Speedy join only works when the received packet is either broadcast or an
4addr unicast packet. Thus packets converted from broadcast to unicast via
the gateway handling code have to be converted to 4addr packets to allow
the receiving gateway server to add the sender address as temporary entry
to the translation table.
Not doing it will make the batman-adv gateway server drop the DHCP response
in many situations because it doesn't yet have the TT entry for the
destination of the DHCP response.
Fixes: 9cbc67d9da47 ("batman-adv: change interface_rx to get orig node")
Signed-off-by: Sven Eckelmann <sven(a)narfation.org>
---
net/batman-adv/send.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index 49836da..0e9445b 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -426,8 +426,8 @@ int batadv_send_skb_via_gw(struct batadv_priv *bat_priv, struct sk_buff *skb,
struct batadv_orig_node *orig_node;
orig_node = batadv_gw_get_selected_orig(bat_priv);
- return batadv_send_skb_unicast(bat_priv, skb, BATADV_UNICAST, 0,
- orig_node, vid);
+ return batadv_send_skb_unicast(bat_priv, skb, BATADV_UNICAST_4ADDR,
+ BATADV_P_DATA, orig_node, vid);
}
void batadv_forw_packet_free(struct batadv_forw_packet *forw_packet)
--
2.8.1
It can happen that a tt_req_node list entry was already removed from
tt.req_list when batadv_send_tt_request reaches the end of the function.
The reference counter was already reduced by 1 for the list entry and thus
the reference counter is not allowed to be reduced again. Otherwise, the
entry is freed too early and the next batadv_tt_req_node_put in this
function will operate on freed memory.
Fixes: cea194d90b11 ("batman-adv: improved client announcement mechanism")
Signed-off-by: Sven Eckelmann <sven(a)narfation.org>
---
net/batman-adv/translation-table.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 3c32f5f..7e6df7a 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -2639,11 +2639,13 @@ static bool batadv_send_tt_request(struct batadv_priv *bat_priv,
out:
if (primary_if)
batadv_hardif_put(primary_if);
+
if (ret && tt_req_node) {
spin_lock_bh(&bat_priv->tt.req_list_lock);
- /* hlist_del_init() verifies tt_req_node still is in the list */
- hlist_del_init(&tt_req_node->list);
- batadv_tt_req_node_put(tt_req_node);
+ if (!hlist_unhashed(&tt_req_node->list)) {
+ hlist_del_init(&tt_req_node->list);
+ batadv_tt_req_node_put(tt_req_node);
+ }
spin_unlock_bh(&bat_priv->tt.req_list_lock);
}
batadv_send_skb_to_orig can return -1 to signal that the skb was not
consumed. tp_meter has then to free the skb to avoid a memory leak.
Fixes: 98d7a766b645 ("batman-adv: throughput meter implementation")
Signed-off-by: Sven Eckelmann <sven(a)narfation.org>
---
v2:
- rebased on current master
- added patch to a common set of related patches
net/batman-adv/tp_meter.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/batman-adv/tp_meter.c b/net/batman-adv/tp_meter.c
index bf6bffb..2333777 100644
--- a/net/batman-adv/tp_meter.c
+++ b/net/batman-adv/tp_meter.c
@@ -1206,6 +1206,9 @@ static int batadv_tp_send_ack(struct batadv_priv *bat_priv, const u8 *dst,
/* send the ack */
r = batadv_send_skb_to_orig(skb, orig_node, NULL);
+ if (r == -1)
+ kfree_skb(skb);
+
if (unlikely(r < 0) || (r == NET_XMIT_DROP)) {
ret = BATADV_TP_REASON_DST_UNREACHABLE;
goto out;
--
2.8.1
Since recently the multicast optimizations are using functions from the
bridge module. If batman-adv is a kernel built-in, then these bridge
functions need to be accessible immediately. Thus adding a Kconfig
dependency for the multicast optimizations to depend on batman-adv being
built as a module if the bridge is built as a module, too.
This fixes build errors like the following:
~~~
net/built-in.o: In function `batadv_mcast_mla_update':
>> (.text+0x19b7eb): undefined reference to `br_multicast_has_querier_anywhere'
net/built-in.o: In function `batadv_mcast_mla_update':
>> (.text+0x19b7fa): undefined reference to `br_multicast_has_querier_adjacent'
net/built-in.o: In function `batadv_mcast_mla_update':
(.text+0x19b809): undefined reference to `br_multicast_has_querier_anywhere'
net/built-in.o: In function `batadv_mcast_mla_update':
(.text+0x19b818): undefined reference to `br_multicast_has_querier_adjacent'
net/built-in.o: In function `batadv_mcast_mla_update':
>> (.text+0x19b8cf): undefined reference to `br_multicast_list_adjacent'
~~~
Fixes: 391b59cdb111 ("batman-adv: Add multicast optimization support for bridged setups")
Reported-by: kbuild test robot <fengguang.wu(a)intel.com>
Signed-off-by: Linus Lüssing <linus.luessing(a)c0d3.blue>
---
net/batman-adv/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/batman-adv/Kconfig b/net/batman-adv/Kconfig
index b7ba97d..833bb14 100644
--- a/net/batman-adv/Kconfig
+++ b/net/batman-adv/Kconfig
@@ -66,7 +66,7 @@ config BATMAN_ADV_NC
config BATMAN_ADV_MCAST
bool "Multicast optimisation"
- depends on BATMAN_ADV && INET
+ depends on BATMAN_ADV && INET && !(BRIDGE=m && BATMAN_ADV=y)
default n
help
This option enables the multicast optimisation which aims to
--
2.1.4
Speedy join only works when the received packet is either broadcast or an
4addr unicast packet. Thus packets converted from broadcast to unicast via
the gateway handling code have to be converted to 4addr packets to allow
the receiving gateway server to add the sender address as temporary node to
the translation table.
Not doing it will make batman-adv drop the DHCP response in many situations
because it doesn't yet have the TT entry for the destination of the DHCP
response.
Signed-off-by: Sven Eckelmann <sven(a)narfation.org>
---
This is completely untested. The RFC was submitted to better explain a
problem to Antonio. This problems was noticed in real world setups but
these patches were not yet tested in these setups.
net/batman-adv/send.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index 49836da..0e9445b 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -426,8 +426,8 @@ int batadv_send_skb_via_gw(struct batadv_priv *bat_priv, struct sk_buff *skb,
struct batadv_orig_node *orig_node;
orig_node = batadv_gw_get_selected_orig(bat_priv);
- return batadv_send_skb_unicast(bat_priv, skb, BATADV_UNICAST, 0,
- orig_node, vid);
+ return batadv_send_skb_unicast(bat_priv, skb, BATADV_UNICAST_4ADDR,
+ BATADV_P_DATA, orig_node, vid);
}
void batadv_forw_packet_free(struct batadv_forw_packet *forw_packet)
--
2.8.1
Hi David,
Antonio currently seems to be occupied. This is currently rather unfortunate
because there are patches waiting in the batman-adv development repository
maint(enance) branch [1] since up to 6 weeks. I am now getting asked when
these patches will hit the distribution kernels and therefore decided to
submit these patches directly to netdev.
The patch from Simon works around the problem that warnings could be triggered
in the translation table code via packets using a VLAN not configured on the
target host. This warning was replaced with a rate limited info message.
Ben Hutchings found an superfluous batadv_softif_vlan_put in the error
handling code of the translation table while he backported the "batman-adv:
Fix reference counting of vlan object for tt_local_entry" patch to the stable
kernels. He noticed correctly that this batadv_softif_vlan_put should also
have been removed by the said patch.
The most requested fix at the moment is related to a double free in the
translation table code. It is a race condition which mostly happens on systems
with multiple cores and multiple network interface attached to batman-adv. Two
Freifunk communities which were haunted by weird crashes (with backtraces
reporting problems in other parts of the kernel) were kind enough to test this
patch. They reported that there systems are now running stable after applying
this patch.
An invalid memory access was detected in the batadv_icmp_packet_rr handling
code when receiving a skbuff with fragments. The last patch is fixing a memory
leak when the interface is removed via .dellink. The code to fix it was copied
from the code handling the legacy sysfs interface to remove netdevices from a
batman-adv netdevice.
There are still 28 patches in the development tree for v4.8 but I will leave
them to Antonio because these are cleanups and features and therefore for net-
next.
Ben Hutchings (1):
batman-adv: Fix double-put of vlan object
Simon Wunderlich (1):
batman-adv: replace WARN with rate limited output on non-existing VLAN
Sven Eckelmann (3):
batman-adv: Fix use-after-free/double-free of tt_req_node
batman-adv: Fix ICMP RR ethernet access after skb_linearize
batman-adv: Clean up untagged vlan when destroying via rtnl-link
net/batman-adv/routing.c | 1 +
net/batman-adv/soft-interface.c | 9 +++++++
net/batman-adv/translation-table.c | 50 +++++++++++++++++++++++++++++++-------
net/batman-adv/types.h | 2 ++
4 files changed, 53 insertions(+), 9 deletions(-)
Kind regards,
Sven
[1] https://git.open-mesh.org/batman-adv.git/shortlog/refs/heads/maint
[Please don't remove b.a.t.m.a.n(a)lists.open-mesh.org without
giving a reason. I nearly only replied to you instead to
the mailing list]
On Thursday 23 June 2016 16:13:11 Sailash Moirangthem wrote:
> Please check the results of the commands.
"ip link" shows that the adhoc0 interface is down. Please make
sure that the interface goes up. This is now definitely an
OpenWrt+wifi driver question and not related to batman-adv.
The interface combination [1] is showing only
"#{ managed, AP, mesh point } <= 8,". So you can try to
deactivate your AP interface in /etc/config/wireless. Make
sure that you only see the adhoc0 interface in `iw dev`
after you've restarted the wifi.
Kind regards,
Sven
[1] https://www.kernel.org/doc/htmldocs/80211/API-struct-ieee80211-iface-combin…