cd5d24a..92d9d83 100644 --- a/debugfs.c +++ b/debugfs.c @@ -322,14 +322,17 @@ static int batadv_nc_nodes_open(struct inode *inode, struct file *file) #define BATADV_DEBUGINFO(_name, _mode, _open) \ struct batadv_debuginfo batadv_debuginfo_##_name = { \ - .attr = { .name = __stringify(_name), \ - .mode = _mode, }, \ - .fops = { .owner = THIS_MODULE, \ - .open = _open, \ - .read = seq_read, \ - .llseek = seq_lseek, \ - .release = single_release, \ - } \ + .attr = { \ + .name = __stringify(_name), \ + .mode = _mode, \ + }, \ + .fops = { \ + .owner = THIS_MODULE, \ + .open = _open, \ + .read = seq_read, \ + .llseek = seq_lseek, \ + .release = single_release, \ + }, \ }; /* the following attributes are general and therefore they will be directly -- 1.7.10.4

2 1

[B.A.T.M.A.N.] [PATCH next] batman-adv: fix DAT candidate selection (must use vid)
by Antonio Quartulli 10 Mar '16

10 Mar '16

Now that DAT is VLAN aware, it must use the VID when computing the DHT address of the candidate nodes where an entry is going to be stored/retrieved. Introduced by: 3e26722bc9f248ec4316749fc1957365c0fa5e4b ("batman-adv: make the Distributed ARP Table vlan aware") Signed-off-by: Antonio Quartulli <antonio(a)meshcoding.com> --- distributed-arp-table.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/distributed-arp-table.c b/distributed-arp-table.c index 6c8c393..d4b3940 100644 --- a/distributed-arp-table.c +++ b/distributed-arp-table.c @@ -530,11 +530,13 @@ static void batadv_choose_next_candidate(struct batadv_priv *bat_priv, * Returns the candidate array of size BATADV_DAT_CANDIDATE_NUM. */ static struct batadv_dat_candidate * -batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst) +batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst, + unsigned short vid) { int select; batadv_dat_addr_t last_max = BATADV_DAT_ADDR_MAX, ip_key; struct batadv_dat_candidate *res; + struct batadv_dat_entry to_hash; if (!bat_priv->orig_hash) return NULL; @@ -543,7 +545,10 @@ batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst) if (!res) return NULL; - ip_key = (batadv_dat_addr_t)batadv_hash_dat(&ip_dst, + to_hash.ip = ip_dst; + to_hash.vid = vid; + + ip_key = (batadv_dat_addr_t)batadv_hash_dat(&to_hash, BATADV_DAT_ADDR_MAX); batadv_dbg(BATADV_DBG_DAT, bat_priv, @@ -572,7 +577,7 @@ batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst) */ static bool batadv_dat_send_data(struct batadv_priv *bat_priv, struct sk_buff *skb, __be32 ip, - int packet_subtype) + unsigned short vid, int packet_subtype) { int i; bool ret = false; @@ -581,7 +586,7 @@ static bool batadv_dat_send_data(struct batadv_priv *bat_priv, struct sk_buff *tmp_skb; struct batadv_dat_candidate *cand; - cand = batadv_dat_select_candidates(bat_priv, ip); + cand = batadv_dat_select_candidates(bat_priv, ip, vid); if (!cand) goto out; @@ -969,7 +974,7 @@ bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv, ret = true; } else { /* Send the request to the DHT */ - ret = batadv_dat_send_data(bat_priv, skb, ip_dst, + ret = batadv_dat_send_data(bat_priv, skb, ip_dst, vid, BATADV_P_DAT_DHT_GET); } out: @@ -1092,8 +1097,8 @@ void batadv_dat_snoop_outgoing_arp_reply(struct batadv_priv *bat_priv, /* Send the ARP reply to the candidates for both the IP addresses that * the node obtained from the ARP reply */ - batadv_dat_send_data(bat_priv, skb, ip_src, BATADV_P_DAT_DHT_PUT); - batadv_dat_send_data(bat_priv, skb, ip_dst, BATADV_P_DAT_DHT_PUT); + batadv_dat_send_data(bat_priv, skb, ip_src, vid, BATADV_P_DAT_DHT_PUT); + batadv_dat_send_data(bat_priv, skb, ip_dst, vid, BATADV_P_DAT_DHT_PUT); } /** * batadv_dat_snoop_incoming_arp_reply - snoop the ARP reply and fill the local -- 1.8.1.5

3 2

[B.A.T.M.A.N.] [RFC] batman-adv: Remove recursive bat-on-bat netdevice check
by Sven Eckelmann 19 Jan '16

19 Jan '16

batman-adv checks in different situation if a new device is already on top of a different batman-adv device. This is done by getting the iflink of a device and all its parent. It assumes that this iflink is always a parent device in an acyclic graph. But this assumption is broken by devices like veth which are actually a pair of two devices linked to each other. The recursive check would therefore get veth0 when calling dev_get_iflink on veth1. And it gets veth0 when calling dev_get_iflink with veth1. Creating a veth pair and loading batman-adv freezes parts of the system ip link add veth0 type veth peer name veth1 modprobe batman-adv An RCU stall will be detected on the system which cannot be fixed. INFO: rcu_sched self-detected stall on CPU 1: (5264 ticks this GP) idle=3e9/140000000000001/0 softirq=144683/144686 fqs=5249 (t=5250 jiffies g=46 c=45 q=43) Task dump for CPU 1: insmod R running task 0 247 245 0x00000008 ffffffff8151f140 ffffffff8107888e ffff88000fd141c0 ffffffff8151f140 0000000000000000 ffffffff81552df0 ffffffff8107b420 0000000000000001 ffff88000e3fa700 ffffffff81540b00 ffffffff8107d667 0000000000000001 Call Trace: <IRQ> [<ffffffff8107888e>] ? rcu_dump_cpu_stacks+0x7e/0xd0 [<ffffffff8107b420>] ? rcu_check_callbacks+0x3f0/0x6b0 [<ffffffff8107d667>] ? hrtimer_run_queues+0x47/0x180 [<ffffffff8107cf9d>] ? update_process_times+0x2d/0x50 [<ffffffff810873fb>] ? tick_handle_periodic+0x1b/0x60 [<ffffffff810290ae>] ? smp_trace_apic_timer_interrupt+0x5e/0x90 [<ffffffff813bbae2>] ? apic_timer_interrupt+0x82/0x90 <EOI> [<ffffffff812c3fd7>] ? __dev_get_by_index+0x37/0x40 [<ffffffffa0031f3e>] ? batadv_hard_if_event+0xee/0x3a0 [batman_adv] [<ffffffff812c5801>] ? register_netdevice_notifier+0x81/0x1a0 [...] Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Cc: Jetmir Gigollai <jetmir_gigollaj(a)web.de> --- compat-include/linux/netdevice.h | 6 ------ net/batman-adv/hard-interface.c | 42 ---------------------------------------- 2 files changed, 48 deletions(-) diff --git a/compat-include/linux/netdevice.h b/compat-include/linux/netdevice.h index f19f624..0e4fcc8 100644 --- a/compat-include/linux/netdevice.h +++ b/compat-include/linux/netdevice.h @@ -111,10 +111,4 @@ static inline int batadv_netdev_set_master(struct net_device *slave, #endif /* < KERNEL_VERSION(3, 17, 0) */ -#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 1, 0) - -#define dev_get_iflink(_net_dev) ((_net_dev)->iflink) - -#endif /* < KERNEL_VERSION(3, 19, 0) */ - #endif /* _NET_BATMAN_ADV_COMPAT_LINUX_NETDEVICE_H_ */ diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c index bef9147..0c2643d 100644 --- a/net/batman-adv/hard-interface.c +++ b/net/batman-adv/hard-interface.c @@ -75,44 +75,6 @@ out: return hard_iface; } -/** - * batadv_is_on_batman_iface - check if a device is a batman iface descendant - * @net_dev: the device to check - * - * If the user creates any virtual device on top of a batman-adv interface, it - * is important to prevent this new interface to be used to create a new mesh - * network (this behaviour would lead to a batman-over-batman configuration). - * This function recursively checks all the fathers of the device passed as - * argument looking for a batman-adv soft interface. - * - * Return: true if the device is descendant of a batman-adv mesh interface (or - * if it is a batman-adv interface itself), false otherwise - */ -static bool batadv_is_on_batman_iface(const struct net_device *net_dev) -{ - struct net_device *parent_dev; - bool ret; - - /* check if this is a batman-adv mesh interface */ - if (batadv_softif_is_valid(net_dev)) - return true; - - /* no more parents..stop recursion */ - if (dev_get_iflink(net_dev) == 0 || - dev_get_iflink(net_dev) == net_dev->ifindex) - return false; - - /* recurse over the parent device */ - parent_dev = __dev_get_by_index(&init_net, dev_get_iflink(net_dev)); - /* if we got a NULL parent_dev there is something broken.. */ - if (WARN(!parent_dev, "Cannot find parent device")) - return false; - - ret = batadv_is_on_batman_iface(parent_dev); - - return ret; -} - static int batadv_is_valid_iface(const struct net_device *net_dev) { if (net_dev->flags & IFF_LOOPBACK) @@ -124,10 +86,6 @@ static int batadv_is_valid_iface(const struct net_device *net_dev) if (net_dev->addr_len != ETH_ALEN) return 0; - /* no batman over batman */ - if (batadv_is_on_batman_iface(net_dev)) - return 0; - return 1; } -- 2.6.2

3 4

[B.A.T.M.A.N.] [PATCH-maint] batman-adv: fix lockdep splat when doing mcast_free
by Simon Wunderlich 30 Dec '15

30 Dec '15

From: Simon Wunderlich <simon(a)open-mesh.com> While testing, we got something like this: WARNING: CPU: 0 PID: 238 at net/batman-adv/multicast.c:142 batadv_mcast_mla_tt_retract+0x94/0x205 [batman_adv]() [...] Call Trace: [<ffffffff815fc597>] dump_stack+0x4b/0x64 [<ffffffff810b34dc>] warn_slowpath_common+0xbc/0x120 [<ffffffffa0024ec5>] ? batadv_mcast_mla_tt_retract+0x94/0x205 [batman_adv] [<ffffffff810b3705>] warn_slowpath_null+0x15/0x20 [<ffffffffa0024ec5>] batadv_mcast_mla_tt_retract+0x94/0x205 [batman_adv] [<ffffffffa00273fe>] batadv_mcast_free+0x36/0x39 [batman_adv] [<ffffffffa0020c77>] batadv_mesh_free+0x7d/0x13f [batman_adv] [<ffffffffa0036a6b>] batadv_softif_free+0x15/0x25 [batman_adv] [...] Signed-off-by: Simon Wunderlich <simon(a)open-mesh.com> --- Changes to PATCH: * rebase on maint, add actual splat --- net/batman-adv/multicast.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c index eb76386..75fa501 100644 --- a/net/batman-adv/multicast.c +++ b/net/batman-adv/multicast.c @@ -802,7 +802,9 @@ void batadv_mcast_free(struct batadv_priv *bat_priv) batadv_tvlv_container_unregister(bat_priv, BATADV_TVLV_MCAST, 1); batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_MCAST, 1); + spin_lock_bh(&bat_priv->tt.commit_lock); batadv_mcast_mla_tt_retract(bat_priv, NULL); + spin_unlock_bh(&bat_priv->tt.commit_lock); } /** -- 2.6.2

5 7

[B.A.T.M.A.N.] [PATCH] batman-adv: Fix invalid read while copying bat_iv.bcast_own
by Sven Eckelmann 30 Dec '15

30 Dec '15

batadv_iv_ogm_orig_del_if removes a part of the bcast_own which previously belonged to the now removed interface. This is done by copying all data which comes before the removed interface and then appending all the data which comes after the removed interface. The address calculation for the position of the data which comes after the removed interface assumed that the bat_iv.bcast_own is a pointer to a single byte datatype. But it is a pointer to unsigned long and thus the calculated position was wrong off factor sizeof(unsigned long). Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- net/batman-adv/bat_iv_ogm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c index ad678f0..a6d389b 100644 --- a/net/batman-adv/bat_iv_ogm.c +++ b/net/batman-adv/bat_iv_ogm.c @@ -185,7 +185,8 @@ unlock: static int batadv_iv_ogm_orig_del_if(struct batadv_orig_node *orig_node, int max_if_num, int del_if_num) { - int chunk_size, ret = -ENOMEM, if_offset; + int ret = -ENOMEM; + size_t chunk_size, if_offset; void *data_ptr = NULL; spin_lock_bh(&orig_node->bat_iv.ogm_cnt_lock); @@ -203,8 +204,9 @@ static int batadv_iv_ogm_orig_del_if(struct batadv_orig_node *orig_node, memcpy(data_ptr, orig_node->bat_iv.bcast_own, del_if_num * chunk_size); /* copy second part */ + if_offset = (del_if_num + 1) * chunk_size; memcpy((char *)data_ptr + del_if_num * chunk_size, - orig_node->bat_iv.bcast_own + ((del_if_num + 1) * chunk_size), + (uint8_t *)orig_node->bat_iv.bcast_own + if_offset, (max_if_num - del_if_num) * chunk_size); free_bcast_own: -- 2.6.2

2 1

[B.A.T.M.A.N.] [PATCH 0/3] Couple of patches while developing BATMAN V
by Simon Wunderlich 15 Dec '15

15 Dec '15

From: Simon Wunderlich <simon(a)open-mesh.com> This series includes a couple of patches which fix some issues and prepare for the upcoming BATMAN V code. Simon Wunderlich (3): batman-adv: fix lockdep splat when doing mcast_free batman-adv: add kerneldoc for batadv_iv_ogm_aggr_packet batman-adv: add seqno maximum age and protection start flag parameters net/batman-adv/bat_iv_ogm.c | 12 ++++++++++-- net/batman-adv/main.h | 3 +++ net/batman-adv/multicast.c | 2 ++ net/batman-adv/routing.c | 13 ++++++++++--- net/batman-adv/routing.h | 3 ++- 5 files changed, 27 insertions(+), 6 deletions(-) -- 2.6.2

5 13

[B.A.T.M.A.N.] old batman-adv within 15.05 brunch?
by Ufo 10 Dec '15

10 Dec '15

is there a reason for staying with batman-adv 2014 for openwrt 15.05? our current freifunk leipzig running batman-adv 2015.0 and it seems to work https://github.com/openwrt-routing/packages/tree/master/batman-adv vs. https://github.com/openwrt-routing/packages/tree/for-15.05/batman-adv -- --- Freifunk Leipzig http://leipzig.freifunk.net

3 3

[B.A.T.M.A.N.] Invalid memory access during if add/del with multiple interfaces
by Sven Eckelmann 29 Nov '15

29 Nov '15

Hi, I've just configured two kvm nodes [1] and interconnected them via ethernet and gretap. The used batman-adv version was v2015.1-115-g5b0b10e. The first node initialized via: insmod /host/batman-adv/net/batman-adv/batman-adv.ko /host/batctl/batctl if add eth0 ifconfig bat0 up ip link add testgre type gretap remote 192.168.2.52 local 192.168.2.51 ttl 255 ifconfig testgre 192.168.3.51 ifconfig bat0 192.168.4.51 /host/batctl/batctl if add testgre The second node was initialized via: insmod /host/batman-adv/net/batman-adv/batman-adv.ko /host/batctl/batctl if add eth0 ifconfig bat0 up ip link add testgre type gretap remote 192.168.2.51 local 192.168.2.52 ttl 255 ifconfig testgre 192.168.3.52 ifconfig bat0 192.168.4.52 /host/batctl/batctl if add testgre The workload of the second node was generated via: ping 192.168.4.51 The first node was running: while true; do /host/batctl/batctl if del testgre; /host/batctl/batctl if add testgre; done Later (when the invalid memory access happened) it was switched to while true; do /host/batctl/batctl if del eth0; /host/batctl/batctl if add eth0; done The output on the first node was: batman_adv: bat0: Interface deactivated: eth0 batman_adv: bat0: Removing interface: eth0 ================================================================== BUG: KASAN: slab-out-of-bounds in memcpy+0x1d/0x40 at addr ffff880007e1e680 Read of size 8 by task batctl/1422 ============================================================================= BUG kmalloc-16 (Tainted: G O ): kasan: bad access detected ----------------------------------------------------------------------------- Disabling lock debugging due to kernel taint INFO: Allocated in batadv_iv_ogm_orig_add_if+0x68/0x1bf [batman_adv] age=7876 cpu=0 pid=1417 ___slab_alloc.constprop.28+0x36f/0x3a0 __slab_alloc.constprop.27+0x40/0x90 __kmalloc+0x190/0x1d0 batadv_iv_ogm_orig_add_if+0x68/0x1bf [batman_adv] batadv_orig_hash_add_if+0x1db/0x31e [batman_adv] batadv_hardif_enable_interface+0x301/0x812 [batman_adv] batadv_store_mesh_iface+0x1d8/0x206 [batman_adv] kobj_attr_store+0x36/0x70 sysfs_kf_write+0x110/0x180 kernfs_fop_write+0x270/0x390 __vfs_write+0xea/0x400 vfs_write+0x13d/0x480 SyS_write+0x11b/0x250 entry_SYSCALL_64_fastpath+0x12/0x72 INFO: Freed in batadv_iv_ogm_orig_del_if+0x103/0x2b1 [batman_adv] age=7904 cpu=0 pid=1410 __slab_free+0x310/0x440 kfree+0x19b/0x1b0 batadv_iv_ogm_orig_del_if+0x103/0x2b1 [batman_adv] batadv_orig_hash_del_if+0x227/0x5a1 [batman_adv] batadv_hardif_disable_interface+0x16d/0x58e [batman_adv] batadv_store_mesh_iface+0x18d/0x206 [batman_adv] kobj_attr_store+0x36/0x70 sysfs_kf_write+0x110/0x180 kernfs_fop_write+0x270/0x390 __vfs_write+0xea/0x400 vfs_write+0x13d/0x480 SyS_write+0x11b/0x250 entry_SYSCALL_64_fastpath+0x12/0x72 INFO: Slab 0xffffea00001f8780 objects=12 used=6 fp=0xffff880007e1ea00 flags=0x4000000000000080 INFO: Object 0xffff880007e1e640 @offset=1600 fp=0x (null) Bytes b4 ffff880007e1e630: 00 00 00 00 88 05 00 00 83 2b 01 00 01 00 00 00 .........+...... Object ffff880007e1e640: 00 00 00 00 00 00 00 00 ff ff ff 7f 00 00 00 00 ................ CPU: 1 PID: 1422 Comm: batctl Tainted: G B O 4.4.0-rc2-next-20151127 #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014 ffff880007e1e640 00000000beca4caa ffff88000aed7948 ffffffff815fc597 ffff88000c803c00 ffff88000aed7978 ffffffff812e2204 ffff88000c803c00 ffffea00001f8780 ffff880007e1e640 ffff88000b91d850 ffff88000aed79a0 Call Trace: [<ffffffff815fc597>] dump_stack+0x4b/0x64 [<ffffffff812e2204>] print_trailer+0xf4/0x150 [<ffffffff812e6d5f>] object_err+0x2f/0x40 [<ffffffff812e88db>] kasan_report_error+0x22b/0x550 [<ffffffff812e4c1d>] ? __slab_alloc.constprop.27+0x4d/0x90 [<ffffffffa00005be>] ? batadv_iv_ogm_orig_del_if+0x67/0x2b1 [batman_adv] [<ffffffff812e9173>] kasan_report+0x53/0x60 [<ffffffff812e815d>] ? memcpy+0x1d/0x40 [<ffffffff812e7c1a>] __asan_loadN+0x12a/0x180 [<ffffffff812e815d>] memcpy+0x1d/0x40 [<ffffffffa000064e>] batadv_iv_ogm_orig_del_if+0xf7/0x2b1 [batman_adv] [<ffffffffa0000557>] ? batadv_iv_ogm_orig_add_if+0x1bf/0x1bf [batman_adv] [<ffffffffa002af5c>] batadv_orig_hash_del_if+0x227/0x5a1 [batman_adv] [<ffffffffa002ae69>] ? batadv_orig_hash_del_if+0x134/0x5a1 [batman_adv] [<ffffffffa001d20a>] batadv_hardif_disable_interface+0x16d/0x58e [batman_adv] [<ffffffffa0038108>] batadv_store_mesh_iface+0x18d/0x206 [batman_adv] [<ffffffff81601400>] ? kobj_attr_show+0x60/0x60 [<ffffffff81601436>] kobj_attr_store+0x36/0x70 [<ffffffff8140c3e3>] ? sysfs_file_ops+0x113/0x170 [<ffffffff8140c550>] sysfs_kf_write+0x110/0x180 [<ffffffff8140c440>] ? sysfs_file_ops+0x170/0x170 [<ffffffff81409ee0>] kernfs_fop_write+0x270/0x390 [<ffffffff812f328a>] __vfs_write+0xea/0x400 [<ffffffff812f31a0>] ? __vfs_read+0x3f0/0x3f0 [<ffffffff811a5ed3>] ? rcu_read_lock_sched_held+0xe3/0x120 [<ffffffff811a6480>] ? rcu_sync_lockdep_assert+0x70/0xb0 [<ffffffff81163ffd>] ? update_fast_ctr+0x1d/0xa0 [<ffffffff811640f2>] ? percpu_down_read+0x52/0x90 [<ffffffff812fc15f>] ? __sb_start_write+0xaf/0xf0 [<ffffffff812f46ed>] vfs_write+0x13d/0x480 [<ffffffff81343c1e>] ? __fget_light+0x13e/0x1f0 [<ffffffff812f6e3b>] SyS_write+0x11b/0x250 [<ffffffff812f6d20>] ? SyS_read+0x250/0x250 [<ffffffff810020e4>] ? lockdep_sys_exit_thunk+0x12/0x14 [<ffffffff81d938f2>] entry_SYSCALL_64_fastpath+0x12/0x72 Memory state around the buggy address: ffff880007e1e580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff880007e1e600: fc fc fc fc fc fc fc fc 00 00 fc fc fc fc fc fc >ffff880007e1e680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff880007e1e700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff880007e1e780: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== ================================================================== BUG: KASAN: slab-out-of-bounds in memcpy+0x1d/0x40 at addr ffff880007e1e540 Read of size 8 by task batctl/1422 ============================================================================= BUG kmalloc-16 (Tainted: G B O ): kasan: bad access detected ----------------------------------------------------------------------------- INFO: Allocated in batadv_iv_ogm_orig_add_if+0x68/0x1bf [batman_adv] age=7900 cpu=0 pid=1417 ___slab_alloc.constprop.28+0x36f/0x3a0 __slab_alloc.constprop.27+0x40/0x90 __kmalloc+0x190/0x1d0 batadv_iv_ogm_orig_add_if+0x68/0x1bf [batman_adv] batadv_orig_hash_add_if+0x1db/0x31e [batman_adv] batadv_hardif_enable_interface+0x301/0x812 [batman_adv] batadv_store_mesh_iface+0x1d8/0x206 [batman_adv] kobj_attr_store+0x36/0x70 sysfs_kf_write+0x110/0x180 kernfs_fop_write+0x270/0x390 __vfs_write+0xea/0x400 vfs_write+0x13d/0x480 SyS_write+0x11b/0x250 entry_SYSCALL_64_fastpath+0x12/0x72 INFO: Freed in batadv_iv_ogm_orig_del_if+0x103/0x2b1 [batman_adv] age=7905 cpu=0 pid=1416 __slab_free+0x310/0x440 kfree+0x19b/0x1b0 batadv_iv_ogm_orig_del_if+0x103/0x2b1 [batman_adv] batadv_orig_hash_del_if+0x227/0x5a1 [batman_adv] batadv_hardif_disable_interface+0x16d/0x58e [batman_adv] batadv_store_mesh_iface+0x18d/0x206 [batman_adv] kobj_attr_store+0x36/0x70 sysfs_kf_write+0x110/0x180 kernfs_fop_write+0x270/0x390 __vfs_write+0xea/0x400 vfs_write+0x13d/0x480 SyS_write+0x11b/0x250 entry_SYSCALL_64_fastpath+0x12/0x72 INFO: Slab 0xffffea00001f8780 objects=12 used=5 fp=0xffff880007e1e640 flags=0x4000000000000080 INFO: Object 0xffff880007e1e500 @offset=1280 fp=0xffffffffffffffff Bytes b4 ffff880007e1e4f0: 00 00 00 00 89 05 00 00 85 2b 01 00 01 00 00 00 .........+...... Object ffff880007e1e500: ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 ................ CPU: 1 PID: 1422 Comm: batctl Tainted: G B O 4.4.0-rc2-next-20151127 #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014 ffff880007e1e500 00000000beca4caa ffff88000aed7948 ffffffff815fc597 ffff88000c803c00 ffff88000aed7978 ffffffff812e2204 ffff88000c803c00 ffffea00001f8780 ffff880007e1e500 ffff88000ad885a0 ffff88000aed79a0 Call Trace: [<ffffffff815fc597>] dump_stack+0x4b/0x64 [<ffffffff812e2204>] print_trailer+0xf4/0x150 [<ffffffff812e6d5f>] object_err+0x2f/0x40 [<ffffffff812e88db>] kasan_report_error+0x22b/0x550 [<ffffffff812e9173>] kasan_report+0x53/0x60 [<ffffffff812e815d>] ? memcpy+0x1d/0x40 [<ffffffff812e7c1a>] __asan_loadN+0x12a/0x180 [<ffffffff812e815d>] memcpy+0x1d/0x40 [<ffffffffa000064e>] batadv_iv_ogm_orig_del_if+0xf7/0x2b1 [batman_adv] [<ffffffffa0000557>] ? batadv_iv_ogm_orig_add_if+0x1bf/0x1bf [batman_adv] [<ffffffffa002af5c>] batadv_orig_hash_del_if+0x227/0x5a1 [batman_adv] [<ffffffffa002ae69>] ? batadv_orig_hash_del_if+0x134/0x5a1 [batman_adv] [<ffffffffa001d20a>] batadv_hardif_disable_interface+0x16d/0x58e [batman_adv] [<ffffffffa0038108>] batadv_store_mesh_iface+0x18d/0x206 [batman_adv] [<ffffffff81601400>] ? kobj_attr_show+0x60/0x60 [<ffffffff81601436>] kobj_attr_store+0x36/0x70 [<ffffffff8140c3e3>] ? sysfs_file_ops+0x113/0x170 [<ffffffff8140c550>] sysfs_kf_write+0x110/0x180 [<ffffffff8140c440>] ? sysfs_file_ops+0x170/0x170 [<ffffffff81409ee0>] kernfs_fop_write+0x270/0x390 [<ffffffff812f328a>] __vfs_write+0xea/0x400 [<ffffffff812f31a0>] ? __vfs_read+0x3f0/0x3f0 [<ffffffff811a5ed3>] ? rcu_read_lock_sched_held+0xe3/0x120 [<ffffffff811a6480>] ? rcu_sync_lockdep_assert+0x70/0xb0 [<ffffffff81163ffd>] ? update_fast_ctr+0x1d/0xa0 [<ffffffff811640f2>] ? percpu_down_read+0x52/0x90 [<ffffffff812fc15f>] ? __sb_start_write+0xaf/0xf0 [<ffffffff812f46ed>] vfs_write+0x13d/0x480 [<ffffffff81343c1e>] ? __fget_light+0x13e/0x1f0 [<ffffffff812f6e3b>] SyS_write+0x11b/0x250 [<ffffffff812f6d20>] ? SyS_read+0x250/0x250 [<ffffffff810020e4>] ? lockdep_sys_exit_thunk+0x12/0x14 [<ffffffff81d938f2>] entry_SYSCALL_64_fastpath+0x12/0x72 Memory state around the buggy address: ffff880007e1e400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff880007e1e480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff880007e1e500: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff880007e1e580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff880007e1e600: fc fc fc fc fc fc fc fc fb fb fc fc fc fc fc fc ================================================================== batman_adv: bat0: Adding interface: eth0 [...] ================================================================== BUG: KASAN: slab-out-of-bounds in batadv_iv_ogm_slide_own_bcast_window+0x298/0x376 [batman_adv] at addr fff Write of size 1 by task kworker/u4:2/67 ============================================================================= BUG kmalloc-8 (Tainted: G B O ): kasan: bad access detected ----------------------------------------------------------------------------- INFO: Allocated in batadv_iv_ogm_orig_del_if+0x1bc/0x392 [batman_adv] age=307 cpu=1 pid=399 ___slab_alloc.constprop.28+0x36f/0x3a0 __slab_alloc.constprop.27+0x40/0x90 __kmalloc+0x190/0x1d0 batadv_iv_ogm_orig_del_if+0x1bc/0x392 [batman_adv] batadv_orig_hash_del_if+0x227/0x5a1 [batman_adv] batadv_hardif_disable_interface+0x16d/0x58e [batman_adv] batadv_softif_slave_del+0x55/0x8b [batman_adv] do_setlink+0x9b8/0x2900 rtnl_newlink+0xb05/0x1260 rtnetlink_rcv_msg+0x241/0x680 netlink_rcv_skb+0x236/0x340 rtnetlink_rcv+0x25/0x30 netlink_unicast+0x3f6/0x580 netlink_sendmsg+0x89e/0xb30 sock_sendmsg+0x70/0xc0 ___sys_sendmsg+0x583/0x670 INFO: Freed in batadv_iv_ogm_orig_add_if+0x1dd/0x22b [batman_adv] age=513 cpu=1 pid=398 __slab_free+0x310/0x440 kfree+0x19b/0x1b0 batadv_iv_ogm_orig_add_if+0x1dd/0x22b [batman_adv] batadv_orig_hash_add_if+0x1db/0x31e [batman_adv] batadv_hardif_enable_interface+0x301/0x812 [batman_adv] batadv_softif_slave_add+0x54/0x87 [batman_adv] do_setlink+0x1bbd/0x2900 rtnl_newlink+0xb05/0x1260 rtnetlink_rcv_msg+0x241/0x680 netlink_rcv_skb+0x236/0x340 rtnetlink_rcv+0x25/0x30 netlink_unicast+0x3f6/0x580 netlink_sendmsg+0x89e/0xb30 sock_sendmsg+0x70/0xc0 ___sys_sendmsg+0x583/0x670 __sys_sendmsg+0xcd/0x160 INFO: Slab 0xffffea0000007200 objects=13 used=11 fp=0xffff8800001c8af8 flags=0x0080 INFO: Object 0xffff8800001c83a8 @offset=936 fp=0xffff8800001c8429 Bytes b4 ffff8800001c8398: 01 00 00 00 8b 01 00 00 85 f2 fe ff 00 00 00 00 ................ Object ffff8800001c83a8: 29 84 1c 00 00 88 ff ff )....... CPU: 0 PID: 67 Comm: kworker/u4:2 Tainted: G B O 4.4.0-rc2-next-20151127 #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014 Workqueue: bat_events batadv_send_outstanding_bat_ogm_packet [batman_adv] ffff8800001c83a8 00000000fce739f9 ffff88000bb97990 ffffffff815fc597 ffff88000c802200 ffff88000bb979c0 ffffffff812e2204 ffff88000c802200 ffffea0000007200 ffff8800001c83a8 0000000000000026 ffff88000bb979e8 Call Trace: [<ffffffff815fc597>] dump_stack+0x4b/0x64 [<ffffffff812e2204>] print_trailer+0xf4/0x150 [<ffffffff812e6d5f>] object_err+0x2f/0x40 [<ffffffff812e88db>] kasan_report_error+0x22b/0x550 [<ffffffff812e8e8c>] __asan_report_store1_noabort+0x5c/0x70 [<ffffffffa0007401>] ? _GLOBAL__sub_I_65535_1_batadv_ring_buffer_set+0x13/0x17 [batman_adv] [<ffffffffa00036a1>] ? batadv_iv_ogm_slide_own_bcast_window+0x298/0x376 [batman_adv] [<ffffffffa00036a1>] batadv_iv_ogm_slide_own_bcast_window+0x298/0x376 [batman_adv] [<ffffffffa0003510>] ? batadv_iv_ogm_slide_own_bcast_window+0x107/0x376 [batman_adv] [<ffffffffa0003a84>] batadv_iv_ogm_schedule+0x305/0x608 [batman_adv] [<ffffffffa00037d2>] ? batadv_iv_ogm_schedule+0x53/0x608 [batman_adv] [<ffffffffa0032dfe>] batadv_schedule_bat_ogm+0xc8/0xcf [batman_adv] [<ffffffffa0033c33>] batadv_send_outstanding_bat_ogm_packet+0x25f/0x2ac [batman_adv] [<ffffffff810edb04>] process_one_work+0x674/0x1090 [<ffffffff810eda87>] ? process_one_work+0x5f7/0x1090 [<ffffffff8116de0d>] ? trace_hardirqs_on+0xd/0x10 [<ffffffff810ed490>] ? cancel_delayed_work_sync+0x10/0x10 [<ffffffff810ee5f2>] worker_thread+0xd2/0xdf0 [<ffffffff810ee520>] ? process_one_work+0x1090/0x1090 [<ffffffff810fdfee>] kthread+0x21e/0x2e0 [<ffffffff810fddd0>] ? kthread_create_on_node+0x400/0x400 [<ffffffff81109639>] ? finish_task_switch+0x1c9/0x5b0 [<ffffffff810fddd0>] ? kthread_create_on_node+0x400/0x400 [<ffffffff81d93c5f>] ret_from_fork+0x3f/0x70 [<ffffffff810fddd0>] ? kthread_create_on_node+0x400/0x400 Memory state around the buggy address: ffff8800001c8280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8800001c8300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8800001c8380: fc fc fc fc fc 01 fc fc fc fc fc fc fc fc fc fc ^ ffff8800001c8400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8800001c8480: fc fc fc fc fc fc fc fc fc fc fc fc 01 fc fc fc ================================================================== This was repeated without rebooting the node and caused following error: batman_adv: bat0: Removing interface: eth0 kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN Modules linked in: batman_adv(O) CPU: 0 PID: 2033 Comm: batctl Tainted: G B O 4.4.0-rc2-next-20151127 #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014 task: ffff88000bb6c5c0 ti: ffff880007df0000 task.ti: ffff880007df0000 RIP: 0010:[<ffffffffa0033e65>] [<ffffffffa0033e65>] batadv_purge_outstanding_packets+0x332/0x36a [batman_adv] RSP: 0018:ffff880007df7b38 EFLAGS: 00010a02 RAX: 1bd5a00000000020 RBX: dead000000000100 RCX: 0000000000000014 RDX: 0000000000000004 RSI: 0000000000000000 RDI: ffff88000ac48100 RBP: ffff880007df7b78 R08: ffffffffa0000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88000bb72fd0 R13: dffffc0000000000 R14: dead000000000100 R15: ffff88000ac49650 FS: 00007fa3b4a3a700(0000) GS:ffff88000ce00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 000000000040369f CR3: 000000000aec6000 CR4: 00000000000006b0 Stack: ffff88000ba02980 ffff88000ba02aa8 ffff88000ba02ac0 ffff88000bb72fd0 ffff88000ba02980 ffff88000bb73040 ffff88000ae77c90 ffff88000ba02140 ffff880007df7be0 ffffffffa001d4a4 ffffffffa001d211 ffffffffa005a940 Call Trace: [<ffffffffa001d4a4>] batadv_hardif_disable_interface+0x407/0x58e [batman_adv] [<ffffffffa001d211>] ? batadv_hardif_disable_interface+0x174/0x58e [batman_adv] [<ffffffffa0038108>] batadv_store_mesh_iface+0x18d/0x206 [batman_adv] [<ffffffff81601400>] ? kobj_attr_show+0x60/0x60 [<ffffffff81601436>] kobj_attr_store+0x36/0x70 [<ffffffff8140c550>] sysfs_kf_write+0x110/0x180 [<ffffffff8140c440>] ? sysfs_file_ops+0x170/0x170 [<ffffffff81409ee0>] kernfs_fop_write+0x270/0x390 [<ffffffff812f328a>] __vfs_write+0xea/0x400 [<ffffffff812f31a0>] ? __vfs_read+0x3f0/0x3f0 [<ffffffff812e5957>] ? __slab_free+0x397/0x440 [<ffffffff812fc15f>] ? __sb_start_write+0xaf/0xf0 [<ffffffff811a641d>] ? rcu_sync_lockdep_assert+0xd/0xb0 [<ffffffff81163ffd>] ? update_fast_ctr+0x1d/0xa0 [<ffffffff811640f2>] ? percpu_down_read+0x52/0x90 [<ffffffff812fc15f>] ? __sb_start_write+0xaf/0xf0 [<ffffffff812f46ed>] vfs_write+0x13d/0x480 [<ffffffff81343c1e>] ? __fget_light+0x13e/0x1f0 [<ffffffff812f6e3b>] SyS_write+0x11b/0x250 [<ffffffff812f6d20>] ? SyS_read+0x250/0x250 [<ffffffff810020e4>] ? lockdep_sys_exit_thunk+0x12/0x14 [<ffffffff81d938f2>] entry_SYSCALL_64_fastpath+0x12/0x72 Code: 00 ad de 48 89 03 48 b8 00 02 00 00 00 00 ad de 48 89 43 08 48 89 df e8 62 ee ff ff 4d 85 f6 74 2a 4c 89 f3 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 dc 4e 2b e1 4c 8b 33 4d 85 e4 RIP [<ffffffffa0033e65>] batadv_purge_outstanding_packets+0x332/0x36a [batman_adv] RSP <ffff880007df7b38> ---[ end trace 761c71262b1ed40c ]--- Kernel panic - not syncing: Fatal exception in interrupt Kernel Offset: disabled It also happened when using the rtnetlink interface instead of batctl/sysfs: while true; do ip link set nomaster dev eth0; ip link set master bat0 dev eth0; done Kind regards, Sven [1] https://www.open-mesh.org/projects/open-mesh/wiki/Emulation_Debug/7 + CONFIG_NET_IPGRE_DEMUX=y + CONFIG_NET_IP_TUNNEL=y + CONFIG_NET_IPGRE=y

1 1

Re: [B.A.T.M.A.N.] batman-adv licence
by Marek Lindner 23 Nov '15

23 Nov '15

Hi Johannes, in the future, please contact our official mailing list instead of mailing me directly. > I am looking for a mesh solution for research purposes in an university. > Can you tell me which licence the B.A.T.M.A.N. project uses, please? > I didn't find a hint to that information on the open-mesh website. As every kernel module batman-adv is licensed under the GPLv2. Each source file also contains information about the license. Cheers, Marek

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

B.A.T.M.A.N November 2015