B.A.T.M.A.N August 2023

b.a.t.m.a.n@lists.open-mesh.org

8 participants
10 discussions

[syzbot] [batman?] memory leak in skb_clone (2)
by syzbot 28 Aug '23

28 Aug '23

Hello, syzbot found the following issue on: HEAD commit: a5e505a99ca7 Merge tag 'platform-drivers-x86-v6.5-5' of gi.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=15eea3e3a80000 kernel config: https://syzkaller.appspot.com/x/.config?x=f3c65e06397a9d58 dashboard link: https://syzkaller.appspot.com/bug?extid=92f9b5fba2df252a3569 compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13597f90680000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/c534ce48946f/disk-a5e505a9.raw… vmlinux: https://storage.googleapis.com/syzbot-assets/724bbdaa3992/vmlinux-a5e505a9.… kernel image: https://storage.googleapis.com/syzbot-assets/47fba0663891/bzImage-a5e505a9.… IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+92f9b5fba2df252a3569(a)syzkaller.appspotmail.com 2023/08/24 02:03:48 executed programs: 322 2023/08/24 02:03:54 executed programs: 337 BUG: memory leak unreferenced object 0xffff888120ea2600 (size 240): comm "kworker/u4:5", pid 5210, jiffies 4295058872 (age 8.300s) hex dump (first 32 bytes): 00 22 e3 20 81 88 ff ff 00 00 00 00 00 00 00 00 .". ............ 00 80 ed 1c 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff83e5e05a>] skb_clone+0xaa/0x190 net/core/skbuff.c:1860 [<ffffffff8499f31f>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:387 [inline] [<ffffffff8499f31f>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline] [<ffffffff8499f31f>] batadv_iv_send_outstanding_bat_ogm_packet+0x2ef/0x370 net/batman-adv/bat_iv_ogm.c:1700 [<ffffffff812b8d31>] process_one_work+0x2f1/0x640 kernel/workqueue.c:2600 [<ffffffff812b966c>] worker_thread+0x5c/0x5c0 kernel/workqueue.c:2751 [<ffffffff812c313b>] kthread+0x12b/0x170 kernel/kthread.c:389 [<ffffffff81140a5c>] ret_from_fork+0x2c/0x40 arch/x86/kernel/process.c:145 [<ffffffff81002be1>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 BUG: memory leak unreferenced object 0xffff888120f36c00 (size 1024): comm "kworker/u4:5", pid 5210, jiffies 4295058872 (age 8.300s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81554a79>] __do_kmalloc_node mm/slab_common.c:984 [inline] [<ffffffff81554a79>] __kmalloc_node_track_caller+0x49/0x140 mm/slab_common.c:1005 [<ffffffff83e54735>] kmalloc_reserve+0x95/0x180 net/core/skbuff.c:575 [<ffffffff83e5c6c8>] pskb_expand_head+0xd8/0x5f0 net/core/skbuff.c:2042 [<ffffffff849ccbef>] __skb_cow include/linux/skbuff.h:3571 [inline] [<ffffffff849ccbef>] skb_cow_head include/linux/skbuff.h:3605 [inline] [<ffffffff849ccbef>] batadv_skb_head_push+0x8f/0x110 net/batman-adv/soft-interface.c:72 [<ffffffff849ca643>] batadv_send_skb_packet+0x83/0x1c0 net/batman-adv/send.c:86 [<ffffffff8499f35a>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:392 [inline] [<ffffffff8499f35a>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline] [<ffffffff8499f35a>] batadv_iv_send_outstanding_bat_ogm_packet+0x32a/0x370 net/batman-adv/bat_iv_ogm.c:1700 [<ffffffff812b8d31>] process_one_work+0x2f1/0x640 kernel/workqueue.c:2600 [<ffffffff812b966c>] worker_thread+0x5c/0x5c0 kernel/workqueue.c:2751 [<ffffffff812c313b>] kthread+0x12b/0x170 kernel/kthread.c:389 [<ffffffff81140a5c>] ret_from_fork+0x2c/0x40 arch/x86/kernel/process.c:145 [<ffffffff81002be1>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 BUG: memory leak unreferenced object 0xffff888120ea2000 (size 240): comm "kworker/u4:5", pid 5210, jiffies 4295058872 (age 8.300s) hex dump (first 32 bytes): 00 28 ea 20 81 88 ff ff 00 00 00 00 00 00 00 00 .(. ............ 00 80 ec 1c 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff83e5e05a>] skb_clone+0xaa/0x190 net/core/skbuff.c:1860 [<ffffffff83f88552>] netem_enqueue+0xc62/0x1430 net/sched/sch_netem.c:479 [<ffffffff83e80975>] dev_qdisc_enqueue+0x25/0xf0 net/core/dev.c:3732 [<ffffffff83e8b217>] __dev_xmit_skb net/core/dev.c:3821 [inline] [<ffffffff83e8b217>] __dev_queue_xmit+0xdc7/0x17d0 net/core/dev.c:4169 [<ffffffff849ca710>] dev_queue_xmit include/linux/netdevice.h:3088 [inline] [<ffffffff849ca710>] batadv_send_skb_packet+0x150/0x1c0 net/batman-adv/send.c:108 [<ffffffff8499f35a>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:392 [inline] [<ffffffff8499f35a>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline] [<ffffffff8499f35a>] batadv_iv_send_outstanding_bat_ogm_packet+0x32a/0x370 net/batman-adv/bat_iv_ogm.c:1700 [<ffffffff812b8d31>] process_one_work+0x2f1/0x640 kernel/workqueue.c:2600 [<ffffffff812b966c>] worker_thread+0x5c/0x5c0 kernel/workqueue.c:2751 [<ffffffff812c313b>] kthread+0x12b/0x170 kernel/kthread.c:389 [<ffffffff81140a5c>] ret_from_fork+0x2c/0x40 arch/x86/kernel/process.c:145 [<ffffffff81002be1>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the bug is already fixed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite bug's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the bug is a duplicate of another bug, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup

1 0

[PATCH net] batman-adv: Hold rtnl lock during MTU update via netlink
by Sven Eckelmann 23 Aug '23

23 Aug '23

The automatic recalculation of the maximum allowed MTU is usually triggered by code sections which are already rtnl lock protected by callers outside of batman-adv. But when the fragmentation setting is changed via batman-adv's own batadv genl family, then the rtnl lock is not yet taken. But dev_set_mtu requires that the caller holds the rtnl lock because it uses netdevice notifiers. And this code will then fail the check for this lock: RTNL: assertion failed at net/core/dev.c (1953) Cc: stable(a)vger.kernel.org Reported-by: syzbot+f8812454d9b3ac00d282(a)syzkaller.appspotmail.com Fixes: c6a953cce8d0 ("batman-adv: Trigger events for auto adjusted MTU") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- This problem was just identified by syzbot [1]. I hope it is ok to directly send this patch to netdev instead of creating a single-patch PR from the batadv/net branch. If you still prefer a PR then we can also prepare it. [1] https://lore.kernel.org/r/0000000000009bbb4b0603717cde@google.com --- net/batman-adv/netlink.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/batman-adv/netlink.c b/net/batman-adv/netlink.c index ad5714f737be..6efbc9275aec 100644 --- a/net/batman-adv/netlink.c +++ b/net/batman-adv/netlink.c @@ -495,7 +495,10 @@ static int batadv_netlink_set_mesh(struct sk_buff *skb, struct genl_info *info) attr = info->attrs[BATADV_ATTR_FRAGMENTATION_ENABLED]; atomic_set(&bat_priv->fragmentation, !!nla_get_u8(attr)); + + rtnl_lock(); batadv_update_min_mtu(bat_priv->soft_iface); + rtnl_unlock(); } if (info->attrs[BATADV_ATTR_GW_BANDWIDTH_DOWN]) { --- base-commit: 421d467dc2d483175bad4fb76a31b9e5a3d744cf change-id: 20230821-batadv-missing-mtu-rtnl-lock-bc4cee67731d Best regards, -- Sven Eckelmann <sven(a)narfation.org>

3 2

[syzbot] [batman?] WARNING in call_netdevice_notifiers_info
by syzbot 21 Aug '23

21 Aug '23

Hello, syzbot found the following issue on: HEAD commit: d44036cad311 net: dsa: felix: fix oversize frame dropping .. git tree: net console+strace: https://syzkaller.appspot.com/x/log.txt?x=10f7ce23a80000 kernel config: https://syzkaller.appspot.com/x/.config?x=aa796b6080b04102 dashboard link: https://syzkaller.appspot.com/bug?extid=f8812454d9b3ac00d282 compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=125cb53ba80000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=131847f7a80000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/9936144a6193/disk-d44036ca.raw… vmlinux: https://storage.googleapis.com/syzbot-assets/1278ad87465f/vmlinux-d44036ca.… kernel image: https://storage.googleapis.com/syzbot-assets/b1a057709018/bzImage-d44036ca.… The issue was bisected to: commit c6a953cce8d0438391e6da48c8d0793d3fbfcfa6 Author: Sven Eckelmann <sven(a)narfation.org> Date: Wed Jul 19 07:29:29 2023 +0000 batman-adv: Trigger events for auto adjusted MTU bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=104ef373a80000 final oops: https://syzkaller.appspot.com/x/report.txt?x=124ef373a80000 console output: https://syzkaller.appspot.com/x/log.txt?x=144ef373a80000 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+f8812454d9b3ac00d282(a)syzkaller.appspotmail.com Fixes: c6a953cce8d0 ("batman-adv: Trigger events for auto adjusted MTU") ------------[ cut here ]------------ RTNL: assertion failed at net/core/dev.c (1953) WARNING: CPU: 0 PID: 5033 at net/core/dev.c:1953 call_netdevice_notifiers_info+0x107/0x130 net/core/dev.c:1953 Modules linked in: CPU: 0 PID: 5033 Comm: syz-executor368 Not tainted 6.5.0-rc6-syzkaller-00126-gd44036cad311 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 RIP: 0010:call_netdevice_notifiers_info+0x107/0x130 net/core/dev.c:1953 Code: f9 40 84 ed 75 8d e8 d8 68 5e f9 ba a1 07 00 00 48 c7 c6 e0 34 81 8b 48 c7 c7 20 35 81 8b c6 05 07 35 6e 06 01 e8 f9 2a 25 f9 <0f> 0b e9 62 ff ff ff 48 89 df e8 ea 75 b2 f9 e9 15 ff ff ff e8 e0 RSP: 0018:ffffc900039df2b8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffc900039df320 RCX: 0000000000000000 RDX: ffff88802d421dc0 RSI: ffffffff814ccc86 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000018 R13: ffff888078c30000 R14: ffff88807d45c0e8 R15: 0000000000000001 FS: 0000555555ccd380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000066a4e0 CR3: 000000007c0e3000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> call_netdevice_notifiers_extack net/core/dev.c:2000 [inline] call_netdevice_notifiers net/core/dev.c:2014 [inline] dev_set_mtu_ext+0x1e8/0x5d0 net/core/dev.c:8664 dev_set_mtu+0xb1/0x160 net/core/dev.c:8694 batadv_update_min_mtu+0x6e/0x90 net/batman-adv/hard-interface.c:645 batadv_netlink_set_mesh+0x7d8/0x14e0 net/batman-adv/netlink.c:498 genl_family_rcv_msg_doit.isra.0+0x1ef/0x2d0 net/netlink/genetlink.c:970 genl_family_rcv_msg net/netlink/genetlink.c:1050 [inline] genl_rcv_msg+0x559/0x800 net/netlink/genetlink.c:1067 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2549 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1078 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x539/0x800 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x93c/0xe30 net/netlink/af_netlink.c:1914 sock_sendmsg_nosec net/socket.c:725 [inline] sock_sendmsg+0xd9/0x180 net/socket.c:748 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2494 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2548 __sys_sendmsg+0x117/0x1e0 net/socket.c:2577 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7ff089227659 Code: 48 83 c4 28 c3 e8 d7 19 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdbc91ce88 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007ff089274390 RCX: 00007ff089227659 RDX: 0000000000000000 RSI: 00000000200005c0 RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000555500000000 R09: 0000555500000000 R10: 0000555500000000 R11: 0000000000000246 R12: 00007ffdbc91ced0 R13: 00007ffdbc91cea0 R14: 0000000000000001 R15: 00007ffdbc91ced0 </TASK> --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. For information about bisection process see: https://goo.gl/tpsmEJ#bisection If the bug is already fixed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite bug's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the bug is a duplicate of another bug, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup

1 0

[PATCH 0/7] pull request for net-next: batman-adv 2023-08-16
by Simon Wunderlich 18 Aug '23

18 Aug '23

Hi Jakub, hi David, here is a cleanup pull request of batman-adv to go into net-next. Please pull or let me know of any problem! Thank you, Simon The following changes since commit 06c2afb862f9da8dc5efa4b6076a0e48c3fbaaa5: Linux 6.5-rc1 (2023-07-09 13:53:13 -0700) are available in the Git repository at: git://git.open-mesh.org/linux-merge.git tags/batadv-next-pullrequest-20230816 for you to fetch changes up to 6f96d46f9a1ad1c02589b598c56ea881094129d8: batman-adv: Drop per algo GW section class code (2023-08-14 18:01:21 +0200) ---------------------------------------------------------------- This cleanup patchset includes the following patches: - bump version strings, by Simon Wunderlich - Remove unused declarations, by Yue Haibing - Clean up MTU handling, by Sven Eckelmann (2 patches) - Clean up/remove (obsolete) functions, by Sven Eckelmann (3 patches) ---------------------------------------------------------------- Simon Wunderlich (1): batman-adv: Start new development cycle Sven Eckelmann (5): batman-adv: Avoid magic value for minimum MTU batman-adv: Check hardif MTU against runtime MTU batman-adv: Drop unused function batadv_gw_bandwidth_set batman-adv: Keep batadv_netlink_notify_* static batman-adv: Drop per algo GW section class code YueHaibing (1): batman-adv: Remove unused declarations net/batman-adv/bat_iv_ogm.c | 1 + net/batman-adv/bat_v.c | 23 +----- net/batman-adv/gateway_common.c | 162 +--------------------------------------- net/batman-adv/gateway_common.h | 7 -- net/batman-adv/hard-interface.c | 20 +++-- net/batman-adv/main.h | 2 +- net/batman-adv/netlink.c | 15 ++-- net/batman-adv/netlink.h | 6 -- net/batman-adv/routing.h | 4 - net/batman-adv/soft-interface.c | 2 +- net/batman-adv/types.h | 7 +- 11 files changed, 28 insertions(+), 221 deletions(-)

2 7

[PATCH 0/5] pull request for net: batman-adv 2023-08-16
by Simon Wunderlich 18 Aug '23

18 Aug '23

Hi David, hi Jakub, here are a few bugfixes for batman-adv which we would like to have integrated into net. Please pull or let me know of any problem! Thank you, Simon The following changes since commit 06c2afb862f9da8dc5efa4b6076a0e48c3fbaaa5: Linux 6.5-rc1 (2023-07-09 13:53:13 -0700) are available in the Git repository at: git://git.open-mesh.org/linux-merge.git tags/batadv-net-pullrequest-20230816 for you to fetch changes up to 421d467dc2d483175bad4fb76a31b9e5a3d744cf: batman-adv: Fix batadv_v_ogm_aggr_send memory leak (2023-08-09 17:33:03 +0200) ---------------------------------------------------------------- Here are some batman-adv bugfixes: - Fix issues with adjusted MTUs (2 patches), by Sven Eckelmann - Fix header access for memory reallocation case, by Remi Pommarel - Fix two memory leaks (2 patches), by Remi Pommarel ---------------------------------------------------------------- Remi Pommarel (3): batman-adv: Do not get eth header before batadv_check_management_packet batman-adv: Fix TT global entry leak when client roamed back batman-adv: Fix batadv_v_ogm_aggr_send memory leak Sven Eckelmann (2): batman-adv: Trigger events for auto adjusted MTU batman-adv: Don't increase MTU when set by user net/batman-adv/bat_v_elp.c | 3 ++- net/batman-adv/bat_v_ogm.c | 7 +++++-- net/batman-adv/hard-interface.c | 14 +++++++++++++- net/batman-adv/soft-interface.c | 3 +++ net/batman-adv/translation-table.c | 1 - net/batman-adv/types.h | 6 ++++++ 6 files changed, 29 insertions(+), 5 deletions(-)

2 6

[PATCH v6 0/3] Implementation of a Stateless Multicast Packet Type
by Linus Lüssing 14 Aug '23

14 Aug '23

Hi, The following patchset implements a stateless, TVLV capable batman-adv multicast packet type. The new batman-adv multicast packet type allows to contain several originator destination MAC addresses within a TVLV. Routers on the way will potentially split the batman-adv multicast packet and adjust its tracker TVLV contents. Routing decisions are still based on the selected BATMAN IV or BATMAN V routing algorithm. So this new batman-adv multicast packet type retains the same loop-free properties. The purpose of this new packet type is to allow to forward an IP multicast packet with less transmissions / overhead than the multicast-via-multiple-unicasts approach. Or to reach a lot more destinations (currently up to 196, depending on the payload size, see Wiki documentation for details) than with the default multicast fanout for the via-unicasts approach. This will allow using applications like mDNS again in several Freifunk communities. And with less transmissions will also make more bulky multicast applications, like media streaming (to an assessable amount of receivers) a lot more feasible. This approach is way simpler than the original multicast (tracker) packet approach we envisioned years ago. As it involves no maintenance of an extra, state based multicast routing table. However the TVLV capability should allow to extend things later, to split control and data plane a bit more for instance, to further increase the number of destinations, to further reduce overhead. A compact overview can be found in the Wiki here, including limitations: https://www.open-mesh.org/projects/batman-adv/wiki/Multicast-Packet-Type Regards, Linus --- Changelog v6: * PATCH 2/3: * add missing include of linux/compiler.h for the newly added likely() in v5 * added kerneldoc for @num_dests_pushed to the in v5 newly added batadv_mcast_forw_push_adjust_padding() * updated kerneldoc of batadv_mcast_forw_push_adjust_padding(), original text was wrongly copy & pasted from batadv_mcast_forw_push_est_padding() without adjustments * PATCH 3/3: * added missing "static" attribute to the newly added batadv_mcast_forw_shrink_align_offset() in v5 Changelog v5: * removed patches 1/5 + 2/5, as they were already applied * rebased to current main branch * changed padding behaviour: * now 2 bytes padding on the end of the multicast tracker TVLV, if number of destination nodes is even * as number of destination nodes might change between initial check until after pushing them, functions to post-adjust padding after pushing were added * added/fixed TTL handling * removed skb_pull() bailing from sub-functions of batadv_mcast_forw_push(), to only have a single skb_pull() to keep track of in batadv_mcast_forw_push() to revert the changes to the skb; instead a "unsigned short *tvlv_len" is passsed along in batadv_mcast_.*push.*() functions to keep track of how many bytes were pushed * moved + verified skb->ip_summed invalidation * batadv_mcast_forw_shrink_tracker() xmas tree ordering * reword batadv_mcast_forw_push_dest() "Return:" kerneldoc * fixed spelling: outter -> outer Changelog v4: * PATCH 4/5: * add missing include for linux/types.h in multicast.h * add missing kerneldoc for @bat_priv in batadv_mcast_forw_push_dest() and batadv_mcast_forw_push_tvlvs() * use sizeof_field(type, field) instead of sizeof(((type *)0)->field) in batadv_mcast_forw_push_dest() * PATCH 5/5: * rename num_dests_remove to num_dests_reduce in batadv_mcast_forw_shrink_align_offse() to fix kerneldocs and for consistency * fix typo in kerneldoc in batadv_mcast_forw_shrink_update_headers() -> @num_dest_reduce -> @num_dests_reduce * use sizeof_field(type, field) instead of sizeof(((type *)0)->field) in batadv_mcast_forw_shrink_align_offset() Changelog v3: * PATCH 1/5: * remove now obsolete includes * PATCH 2/5: * fix batadv_tvlv_handler_register() in network-coding.c * add missing include for linux/skbuff.h * move variable declarations out of the switch case in batadv_tvlv_call_handler() * PATCH 3/5: * remove unnecessary include of multicast.h in routing.c * add a few missing includes to multicast_forw.c (linux/byteorder/generic.h, linux/errno.h, linux/gfp.h, linux/stddef.h uapi/linux/batadv_packet.h, multicast.h) * PATCH 4/5: * add missing rcu_read_unlock() in error case before returning in batadv_mcast_forw_push_dests_list() * remove unnecessary include of soft-interface.h in multicast_forw.c * add a few missing includes to multicast_forw.c (linux/bug.h, linux/build_bug.h, linux/limits.h, linux/rculist.h, linux/rcupdate.h, linux/string.h) * make batadv_mcast_forw_mode_by_count() static * fix return types in the declaration of batadv_mcast_forw_packet_hdrlen() and batadv_mcast_forw_push() in multicast.h * fix typo in commit message: "that the are capable of" -> "that the*y* are capable of" * PATCH 5/5: * make batadv_mcast_forw_shrink_pack_dests() adhere to 80 characters per line for consistency * add a "continue" statement after the jump label in batadv_mcast_forw_shrink_pack_dests() to silence the sparse error "error: label at end of compound statement" Changelog v2: * Add "[PATCH v2 0/5]" prefix to title of cover letter, so that Patchwork can hopefully find it - no other changes

3 11

[PATCH net] batman-adv: Fix batadv_v_ogm_aggr_send memory leak
by Remi Pommarel 09 Aug '23

09 Aug '23

When batadv_v_ogm_aggr_send is called for an inactive interface, the skb is silently dropped by batadv_v_ogm_send_to_if() but never freed causing the following memory leak: unreferenced object 0xffff00000c164800 (size 512): comm "kworker/u8:1", pid 2648, jiffies 4295122303 (age 97.656s) hex dump (first 32 bytes): 00 80 af 09 00 00 ff ff e1 09 00 00 75 01 60 83 ............u.`. 1f 00 00 00 b8 00 00 00 15 00 05 00 da e3 d3 64 ...............d backtrace: [<0000000007ad20f6>] __kmalloc_track_caller+0x1a8/0x310 [<00000000d1029e55>] kmalloc_reserve.constprop.0+0x70/0x13c [<000000008b9d4183>] __alloc_skb+0xec/0x1fc [<00000000c7af5051>] __netdev_alloc_skb+0x48/0x23c [<00000000642ee5f5>] batadv_v_ogm_aggr_send+0x50/0x36c [<0000000088660bd7>] batadv_v_ogm_aggr_work+0x24/0x40 [<0000000042fc2606>] process_one_work+0x3b0/0x610 [<000000002f2a0b1c>] worker_thread+0xa0/0x690 [<0000000059fae5d4>] kthread+0x1fc/0x210 [<000000000c587d3a>] ret_from_fork+0x10/0x20 Free the skb in that case to fix this leak. Cc: stable(a)vger.kernel.org Fixes: 0da0035942d4 ("batman-adv: OGMv2 - add basic infrastructure") Signed-off-by: Remi Pommarel <repk(a)triplefau.lt> --- net/batman-adv/bat_v_ogm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c index e710e9afe78f..445b06fc0d90 100644 --- a/net/batman-adv/bat_v_ogm.c +++ b/net/batman-adv/bat_v_ogm.c @@ -123,8 +123,10 @@ static void batadv_v_ogm_send_to_if(struct sk_buff *skb, { struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface); - if (hard_iface->if_status != BATADV_IF_ACTIVE) + if (hard_iface->if_status != BATADV_IF_ACTIVE) { + kfree_skb(skb); return; + } batadv_inc_counter(bat_priv, BATADV_CNT_MGMT_TX); batadv_add_counter(bat_priv, BATADV_CNT_MGMT_TX_BYTES, -- 2.40.0

2 1

[PATCH net] batman-adv: Fix TT global entry leak when client roamed back
by Remi Pommarel 05 Aug '23

05 Aug '23

When a client roamed back to a node before it got time to destroy the pending local entry (i.e. within the same originator interval) the old global one is directly removed from hash table and left as such. But because this entry had an extra reference taken at lookup (i.e using batadv_tt_global_hash_find) there is no way its memory will be reclaimed at any time causing the following memory leak: unreferenced object 0xffff0000073c8000 (size 18560): comm "softirq", pid 0, jiffies 4294907738 (age 228.644s) hex dump (first 32 bytes): 06 31 ac 12 c7 7a 05 00 01 00 00 00 00 00 00 00 .1...z.......... 2c ad be 08 00 80 ff ff 6c b6 be 08 00 80 ff ff ,.......l....... backtrace: [<00000000ee6e0ffa>] kmem_cache_alloc+0x1b4/0x300 [<000000000ff2fdbc>] batadv_tt_global_add+0x700/0xe20 [<00000000443897c7>] _batadv_tt_update_changes+0x21c/0x790 [<000000005dd90463>] batadv_tt_update_changes+0x3c/0x110 [<00000000a2d7fc57>] batadv_tt_tvlv_unicast_handler_v1+0xafc/0xe10 [<0000000011793f2a>] batadv_tvlv_containers_process+0x168/0x2b0 [<00000000b7cbe2ef>] batadv_recv_unicast_tvlv+0xec/0x1f4 [<0000000042aef1d8>] batadv_batman_skb_recv+0x25c/0x3a0 [<00000000bbd8b0a2>] __netif_receive_skb_core.isra.0+0x7a8/0xe90 [<000000004033d428>] __netif_receive_skb_one_core+0x64/0x74 [<000000000f39a009>] __netif_receive_skb+0x48/0xe0 [<00000000f2cd8888>] process_backlog+0x174/0x344 [<00000000507d6564>] __napi_poll+0x58/0x1f4 [<00000000b64ef9eb>] net_rx_action+0x504/0x590 [<00000000056fa5e4>] _stext+0x1b8/0x418 [<00000000878879d6>] run_ksoftirqd+0x74/0xa4 unreferenced object 0xffff00000bae1a80 (size 56): comm "softirq", pid 0, jiffies 4294910888 (age 216.092s) hex dump (first 32 bytes): 00 78 b1 0b 00 00 ff ff 0d 50 00 00 00 00 00 00 .x.......P...... 00 00 00 00 00 00 00 00 50 c8 3c 07 00 00 ff ff ........P.<..... backtrace: [<00000000ee6e0ffa>] kmem_cache_alloc+0x1b4/0x300 [<00000000d9aaa49e>] batadv_tt_global_add+0x53c/0xe20 [<00000000443897c7>] _batadv_tt_update_changes+0x21c/0x790 [<000000005dd90463>] batadv_tt_update_changes+0x3c/0x110 [<00000000a2d7fc57>] batadv_tt_tvlv_unicast_handler_v1+0xafc/0xe10 [<0000000011793f2a>] batadv_tvlv_containers_process+0x168/0x2b0 [<00000000b7cbe2ef>] batadv_recv_unicast_tvlv+0xec/0x1f4 [<0000000042aef1d8>] batadv_batman_skb_recv+0x25c/0x3a0 [<00000000bbd8b0a2>] __netif_receive_skb_core.isra.0+0x7a8/0xe90 [<000000004033d428>] __netif_receive_skb_one_core+0x64/0x74 [<000000000f39a009>] __netif_receive_skb+0x48/0xe0 [<00000000f2cd8888>] process_backlog+0x174/0x344 [<00000000507d6564>] __napi_poll+0x58/0x1f4 [<00000000b64ef9eb>] net_rx_action+0x504/0x590 [<00000000056fa5e4>] _stext+0x1b8/0x418 [<00000000878879d6>] run_ksoftirqd+0x74/0xa4 Releasing the extra reference from batadv_tt_global_hash_find even at roam back when batadv_tt_global_free is called fixes this memory leak. Cc: stable(a)vger.kernel.org Fixes: 068ee6e204e1 ("batman-adv: roaming handling mechanism redesign") Signed-off-by: Remi Pommarel <repk(a)triplefau.lt> --- net/batman-adv/translation-table.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index 36ca31252a73..b95c36765d04 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -774,7 +774,6 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const u8 *addr, if (roamed_back) { batadv_tt_global_free(bat_priv, tt_global, "Roaming canceled"); - tt_global = NULL; } else { /* The global entry has to be marked as ROAMING and * has to be kept for consistency purpose -- 2.40.0

2 1

[PATCH 0/3] batman-adv: Drop ununused functions and localize when possible
by Sven Eckelmann 02 Aug '23

02 Aug '23

There were a couple of functions which were still compiled but not used anymore since a while. Just drop them and make sure that other ones are local only (to make it easier to spot them in the future). Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- Sven Eckelmann (3): batman-adv: Drop unused function batadv_gw_bandwidth_set batman-adv: Keep batadv_netlink_notify_* static batman-adv: Drop per algo GW section class code net/batman-adv/bat_iv_ogm.c | 1 + net/batman-adv/bat_v.c | 23 +----- net/batman-adv/gateway_common.c | 162 +--------------------------------------- net/batman-adv/gateway_common.h | 7 -- net/batman-adv/netlink.c | 15 ++-- net/batman-adv/netlink.h | 6 -- net/batman-adv/types.h | 7 +- 7 files changed, 13 insertions(+), 208 deletions(-) --- base-commit: ed12d0c16556942c4fd52af122030182c11e60ef change-id: 20230802-cleanup_functions-2946498ebebc Best regards, -- Sven Eckelmann <sven(a)narfation.org>

1 3

[PATCH 1/2] batctl: mcast_flags: update to current state
by Linus Lüssing 01 Aug '23

01 Aug '23

Add the new "P" flag, which signals support for the new batman-adv multicast packet type, to the "batctl mcast_flags" and "batctl tcpdump" outputs. The examples in the README.rst are updated, too, including a description for the R4 and R6 flags. Signed-off-by: Linus Lüssing <linus.luessing(a)c0d3.blue> --- README.rst | 88 ++++++++++++++++++++++++++++--------------------- batadv_packet.h | 45 +++++++++++++++++++++---- genl_json.c | 2 ++ mcast_flags.c | 8 +++-- tcpdump.c | 5 +-- 5 files changed, 100 insertions(+), 48 deletions(-) diff --git a/README.rst b/README.rst index 606d55721204..3495fba02e0e 100644 --- a/README.rst +++ b/README.rst @@ -323,15 +323,15 @@ Usage:: Example:: - Multicast flags (own flags: [U46]) + Multicast flags (own flags: [U46R4R6.]) * Bridged [U] U * No IGMP/MLD Querier [4/6]: ./. * Shadowing IGMP/MLD Querier [4/6]: 4/6 ------------------------------------------- Originator Flags - 02:04:64:a4:39:c1 [U..] - 02:04:64:a4:39:c2 [U..] - 02:04:64:a4:39:c3 [...] + 02:04:64:a4:39:c1 [U... . .] + 02:04:64:a4:39:c2 [...R4R6.] + 02:04:64:a4:39:c3 [.... . P] where @@ -348,6 +348,17 @@ U: 6: wants all IPv6 multicast traffic, meaning other nodes need to always forward any IPv6 multicast traffic to it +R4: + wants all routable IPv4 multicast traffic, meaning other nodes need to always + forward multicast traffic destined to 224.0.0.0/4 excluding 224.0.0.0/24 to + it +R6: + wants all routable IPv6 multicast traffic, meaning other nodes need to always + forward multicast traffic destined to ffXY::/16 with Y > 2 (scope greater + than link-local) to it +P: + the node either cannot handle batman-adv multicast packets with a multicast + tracker TVLV or one of its hard interfaces has an MTU smaller than 1280 bytes If a node does not have multicast optimizations available (e.g. old batman-adv version or optimizations not compiled in), therefore not announcing any @@ -930,39 +941,42 @@ Example:: $ batctl meshif bat0 mcast_flags_json | json_pp [ - { - "mcast_flags": { - "all_unsnoopables": true, - "raw": 1, - "want_all_ipv4": false, - "want_all_ipv6": false, - "want_no_rtr_ipv4": false, - "want_no_rtr_ipv6": false - }, - "orig_address": "9e:58:32:59:54:c3" - }, - { - "mcast_flags": { - "all_unsnoopables": true, - "raw": 1, - "want_all_ipv4": false, - "want_all_ipv6": false, - "want_no_rtr_ipv4": false, - "want_no_rtr_ipv6": false - }, - "orig_address": "32:12:17:0a:21:63" - }, - { - "mcast_flags": { - "all_unsnoopables": true, - "raw": 1, - "want_all_ipv4": false, - "want_all_ipv6": false, - "want_no_rtr_ipv4": false, - "want_no_rtr_ipv6": false - }, - "orig_address": "1a:34:8c:c4:fe:13" - }, + { + "mcast_flags" : { + "all_unsnoopables" : true, + "have_mc_ptype_capa" : true, + "raw" : 57, + "want_all_ipv4" : false, + "want_all_ipv6" : false, + "want_no_rtr_ipv4" : true, + "want_no_rtr_ipv6" : true + }, + "orig_address" : "02:04:64:a4:39:c1" + }, + { + "mcast_flags" : { + "all_unsnoopables" : false, + "have_mc_ptype_capa" : true, + "raw" : 40, + "want_all_ipv4" : false, + "want_all_ipv6" : false, + "want_no_rtr_ipv4" : true, + "want_no_rtr_ipv6" : false + }, + "orig_address" : "02:04:64:a4:39:c2" + }, + { + "mcast_flags" : { + "all_unsnoopables" : false, + "have_mc_ptype_capa" : false, + "raw" : 24, + "want_all_ipv4" : false, + "want_all_ipv6" : false, + "want_no_rtr_ipv4" : true, + "want_no_rtr_ipv6" : true + }, + "orig_address" : "02:04:64:a4:39:c3" + }, [...] ] diff --git a/batadv_packet.h b/batadv_packet.h index 9204e4494b25..6e25753015df 100644 --- a/batadv_packet.h +++ b/batadv_packet.h @@ -116,6 +116,9 @@ enum batadv_icmp_packettype { * only need routable IPv4 multicast packets we signed up for explicitly * @BATADV_MCAST_WANT_NO_RTR6: we have no IPv6 multicast router and therefore * only need routable IPv6 multicast packets we signed up for explicitly + * @BATADV_MCAST_HAVE_MC_PTYPE_CAPA: we can parse, receive and forward + * batman-adv multicast packets with a multicast tracker TVLV. And all our + * hard interfaces have an MTU of at least 1280 bytes. */ enum batadv_mcast_flags { BATADV_MCAST_WANT_ALL_UNSNOOPABLES = 1UL << 0, @@ -123,6 +126,7 @@ enum batadv_mcast_flags { BATADV_MCAST_WANT_ALL_IPV6 = 1UL << 2, BATADV_MCAST_WANT_NO_RTR4 = 1UL << 3, BATADV_MCAST_WANT_NO_RTR6 = 1UL << 4, + BATADV_MCAST_HAVE_MC_PTYPE_CAPA = 1UL << 5, }; /* tt data subtypes */ @@ -174,14 +178,16 @@ enum batadv_bla_claimframe { * @BATADV_TVLV_TT: translation table tvlv * @BATADV_TVLV_ROAM: roaming advertisement tvlv * @BATADV_TVLV_MCAST: multicast capability tvlv + * @BATADV_TVLV_MCAST_TRACKER: multicast tracker tvlv */ enum batadv_tvlv_type { - BATADV_TVLV_GW = 0x01, - BATADV_TVLV_DAT = 0x02, - BATADV_TVLV_NC = 0x03, - BATADV_TVLV_TT = 0x04, - BATADV_TVLV_ROAM = 0x05, - BATADV_TVLV_MCAST = 0x06, + BATADV_TVLV_GW = 0x01, + BATADV_TVLV_DAT = 0x02, + BATADV_TVLV_NC = 0x03, + BATADV_TVLV_TT = 0x04, + BATADV_TVLV_ROAM = 0x05, + BATADV_TVLV_MCAST = 0x06, + BATADV_TVLV_MCAST_TRACKER = 0x07, }; #pragma pack(2) @@ -487,6 +493,25 @@ struct batadv_bcast_packet { */ }; +/** + * struct batadv_mcast_packet - multicast packet for network payload + * @packet_type: batman-adv packet type, part of the general header + * @version: batman-adv protocol version, part of the general header + * @ttl: time to live for this packet, part of the general header + * @reserved: reserved byte for alignment + * @tvlv_len: length of the appended tvlv buffer (in bytes) + */ +struct batadv_mcast_packet { + __u8 packet_type; + __u8 version; + __u8 ttl; + __u8 reserved; + __be16 tvlv_len; + /* "4 bytes boundary + 2 bytes" long to make the payload after the + * following ethernet header again 4 bytes boundary aligned + */ +}; + /** * struct batadv_coded_packet - network coded packet * @packet_type: batman-adv packet type, part of the general header @@ -628,6 +653,14 @@ struct batadv_tvlv_mcast_data { __u8 reserved[3]; }; +/** + * struct batadv_tvlv_mcast_tracker - payload of a multicast tracker tvlv + * @num_dests: number of subsequent destination originator MAC addresses + */ +struct batadv_tvlv_mcast_tracker { + __be16 num_dests; +}; + #pragma pack() #endif /* _UAPI_LINUX_BATADV_PACKET_H_ */ diff --git a/genl_json.c b/genl_json.c index 2be533d064e0..4cb1bafca8ef 100644 --- a/genl_json.c +++ b/genl_json.c @@ -157,6 +157,8 @@ static void nljson_print_mcastflags(struct nlattr *attrs[], int idx) val & BATADV_MCAST_WANT_NO_RTR4 ? "true" : "false"); printf("\"want_no_rtr_ipv6\": %s,", val & BATADV_MCAST_WANT_NO_RTR6 ? "true" : "false"); + printf("\"have_mc_ptype_capa\": %s,", + val & BATADV_MCAST_HAVE_MC_PTYPE_CAPA ? "true" : "false"); printf("\"raw\": %"PRIu32, val); putchar('}'); } diff --git a/mcast_flags.c b/mcast_flags.c index 44344e0c1f61..7d4c1d69adfb 100644 --- a/mcast_flags.c +++ b/mcast_flags.c @@ -80,12 +80,13 @@ static int mcast_flags_callback(struct nl_msg *msg, void *arg) if (attrs[BATADV_ATTR_MCAST_FLAGS]) { flags = nla_get_u32(attrs[BATADV_ATTR_MCAST_FLAGS]); - printf("[%c%c%c%s%s]\n", + printf("[%c%c%c%s%s%c]\n", flags & BATADV_MCAST_WANT_ALL_UNSNOOPABLES ? 'U' : '.', flags & BATADV_MCAST_WANT_ALL_IPV4 ? '4' : '.', flags & BATADV_MCAST_WANT_ALL_IPV6 ? '6' : '.', !(flags & BATADV_MCAST_WANT_NO_RTR4) ? "R4" : ". ", - !(flags & BATADV_MCAST_WANT_NO_RTR6) ? "R6" : ". "); + !(flags & BATADV_MCAST_WANT_NO_RTR6) ? "R6" : ". ", + !(flags & BATADV_MCAST_HAVE_MC_PTYPE_CAPA) ? 'P' : '.'); } else { printf("-\n"); } @@ -125,7 +126,7 @@ static int netlink_print_mcast_flags(struct state *state, char *orig_iface, } ret = asprintf(&header, - "Multicast flags (own flags: [%c%c%c%s%s])\n" + "Multicast flags (own flags: [%c%c%c%s%s%c])\n" "* Bridged [U]\t\t\t\t%c\n" "* No IGMP/MLD Querier [4/6]:\t\t%c/%c\n" "* Shadowing IGMP/MLD Querier [4/6]:\t%c/%c\n" @@ -136,6 +137,7 @@ static int netlink_print_mcast_flags(struct state *state, char *orig_iface, (mcast_flags & BATADV_MCAST_WANT_ALL_IPV6) ? '6' : '.', !(mcast_flags & BATADV_MCAST_WANT_NO_RTR4) ? "R4" : ". ", !(mcast_flags & BATADV_MCAST_WANT_NO_RTR6) ? "R6" : ". ", + !(mcast_flags & BATADV_MCAST_HAVE_MC_PTYPE_CAPA) ? 'P' : '.', bridged ? 'U' : '.', querier4, querier6, shadowing4, shadowing6, "Originator", "Flags"); diff --git a/tcpdump.c b/tcpdump.c index 9a830b2ba8b2..debcb0ae517a 100644 --- a/tcpdump.c +++ b/tcpdump.c @@ -231,12 +231,13 @@ static void batctl_tvlv_parse_mcast_v2(void *buff, ssize_t buff_len) flags = tvlv->flags; - printf("\tTVLV MCASTv2: [%c%c%c%s%s]\n", + printf("\tTVLV MCASTv2: [%c%c%c%s%s%c]\n", flags & BATADV_MCAST_WANT_ALL_UNSNOOPABLES ? 'U' : '.', flags & BATADV_MCAST_WANT_ALL_IPV4 ? '4' : '.', flags & BATADV_MCAST_WANT_ALL_IPV6 ? '6' : '.', !(flags & BATADV_MCAST_WANT_NO_RTR4) ? "R4" : ". ", - !(flags & BATADV_MCAST_WANT_NO_RTR6) ? "R6" : ". "); + !(flags & BATADV_MCAST_WANT_NO_RTR6) ? "R6" : ". ", + !(flags & BATADV_MCAST_HAVE_MC_PTYPE_CAPA) ? 'P' : '.'); } typedef void (*batctl_tvlv_parser_t)(void *buff, ssize_t buff_len); -- 2.40.1

1 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

B.A.T.M.A.N August 2023