B.A.T.M.A.N January 2024

b.a.t.m.a.n@lists.open-mesh.org

8 participants
10 discussions

[PATCH net v2] bridge: mcast: fix disabled snooping after long uptime
by Linus Lüssing 31 Jan '24

31 Jan '24

The original idea of the delay_time check was to not apply multicast snooping too early when an MLD querier appears. And to instead wait at least for MLD reports to arrive before switching from flooding to group based, MLD snooped forwarding, to avoid temporary packet loss. However in a batman-adv mesh network it was noticed that after 248 days of uptime 32bit MIPS based devices would start to signal that they had stopped applying multicast snooping due to missing queriers - even though they were the elected querier and still sending MLD queries themselves. While time_is_before_jiffies() generally is safe against jiffies wrap-arounds, like the code comments in jiffies.h explain, it won't be able to track a difference larger than ULONG_MAX/2. With a 32bit large jiffies and one jiffies tick every 10ms (CONFIG_HZ=100) on these MIPS devices running OpenWrt this would result in a difference larger than ULONG_MAX/2 after 248 (= 2^32/100/60/60/24/2) days and time_is_before_jiffies() would then start to return false instead of true. Leading to multicast snooping not being applied to multicast packets anymore. Fix this issue by using a proper timer_list object which won't have this ULONG_MAX/2 difference limitation. Fixes: b00589af3b04 ("bridge: disable snooping if there is no querier") Signed-off-by: Linus Lüssing <linus.luessing(a)c0d3.blue> --- Changelog v2: * removed "inline" from br_multicast_query_delay_expired() net/bridge/br_multicast.c | 20 +++++++++++++++----- net/bridge/br_private.h | 4 ++-- 2 files changed, 17 insertions(+), 7 deletions(-) diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c index d7d021af1029..2d7b73242958 100644 --- a/net/bridge/br_multicast.c +++ b/net/bridge/br_multicast.c @@ -1762,6 +1762,10 @@ static void br_ip6_multicast_querier_expired(struct timer_list *t) } #endif +static void br_multicast_query_delay_expired(struct timer_list *t) +{ +} + static void br_multicast_select_own_querier(struct net_bridge_mcast *brmctx, struct br_ip *ip, struct sk_buff *skb) @@ -3198,7 +3202,7 @@ br_multicast_update_query_timer(struct net_bridge_mcast *brmctx, unsigned long max_delay) { if (!timer_pending(&query->timer)) - query->delay_time = jiffies + max_delay; + mod_timer(&query->delay_timer, jiffies + max_delay); mod_timer(&query->timer, jiffies + brmctx->multicast_querier_interval); } @@ -4041,13 +4045,11 @@ void br_multicast_ctx_init(struct net_bridge *br, brmctx->multicast_querier_interval = 255 * HZ; brmctx->multicast_membership_interval = 260 * HZ; - brmctx->ip4_other_query.delay_time = 0; brmctx->ip4_querier.port_ifidx = 0; seqcount_spinlock_init(&brmctx->ip4_querier.seq, &br->multicast_lock); brmctx->multicast_igmp_version = 2; #if IS_ENABLED(CONFIG_IPV6) brmctx->multicast_mld_version = 1; - brmctx->ip6_other_query.delay_time = 0; brmctx->ip6_querier.port_ifidx = 0; seqcount_spinlock_init(&brmctx->ip6_querier.seq, &br->multicast_lock); #endif @@ -4056,6 +4058,8 @@ void br_multicast_ctx_init(struct net_bridge *br, br_ip4_multicast_local_router_expired, 0); timer_setup(&brmctx->ip4_other_query.timer, br_ip4_multicast_querier_expired, 0); + timer_setup(&brmctx->ip4_other_query.delay_timer, + br_multicast_query_delay_expired, 0); timer_setup(&brmctx->ip4_own_query.timer, br_ip4_multicast_query_expired, 0); #if IS_ENABLED(CONFIG_IPV6) @@ -4063,6 +4067,8 @@ void br_multicast_ctx_init(struct net_bridge *br, br_ip6_multicast_local_router_expired, 0); timer_setup(&brmctx->ip6_other_query.timer, br_ip6_multicast_querier_expired, 0); + timer_setup(&brmctx->ip6_other_query.delay_timer, + br_multicast_query_delay_expired, 0); timer_setup(&brmctx->ip6_own_query.timer, br_ip6_multicast_query_expired, 0); #endif @@ -4197,10 +4203,12 @@ static void __br_multicast_stop(struct net_bridge_mcast *brmctx) { del_timer_sync(&brmctx->ip4_mc_router_timer); del_timer_sync(&brmctx->ip4_other_query.timer); + del_timer_sync(&brmctx->ip4_other_query.delay_timer); del_timer_sync(&brmctx->ip4_own_query.timer); #if IS_ENABLED(CONFIG_IPV6) del_timer_sync(&brmctx->ip6_mc_router_timer); del_timer_sync(&brmctx->ip6_other_query.timer); + del_timer_sync(&brmctx->ip6_other_query.delay_timer); del_timer_sync(&brmctx->ip6_own_query.timer); #endif } @@ -4643,13 +4651,15 @@ int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val) max_delay = brmctx->multicast_query_response_interval; if (!timer_pending(&brmctx->ip4_other_query.timer)) - brmctx->ip4_other_query.delay_time = jiffies + max_delay; + mod_timer(&brmctx->ip4_other_query.delay_timer, + jiffies + max_delay); br_multicast_start_querier(brmctx, &brmctx->ip4_own_query); #if IS_ENABLED(CONFIG_IPV6) if (!timer_pending(&brmctx->ip6_other_query.timer)) - brmctx->ip6_other_query.delay_time = jiffies + max_delay; + mod_timer(&brmctx->ip6_other_query.delay_timer, + jiffies + max_delay); br_multicast_start_querier(brmctx, &brmctx->ip6_own_query); #endif diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h index b0a92c344722..86ea5e6689b5 100644 --- a/net/bridge/br_private.h +++ b/net/bridge/br_private.h @@ -78,7 +78,7 @@ struct bridge_mcast_own_query { /* other querier */ struct bridge_mcast_other_query { struct timer_list timer; - unsigned long delay_time; + struct timer_list delay_timer; }; /* selected querier */ @@ -1159,7 +1159,7 @@ __br_multicast_querier_exists(struct net_bridge_mcast *brmctx, own_querier_enabled = false; } - return time_is_before_jiffies(querier->delay_time) && + return !timer_pending(&querier->delay_timer) && (own_querier_enabled || timer_pending(&querier->timer)); } -- 2.43.0

3 2

Problem starting A.L.F.R.E.D on batman-adv?
by doug.fajardo＠gmail.com 29 Jan '24

29 Jan '24

I cant seem to get A.L.F.R.E.D. to start: doug@dougwork:~/sdshome/alfred$ sudo alfred -b bat0 Can't start server: interface missing batman-adv module is from the Unix kernel distribution (Alfred was added thru the apt package manager, identified as version 2022.0-1 ( I also tried downloading and compiling; no warnings or errors compiling, I saw identical symptoms). The batman-adv network seems to be working properly. It correctly sees two other nodes. Can anyone point out what I am missing ? Thanks! *** Doug OS is Ubuntu bookworm, with latest patches as of today (1/28/2023) doug@dougwork: uname -a Linux dougwork 6.5.0-15-generic #15~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Fri Jan 12 18:54:30 UTC 2 x86_64 x86_64 x86_64 GNU/Linux doug@dougwork: sudo batctl n [B.A.T.M.A.N. adv 2023.1, MainIF/MAC: enp6s0/5c:62:8b:ea:33:b8 (bat0/6e:d4:b2:77:d1:85 BATMAN_IV)] IF Neighbor last-seen enp6s0 d8:3a:dd:4d:35:c4 0.192s enp6s0 dc:a6:32:0b:49:35 0.392s doug@dougwork: ifconfig enp6s0 enp6s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 ether 5c:62:8b:ea:33:b8 txqueuelen 1000 (Ethernet) RX packets 85660 bytes 5364556 (5.3 MB) RX errors 0 dropped 4109 overruns 0 frame 0 TX packets 75996 bytes 104561707 (104.5 MB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

4 3

[PATCH 0/6] batctl: tcpdump: Fix problems detected during fuzzing
by Sven Eckelmann 27 Jan '24

27 Jan '24

While many parts of batctl are rather simple, tcpdump is one of the most complex parts - which unfortunately is also dealing all the time with potentially harmful input. It is therefore a good idea to perform some tests to figure out how bad the current state of the code is. The findings will be presented here - including some information how other people can reproduce these problems. With afl++, it is possible to fuzz batctl tcpdump and find parsing errors (easier). But it needs an entry point to actually send data to. So for simplicity, a fuzzme subcommand was added which just gets new data from afl++ and then runs the main ethernet parsing function. diff --git a/split_pcap.py b/split_pcap.py new file mode 100755 index 0000000000000000000000000000000000000000..11a1f5ce8ec60fac141693b0449d5c3955f9ad28 --- /dev/null +++ b/split_pcap.py @@ -0,0 +1,21 @@ +#!/usr/bin/env python3 + +import sys + +from hashlib import sha256 +from scapy.utils import rdpcap + + +def main(): + for pcap in sys.argv[1:]: + packets = rdpcap(pcap) + for packet in packets: + m = sha256() + m.update(packet.load) + fname = m.hexdigest() + with open(fname, "wb") as f: + f.write(packet.load) + + +if __name__ == "__main__": + main() diff --git a/tcpdump.c b/tcpdump.c index 5e7c76c69bd192d7485958aafabc0e9264b41b90..d340af986f99bdf2e8e6dae0d91a641bc80e82a2 100644 --- a/tcpdump.c +++ b/tcpdump.c @@ -1556,3 +1556,41 @@ static int tcpdump(struct state *state __maybe_unused, int argc, char **argv) COMMAND(SUBCOMMAND, tcpdump, "td", 0, NULL, "<interface> \ttcpdump layer 2 traffic on the given interface"); + +__AFL_FUZZ_INIT(); + +static int fuzzme(struct state *state __maybe_unused, int argc, char **argv) +{ + dump_level = dump_level_all; + +#ifdef __AFL_HAVE_MANUAL_CONTROL + __AFL_INIT(); +#endif + + unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF; + while (__AFL_LOOP(10000)) { + int len = __AFL_FUZZ_TESTCASE_LEN; + + /* safety check from tcpdump */ + if ((size_t)len < sizeof(struct ether_header)) + continue; + + /* move into new buffer to allow ASAN to detect invalid memory access */ + unsigned char *p = malloc(len); + if (!p) + continue; + + memcpy(p, buf, len); + + /* function under test */ + parse_eth_hdr(p, len, 0, 0); + + /* drop buffer from asan */ + free(p); + } + + return 0; +} + +COMMAND(SUBCOMMAND, fuzzme, "fz", 0, NULL, To build the fuzzing test, it is necessary to build batctl slightly differently: make clean export AFL_USE_ASAN=1; CC=afl-clang-fast make V=s And the some input files (containing raw ethernet fames have to be generated from existing pcaps): mkdir in cd in ../split_pcap.py ~/wireshark-batman-adv/tests/* cd .. And then multiple afl++ fuzzer instances can be started. if [ -z "${STY}" ]; then echo "must be started inside a screen session" >&2 exit 1 fi for i in $(seq 1 $(nproc)); do start_mode=-M [ "${i}" = "1" ] || start_mode=-S screen afl-fuzz "${start_mode}" "fuzzer${i}" -i in -o out ./batctl fuzzme done The crashes can then be analyzed further by sending them to the fuzzme subcommand: ./batctl fuzzme < out/fuzzer1/crashes/id:000000,sig:06,src:000528,time:12,execs:23992,op:havoc,rep:8 Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- Sven Eckelmann (6): batctl: tcpdump: Fix missing sanity check for batman-adv header batctl: tcpdump: Add missing throughput header length check batctl: tcpdump: Fix IPv4 header length check batctl: tcpdump: Add missing ICMPv6 Neighbor Advert length check batctl: tcpdump: Add missing ICMPv6 Neighbor Solicit length check batctl: tcpdump: Fix ICMPv4 inner IPv4 header length check tcpdump.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-) --- base-commit: a57de3183e67ec27cf96f1761e69d542e6dfac03 change-id: 20240127-tcpdump_fuzzing-736774906f60 Best regards, -- Sven Eckelmann <sven(a)narfation.org>

1 7

[PATCH net] bridge: mcast: fix disabled snooping after long uptime
by Linus Lüssing 27 Jan '24

27 Jan '24

The original idea of the delay_time check was to not apply multicast snooping too early when an MLD querier appears. And to instead wait at least for MLD reports to arrive before switching from flooding to group based, MLD snooped forwarding, to avoid temporary packet loss. However in a batman-adv mesh network it was noticed that after 248 days of uptime 32bit MIPS based devices would start to signal that they had stopped applying multicast snooping due to missing queriers - even though they were the elected querier and still sending MLD queries themselves. While time_is_before_jiffies() generally is safe against jiffies wrap-arounds, like the code comments in jiffies.h explain, it won't be able to track a difference larger than ULONG_MAX/2. With a 32bit large jiffies and one jiffies tick every 10ms (CONFIG_HZ=100) on these MIPS devices running OpenWrt this would result in a difference larger than ULONG_MAX/2 after 248 (= 2^32/100/60/60/24/2) days and time_is_before_jiffies() would then start to return false instead of true. Leading to multicast snooping not being applied to multicast packets anymore. Fix this issue by using a proper timer_list object which won't have this ULONG_MAX/2 difference limitation. Fixes: b00589af3b04 ("bridge: disable snooping if there is no querier") Signed-off-by: Linus Lüssing <linus.luessing(a)c0d3.blue> --- net/bridge/br_multicast.c | 20 +++++++++++++++----- net/bridge/br_private.h | 4 ++-- 2 files changed, 17 insertions(+), 7 deletions(-) diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c index d7d021af1029..df14ee36ea20 100644 --- a/net/bridge/br_multicast.c +++ b/net/bridge/br_multicast.c @@ -1762,6 +1762,10 @@ static void br_ip6_multicast_querier_expired(struct timer_list *t) } #endif +static inline void br_multicast_query_delay_expired(struct timer_list *t) +{ +} + static void br_multicast_select_own_querier(struct net_bridge_mcast *brmctx, struct br_ip *ip, struct sk_buff *skb) @@ -3198,7 +3202,7 @@ br_multicast_update_query_timer(struct net_bridge_mcast *brmctx, unsigned long max_delay) { if (!timer_pending(&query->timer)) - query->delay_time = jiffies + max_delay; + mod_timer(&query->delay_timer, jiffies + max_delay); mod_timer(&query->timer, jiffies + brmctx->multicast_querier_interval); } @@ -4041,13 +4045,11 @@ void br_multicast_ctx_init(struct net_bridge *br, brmctx->multicast_querier_interval = 255 * HZ; brmctx->multicast_membership_interval = 260 * HZ; - brmctx->ip4_other_query.delay_time = 0; brmctx->ip4_querier.port_ifidx = 0; seqcount_spinlock_init(&brmctx->ip4_querier.seq, &br->multicast_lock); brmctx->multicast_igmp_version = 2; #if IS_ENABLED(CONFIG_IPV6) brmctx->multicast_mld_version = 1; - brmctx->ip6_other_query.delay_time = 0; brmctx->ip6_querier.port_ifidx = 0; seqcount_spinlock_init(&brmctx->ip6_querier.seq, &br->multicast_lock); #endif @@ -4056,6 +4058,8 @@ void br_multicast_ctx_init(struct net_bridge *br, br_ip4_multicast_local_router_expired, 0); timer_setup(&brmctx->ip4_other_query.timer, br_ip4_multicast_querier_expired, 0); + timer_setup(&brmctx->ip4_other_query.delay_timer, + br_multicast_query_delay_expired, 0); timer_setup(&brmctx->ip4_own_query.timer, br_ip4_multicast_query_expired, 0); #if IS_ENABLED(CONFIG_IPV6) @@ -4063,6 +4067,8 @@ void br_multicast_ctx_init(struct net_bridge *br, br_ip6_multicast_local_router_expired, 0); timer_setup(&brmctx->ip6_other_query.timer, br_ip6_multicast_querier_expired, 0); + timer_setup(&brmctx->ip6_other_query.delay_timer, + br_multicast_query_delay_expired, 0); timer_setup(&brmctx->ip6_own_query.timer, br_ip6_multicast_query_expired, 0); #endif @@ -4197,10 +4203,12 @@ static void __br_multicast_stop(struct net_bridge_mcast *brmctx) { del_timer_sync(&brmctx->ip4_mc_router_timer); del_timer_sync(&brmctx->ip4_other_query.timer); + del_timer_sync(&brmctx->ip4_other_query.delay_timer); del_timer_sync(&brmctx->ip4_own_query.timer); #if IS_ENABLED(CONFIG_IPV6) del_timer_sync(&brmctx->ip6_mc_router_timer); del_timer_sync(&brmctx->ip6_other_query.timer); + del_timer_sync(&brmctx->ip6_other_query.delay_timer); del_timer_sync(&brmctx->ip6_own_query.timer); #endif } @@ -4643,13 +4651,15 @@ int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val) max_delay = brmctx->multicast_query_response_interval; if (!timer_pending(&brmctx->ip4_other_query.timer)) - brmctx->ip4_other_query.delay_time = jiffies + max_delay; + mod_timer(&brmctx->ip4_other_query.delay_timer, + jiffies + max_delay); br_multicast_start_querier(brmctx, &brmctx->ip4_own_query); #if IS_ENABLED(CONFIG_IPV6) if (!timer_pending(&brmctx->ip6_other_query.timer)) - brmctx->ip6_other_query.delay_time = jiffies + max_delay; + mod_timer(&brmctx->ip6_other_query.delay_timer, + jiffies + max_delay); br_multicast_start_querier(brmctx, &brmctx->ip6_own_query); #endif diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h index b0a92c344722..86ea5e6689b5 100644 --- a/net/bridge/br_private.h +++ b/net/bridge/br_private.h @@ -78,7 +78,7 @@ struct bridge_mcast_own_query { /* other querier */ struct bridge_mcast_other_query { struct timer_list timer; - unsigned long delay_time; + struct timer_list delay_timer; }; /* selected querier */ @@ -1159,7 +1159,7 @@ __br_multicast_querier_exists(struct net_bridge_mcast *brmctx, own_querier_enabled = false; } - return time_is_before_jiffies(querier->delay_time) && + return !timer_pending(&querier->delay_timer) && (own_querier_enabled || timer_pending(&querier->timer)); } -- 2.43.0

2 1

[PATCH] batman-adv: Drop usage of export.h
by Sven Eckelmann 22 Jan '24

22 Jan '24

The linux/export.h include was introduced in commit f6977d91a992 ("batman-adv: Introduce missing headers for genetlink restructure") to have access to THIS_MODULE. But with commit 5b20755b7780 ("init: move THIS_MODULE from <linux/export.h> to <linux/init.h>"), it was moved and the include for export.h is no longer needed. Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- net/batman-adv/netlink.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/batman-adv/netlink.c b/net/batman-adv/netlink.c index cda99753..6aff7cc1 100644 --- a/net/batman-adv/netlink.c +++ b/net/batman-adv/netlink.c @@ -15,7 +15,6 @@ #include <linux/cache.h> #include <linux/err.h> #include <linux/errno.h> -#include <linux/export.h> #include <linux/genetlink.h> #include <linux/gfp.h> #include <linux/if_ether.h> --- base-commit: ecdc425a87d40eba44c9c094293d50d3e9a38b45 change-id: 20240122-no-export-header-0293ee4ccd11 Best regards, -- Sven Eckelmann <sven(a)narfation.org>

1 0

[syzbot] [btrfs?] memory leak in corrupted
by syzbot 17 Jan '24

17 Jan '24

Hello, syzbot found the following issue on: HEAD commit: 052d534373b7 Merge tag 'exfat-for-6.8-rc1' of git://git.ke.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=14620debe80000 kernel config: https://syzkaller.appspot.com/x/.config?x=a7031f9e71583b4a dashboard link: https://syzkaller.appspot.com/bug?extid=ebe64cc5950868e77358 compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16a344c1e80000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/82a7201eef4c/disk-052d5343.raw… vmlinux: https://storage.googleapis.com/syzbot-assets/ca12b4c31826/vmlinux-052d5343.… kernel image: https://storage.googleapis.com/syzbot-assets/3f07360ba5a8/bzImage-052d5343.… IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+ebe64cc5950868e77358(a)syzkaller.appspotmail.com BUG: memory leak unreferenced object 0xffff88811c71a980 (size 64): comm "syz-executor.7", pid 5063, jiffies 4294953937 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 20 8e 7e 1c 81 88 ff ff ........ .~..... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 9f8721dd): [<ffffffff815f7d53>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff815f7d53>] slab_post_alloc_hook mm/slub.c:3817 [inline] [<ffffffff815f7d53>] slab_alloc_node mm/slub.c:3860 [inline] [<ffffffff815f7d53>] kmalloc_trace+0x283/0x330 mm/slub.c:4007 [<ffffffff84aae617>] kmalloc include/linux/slab.h:590 [inline] [<ffffffff84aae617>] kzalloc include/linux/slab.h:711 [inline] [<ffffffff84aae617>] batadv_tvlv_handler_register+0xf7/0x2a0 net/batman-adv/tvlv.c:560 [<ffffffff84a8d09f>] batadv_mcast_init+0x4f/0xc0 net/batman-adv/multicast.c:1926 [<ffffffff84a895b9>] batadv_mesh_init+0x209/0x2f0 net/batman-adv/main.c:231 [<ffffffff84a9fa88>] batadv_softif_init_late+0x1f8/0x280 net/batman-adv/soft-interface.c:812 [<ffffffff83f48559>] register_netdevice+0x189/0xca0 net/core/dev.c:10188 [<ffffffff84a9f255>] batadv_softif_newlink+0x55/0x70 net/batman-adv/soft-interface.c:1088 [<ffffffff83f61dc0>] rtnl_newlink_create net/core/rtnetlink.c:3515 [inline] [<ffffffff83f61dc0>] __rtnl_newlink+0xb10/0xec0 net/core/rtnetlink.c:3735 [<ffffffff83f621bc>] rtnl_newlink+0x4c/0x70 net/core/rtnetlink.c:3748 [<ffffffff83f5cd1f>] rtnetlink_rcv_msg+0x22f/0x5b0 net/core/rtnetlink.c:6615 [<ffffffff84093291>] netlink_rcv_skb+0x91/0x1d0 net/netlink/af_netlink.c:2543 [<ffffffff84092242>] netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] [<ffffffff84092242>] netlink_unicast+0x2c2/0x440 net/netlink/af_netlink.c:1367 [<ffffffff84092701>] netlink_sendmsg+0x341/0x690 net/netlink/af_netlink.c:1908 [<ffffffff83ef2912>] sock_sendmsg_nosec net/socket.c:730 [inline] [<ffffffff83ef2912>] __sock_sendmsg+0x52/0xa0 net/socket.c:745 [<ffffffff83ef5af4>] __sys_sendto+0x164/0x1e0 net/socket.c:2191 [<ffffffff83ef5b98>] __do_sys_sendto net/socket.c:2203 [inline] [<ffffffff83ef5b98>] __se_sys_sendto net/socket.c:2199 [inline] [<ffffffff83ef5b98>] __x64_sys_sendto+0x28/0x30 net/socket.c:2199 BUG: memory leak unreferenced object 0xffff88811c8561c0 (size 64): comm "syz-executor.0", pid 5062, jiffies 4294953941 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 20 ce 7e 1c 81 88 ff ff ........ .~..... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 7256c890): [<ffffffff815f7d53>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff815f7d53>] slab_post_alloc_hook mm/slub.c:3817 [inline] [<ffffffff815f7d53>] slab_alloc_node mm/slub.c:3860 [inline] [<ffffffff815f7d53>] kmalloc_trace+0x283/0x330 mm/slub.c:4007 [<ffffffff84aae617>] kmalloc include/linux/slab.h:590 [inline] [<ffffffff84aae617>] kzalloc include/linux/slab.h:711 [inline] [<ffffffff84aae617>] batadv_tvlv_handler_register+0xf7/0x2a0 net/batman-adv/tvlv.c:560 [<ffffffff84a8d09f>] batadv_mcast_init+0x4f/0xc0 net/batman-adv/multicast.c:1926 [<ffffffff84a895b9>] batadv_mesh_init+0x209/0x2f0 net/batman-adv/main.c:231 [<ffffffff84a9fa88>] batadv_softif_init_late+0x1f8/0x280 net/batman-adv/soft-interface.c:812 [<ffffffff83f48559>] register_netdevice+0x189/0xca0 net/core/dev.c:10188 [<ffffffff84a9f255>] batadv_softif_newlink+0x55/0x70 net/batman-adv/soft-interface.c:1088 [<ffffffff83f61dc0>] rtnl_newlink_create net/core/rtnetlink.c:3515 [inline] [<ffffffff83f61dc0>] __rtnl_newlink+0xb10/0xec0 net/core/rtnetlink.c:3735 [<ffffffff83f621bc>] rtnl_newlink+0x4c/0x70 net/core/rtnetlink.c:3748 [<ffffffff83f5cd1f>] rtnetlink_rcv_msg+0x22f/0x5b0 net/core/rtnetlink.c:6615 [<ffffffff84093291>] netlink_rcv_skb+0x91/0x1d0 net/netlink/af_netlink.c:2543 [<ffffffff84092242>] netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] [<ffffffff84092242>] netlink_unicast+0x2c2/0x440 net/netlink/af_netlink.c:1367 [<ffffffff84092701>] netlink_sendmsg+0x341/0x690 net/netlink/af_netlink.c:1908 [<ffffffff83ef2912>] sock_sendmsg_nosec net/socket.c:730 [inline] [<ffffffff83ef2912>] __sock_sendmsg+0x52/0xa0 net/socket.c:745 [<ffffffff83ef5af4>] __sys_sendto+0x164/0x1e0 net/socket.c:2191 [<ffffffff83ef5b98>] __do_sys_sendto net/socket.c:2203 [inline] [<ffffffff83ef5b98>] __se_sys_sendto net/socket.c:2199 [inline] [<ffffffff83ef5b98>] __x64_sys_sendto+0x28/0x30 net/socket.c:2199 BUG: memory leak unreferenced object 0xffff88811cd88cc0 (size 64): comm "syz-executor.5", pid 5078, jiffies 4294953981 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 20 8e 05 1d 81 88 ff ff ........ ....... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc a919e6d6): [<ffffffff815f7d53>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff815f7d53>] slab_post_alloc_hook mm/slub.c:3817 [inline] [<ffffffff815f7d53>] slab_alloc_node mm/slub.c:3860 [inline] [<ffffffff815f7d53>] kmalloc_trace+0x283/0x330 mm/slub.c:4007 [<ffffffff84aae617>] kmalloc include/linux/slab.h:590 [inline] [<ffffffff84aae617>] kzalloc include/linux/slab.h:711 [inline] [<ffffffff84aae617>] batadv_tvlv_handler_register+0xf7/0x2a0 net/batman-adv/tvlv.c:560 [<ffffffff84a8d09f>] batadv_mcast_init+0x4f/0xc0 net/batman-adv/multicast.c:1926 [<ffffffff84a895b9>] batadv_mesh_init+0x209/0x2f0 net/batman-adv/main.c:231 [<ffffffff84a9fa88>] batadv_softif_init_late+0x1f8/0x280 net/batman-adv/soft-interface.c:812 [<ffffffff83f48559>] register_netdevice+0x189/0xca0 net/core/dev.c:10188 [<ffffffff84a9f255>] batadv_softif_newlink+0x55/0x70 net/batman-adv/soft-interface.c:1088 [<ffffffff83f61dc0>] rtnl_newlink_create net/core/rtnetlink.c:3515 [inline] [<ffffffff83f61dc0>] __rtnl_newlink+0xb10/0xec0 net/core/rtnetlink.c:3735 [<ffffffff83f621bc>] rtnl_newlink+0x4c/0x70 net/core/rtnetlink.c:3748 [<ffffffff83f5cd1f>] rtnetlink_rcv_msg+0x22f/0x5b0 net/core/rtnetlink.c:6615 [<ffffffff84093291>] netlink_rcv_skb+0x91/0x1d0 net/netlink/af_netlink.c:2543 [<ffffffff84092242>] netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] [<ffffffff84092242>] netlink_unicast+0x2c2/0x440 net/netlink/af_netlink.c:1367 [<ffffffff84092701>] netlink_sendmsg+0x341/0x690 net/netlink/af_netlink.c:1908 [<ffffffff83ef2912>] sock_sendmsg_nosec net/socket.c:730 [inline] [<ffffffff83ef2912>] __sock_sendmsg+0x52/0xa0 net/socket.c:745 [<ffffffff83ef5af4>] __sys_sendto+0x164/0x1e0 net/socket.c:2191 [<ffffffff83ef5b98>] __do_sys_sendto net/socket.c:2203 [inline] [<ffffffff83ef5b98>] __se_sys_sendto net/socket.c:2199 [inline] [<ffffffff83ef5b98>] __x64_sys_sendto+0x28/0x30 net/socket.c:2199 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup

2 3

[PATCH] batman-adv: mcast: fix memory leak on deleting a batman-adv interface
by Linus Lüssing 17 Jan '24

17 Jan '24

The batman-adv multicast tracker TVLV handler is registered for the new batman-adv multicast packet type upon creating a batman-adv interface, but not unregistered again upon the interface's deletion, leading to a memory leak. Fix this memory leak by calling the according TVLV handler unregister routine for the multicast tracker TVLV upon batman-adv interface deletion. Fixes: 8ed36122d709 ("batman-adv: mcast: implement multicast packet reception and forwarding") Reported-by: syzbot+ebe64cc5950868e77358(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000beadc4060f0cbc23@google.com/ Signed-off-by: Linus Lüssing <linus.luessing(a)c0d3.blue> --- net/batman-adv/multicast.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c index c8620905c2dc..38fab5e46ae2 100644 --- a/net/batman-adv/multicast.c +++ b/net/batman-adv/multicast.c @@ -2183,6 +2183,7 @@ void batadv_mcast_free(struct batadv_priv *bat_priv) cancel_delayed_work_sync(&bat_priv->mcast.work); batadv_tvlv_container_unregister(bat_priv, BATADV_TVLV_MCAST, 2); + batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_MCAST_TRACKER, 1); batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_MCAST, 2); /* safely calling outside of worker, as worker was canceled above */ -- 2.43.0

1 0

[PATCH v2] batman-adv: Drop support for Linux < 4.19
by Sven Eckelmann 10 Jan '24

10 Jan '24

The Linux Kernel 4.14 reached its end of life [1] after 6 years. Instead it is recommended to use at least kernel 4.19. It is also over 5 years old but still maintained by the stable kernel team. All older kernels (4.14 - v4.18) will be dropped to reduce the support overhead. [1] https://lore.kernel.org/r/2024011046-ecology-tiptoeing-ce50@gregkh/ Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- Changes in v2: - Add EOL announcement URL to commit message - Fix conflict in README.external.rst - Link to v1: https://lore.kernel.org/r/20231104-drop-compat-4-14-v1-1-d2453b1cfd45@narfa… --- README.external.rst | 2 +- compat-include/linux/netdevice.h | 8 -------- compat-include/linux/stddef.h | 24 ------------------------ compat-include/net/cfg80211.h | 40 ---------------------------------------- compat-include/net/genetlink.h | 18 ------------------ compat.h | 7 ------- 6 files changed, 1 insertion(+), 98 deletions(-) diff --git a/README.external.rst b/README.external.rst index 3b014af8..4e1de973 100644 --- a/README.external.rst +++ b/README.external.rst @@ -12,7 +12,7 @@ and as an external module. The external module allows to get new features without upgrading to a newer kernel version and to get batman-adv specific bug fixes for kernels that are not supported anymore. It compiles against and should work -with Linux 4.14 - 6.7. Supporting older versions is not +with Linux 4.19 - 6.7. Supporting older versions is not planned, but it's probably easy to backport it. If you work on a backport, feel free to contact us. :-) diff --git a/compat-include/linux/netdevice.h b/compat-include/linux/netdevice.h index 3188ad3d..a489ac9b 100644 --- a/compat-include/linux/netdevice.h +++ b/compat-include/linux/netdevice.h @@ -13,14 +13,6 @@ #include <linux/version.h> #include_next <linux/netdevice.h> -#if LINUX_VERSION_IS_LESS(4, 15, 0) - -#define netdev_master_upper_dev_link(dev, upper_dev, upper_priv, upper_info, extack) \ - netdev_master_upper_dev_link(dev, upper_dev, upper_priv, upper_info) - -#endif /* LINUX_VERSION_IS_LESS(4, 15, 0) */ - - #if LINUX_VERSION_IS_LESS(5, 15, 0) static inline void batadv_dev_put(struct net_device *dev) diff --git a/compat-include/linux/stddef.h b/compat-include/linux/stddef.h deleted file mode 100644 index c4558f81..00000000 --- a/compat-include/linux/stddef.h +++ /dev/null @@ -1,24 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/* Copyright (C) B.A.T.M.A.N. contributors: - * - * Marek Lindner, Simon Wunderlich - * - * This file contains macros for maintaining compatibility with older versions - * of the Linux kernel. - */ - -#ifndef _NET_BATMAN_ADV_COMPAT_LINUX_STDDEF_H_ -#define _NET_BATMAN_ADV_COMPAT_LINUX_STDDEF_H_ - -#include <linux/version.h> -#include_next <linux/stddef.h> - -#if LINUX_VERSION_IS_LESS(4, 16, 0) - -#ifndef sizeof_field -#define sizeof_field(TYPE, MEMBER) sizeof((((TYPE *)0)->MEMBER)) -#endif - -#endif /* LINUX_VERSION_IS_LESS(4, 16, 0) */ - -#endif /* _NET_BATMAN_ADV_COMPAT_LINUX_STDDEF_H_ */ diff --git a/compat-include/net/cfg80211.h b/compat-include/net/cfg80211.h deleted file mode 100644 index 4bfcd5a3..00000000 --- a/compat-include/net/cfg80211.h +++ /dev/null @@ -1,40 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0 */ -/* Copyright (C) B.A.T.M.A.N. contributors: - * - * Marek Lindner, Simon Wunderlich - * - * This file contains macros for maintaining compatibility with older versions - * of the Linux kernel. - */ - -#ifndef _NET_BATMAN_ADV_COMPAT_NET_CFG80211_H_ -#define _NET_BATMAN_ADV_COMPAT_NET_CFG80211_H_ - -#include <linux/version.h> -#include_next <net/cfg80211.h> - - -#if LINUX_VERSION_IS_LESS(4, 18, 0) && IS_ENABLED(CONFIG_CFG80211) - -/* cfg80211 fix: https://patchwork.kernel.org/patch/10449857/ */ -static inline int batadv_cfg80211_get_station(struct net_device *dev, - const u8 *mac_addr, - struct station_info *sinfo) -{ - memset(sinfo, 0, sizeof(*sinfo)); - return cfg80211_get_station(dev, mac_addr, sinfo); -} - -#define cfg80211_get_station(dev, mac_addr, sinfo) \ - batadv_cfg80211_get_station(dev, mac_addr, sinfo) - -#endif /* LINUX_VERSION_IS_LESS(4, 18, 0) && IS_ENABLED(CONFIG_CFG80211) */ - - -#if LINUX_VERSION_IS_LESS(4, 18, 0) - -#define cfg80211_sinfo_release_content(sinfo) - -#endif /* LINUX_VERSION_IS_LESS(4, 18, 0) */ - -#endif /* _NET_BATMAN_ADV_COMPAT_NET_CFG80211_H_ */ diff --git a/compat-include/net/genetlink.h b/compat-include/net/genetlink.h index 05c57ce0..85376044 100644 --- a/compat-include/net/genetlink.h +++ b/compat-include/net/genetlink.h @@ -13,24 +13,6 @@ #include <linux/version.h> #include_next <net/genetlink.h> -#if LINUX_VERSION_IS_LESS(4, 15, 0) - -static inline -void batadv_genl_dump_check_consistent(struct netlink_callback *cb, - void *user_hdr) -{ - struct genl_family genl_family = { - .hdrsize = 0, - }; - - genl_dump_check_consistent(cb, user_hdr, &genl_family); -} - -#define genl_dump_check_consistent batadv_genl_dump_check_consistent - -#endif /* LINUX_VERSION_IS_LESS(4, 15, 0) */ - - #if LINUX_VERSION_IS_LESS(5, 10, 0) #if LINUX_VERSION_IS_LESS(5, 2, 0) diff --git a/compat.h b/compat.h index 8e19f9bb..638bfc54 100644 --- a/compat.h +++ b/compat.h @@ -16,13 +16,6 @@ #include "compat-autoconf.h" -#if LINUX_VERSION_IS_LESS(4, 15, 0) - -#define batadv_softif_slave_add(__dev, __slave_dev, __extack) \ - batadv_softif_slave_add(__dev, __slave_dev) - -#endif /* LINUX_VERSION_IS_LESS(4, 15, 0) */ - #endif /* __KERNEL__ */ #endif /* _NET_BATMAN_ADV_COMPAT_H_ */ --- base-commit: e6fbde1250b73c3c9f49fc5a22ad9a8b10f864d5 change-id: 20231104-drop-compat-4-14-1bba04bac963 Best regards, -- Sven Eckelmann <sven(a)narfation.org>

1 0

[PATCH] batman-adv: mcast: fix mcast packet type counter on timeouted nodes
by Linus Lüssing 09 Jan '24

09 Jan '24

When a node which does not have the new batman-adv multicast packet type capability vanishes then the according, global counter erroneously would not be reduced in response on other nodes. Which in turn leads to the mesh never switching back to sending with the new multicast packet type. Fix this by reducing the according counter when such a node times out. Fixes: be9b0169c840 ("batman-adv: mcast: implement multicast packet generation") Signed-off-by: Linus Lüssing <linus.luessing(a)c0d3.blue> --- net/batman-adv/multicast.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c index 2981a2ed40cb..c8620905c2dc 100644 --- a/net/batman-adv/multicast.c +++ b/net/batman-adv/multicast.c @@ -2206,6 +2206,8 @@ void batadv_mcast_purge_orig(struct batadv_orig_node *orig) BATADV_MCAST_WANT_NO_RTR4); batadv_mcast_want_rtr6_update(bat_priv, orig, BATADV_MCAST_WANT_NO_RTR6); + batadv_mcast_have_mc_ptype_update(bat_priv, orig, + BATADV_MCAST_HAVE_MC_PTYPE_CAPA); spin_unlock_bh(&orig->mcast_handler_lock); } -- 2.43.0

1 0

[PATCH 0/2] batman-adv: Adjustments for two function implementations
by Markus Elfring 02 Jan '24

02 Jan '24

From: Markus Elfring <elfring(a)users.sourceforge.net> Date: Tue, 2 Jan 2024 08:02:01 +0100 A few update suggestions were taken into account from static source code analysis. Markus Elfring (2): Return directly after a failed batadv_dat_select_candidates() in batadv_dat_forward_data() Improve exception handling in batadv_throw_uevent() net/batman-adv/distributed-arp-table.c | 3 +-- net/batman-adv/main.c | 14 ++++++++------ 2 files changed, 9 insertions(+), 8 deletions(-) -- 2.43.0

2 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

B.A.T.M.A.N January 2024