B.A.T.M.A.N August 2024

b.a.t.m.a.n@lists.open-mesh.org

3 participants
4 discussions

Re: bat0 not capable of MTU > 1500
by Rich Chase 03 Sep '24

03 Sep '24

I am trying to create an unimpeded path MTU of 1500 on my OpenWRT router (Belkin RT-3200). I built the firmware from git Master, with kernel version 6.1, and batman-adv version 2023.2. I have a batmesh hard-if device mastering an 802.1S mesh, which are both set to MTU=2304. Using Luci (OpenWRT web gui for uci), I set the MTU of bat0 to 1504 to accommodate .1q vlans on bat0 -- bat0.5, bat0.110, etc. I see in the system log: kern.err kernel: [751585.375855] bat0: mtu greater than device maximum Also, if I do: #> ip link set bat0 mtu 1504 I get: ip: SIOCSIFMTU: Invalid argument and if I test: #> ip link show bat0 ...it says that my mtu is 1500 still. For my life I can't see anything I'm doing wrong. Why can't bat0 have MTU greater than 1500? I don't have any other devices mastered by bat0, other than my .1s wifi mesh link. Throwing myself at your mercy. Help?

3 3

[PATCH] batctl: add switch for setting multicast_mld_rtr_only
by Linus Lüssing 31 Aug '24

31 Aug '24

This patch adds an option for the new multicast_mld_rtr_only setting in batman-adv. Signed-off-by: Linus Lüssing <linus.luessing(a)c0d3.blue> --- Makefile | 1 + README.rst | 10 +++++ batman_adv.h | 9 +++++ event.c | 4 ++ man/batctl.8 | 18 +++++++++ multicast_mld_rtr_only.c | 83 ++++++++++++++++++++++++++++++++++++++++ 6 files changed, 125 insertions(+) create mode 100644 multicast_mld_rtr_only.c diff --git a/Makefile b/Makefile index c1212c444971..9e6f535c7816 100755 --- a/Makefile +++ b/Makefile @@ -66,6 +66,7 @@ $(eval $(call add_command,mesh_json,y)) $(eval $(call add_command,multicast_fanout,y)) $(eval $(call add_command,multicast_forceflood,y)) $(eval $(call add_command,multicast_mode,y)) +$(eval $(call add_command,multicast_mld_rtr_only,y)) $(eval $(call add_command,neighbors,y)) $(eval $(call add_command,neighbors_json,y)) $(eval $(call add_command,network_coding,y)) diff --git a/README.rst b/README.rst index 3495fba02e0e..63b16b0f66af 100644 --- a/README.rst +++ b/README.rst @@ -669,6 +669,16 @@ Usage:: batctl multicast_forceflood|mff [0|1] +batctl multicast_mld_rtr_only +----------------------------- + +display or modify the multicast MLD router only setting + +Usage:: + + batctl multicast_mld_rtr_only|mro [0|1] + + batctl network_coding --------------------- diff --git a/batman_adv.h b/batman_adv.h index 35dc016c9bb4..11cd170036ff 100644 --- a/batman_adv.h +++ b/batman_adv.h @@ -481,6 +481,15 @@ enum batadv_nl_attrs { */ BATADV_ATTR_MULTICAST_FANOUT, + /** + * @BATADV_ATTR_MULTICAST_MLD_RTR_ONLY_ENABLED: defines how IGMP/MLD + * reports are forwarded in the mesh. If set to non-zero then IGMP/MLD + * reports are only forwarded to detected multicast routers. If set to + * zero then they are flooded instead. + * Warning: The former is experimental and potentially unsafe! + */ + BATADV_ATTR_MULTICAST_MLD_RTR_ONLY_ENABLED, + /* add attributes above here, update the policy in netlink.c */ /** diff --git a/event.c b/event.c index 274f99fcb65a..14700ea57ae0 100644 --- a/event.c +++ b/event.c @@ -283,6 +283,10 @@ static void event_parse_set_mesh(struct nlattr **attrs) printf("* multicast_forceflood %s\n", u8_to_boolstr(attrs[BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED])); + if (attrs[BATADV_ATTR_MULTICAST_MLD_RTR_ONLY_ENABLED]) + printf("* multicast_forceflood %s\n", + u8_to_boolstr(attrs[BATADV_ATTR_MULTICAST_MLD_RTR_ONLY_ENABLED])); + if (attrs[BATADV_ATTR_NETWORK_CODING_ENABLED]) printf("* network_coding %s\n", u8_to_boolstr(attrs[BATADV_ATTR_NETWORK_CODING_ENABLED])); diff --git a/man/batctl.8 b/man/batctl.8 index b5be0b801708..9d830907ac7f 100644 --- a/man/batctl.8 +++ b/man/batctl.8 @@ -341,6 +341,24 @@ disable multicast forceflood. This setting defines whether multicast optimizatio flooding of multicast packets. If set to non-zero then all nodes in the mesh are going to use classic flooding for any multicast packet with no optimizations. .TP +[\fBmeshif\fP \fInetdev\fP] \fBmulticast_mld_rtr_only\fP|\fBmro\fP [\fI0\fP|\fI1\fP] +If no parameter is given the current multicast MLD router only setting is displayed. Otherwise the parameter is used to +set the IGMP/MLD report forwarding behaviour. If enabled then MLD reports are forwarded to detected multicast routers only. +If disabled then they are flooded instead. + +.br +.br +Warning: Enabling this is experimental and potentially unsafe! + +.br +.br +If the IGMP/MLD querier is configured directly on the bridge on top of +bat0. But there is no multicast router on or behind this node. Then this +bridge will be unable to detect multicast listeners on/behind other +nodes which have the MLD-RTR-ONLY setting enabled. (A workaround for this +can then in turn be to set multicast_router=2 on the bat0 bridge port +on the node with the IGMP/MLD querier.) +.TP [\fBmeshif\fP \fInetdev\fP] \fBnetwork_coding\fP|\fBnc\fP [\fI0\fP|\fI1\fP] If no parameter is given the current network coding mode setting is displayed. Otherwise the parameter is used to enable or disable network coding. diff --git a/multicast_mld_rtr_only.c b/multicast_mld_rtr_only.c new file mode 100644 index 000000000000..599f96fb2375 --- /dev/null +++ b/multicast_mld_rtr_only.c @@ -0,0 +1,83 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (C) B.A.T.M.A.N. contributors: + * + * Linus Lüssing <linus.luessing(a)c0d3.blue> + * + * License-Filename: LICENSES/preferred/GPL-2.0 + */ + +#include "main.h" + +#include <errno.h> +#include <linux/genetlink.h> +#include <netlink/genl/genl.h> + +#include "batman_adv.h" +#include "netlink.h" +#include "sys.h" + +static struct simple_boolean_data multicast_mld_rtr_only; + +static int print_multicast_mld_rtr_only(struct nl_msg *msg, void *arg) +{ + struct nlattr *attrs[BATADV_ATTR_MAX + 1]; + struct nlmsghdr *nlh = nlmsg_hdr(msg); + struct genlmsghdr *ghdr; + int *result = arg; + + if (!genlmsg_valid_hdr(nlh, 0)) + return NL_OK; + + ghdr = nlmsg_data(nlh); + + if (nla_parse(attrs, BATADV_ATTR_MAX, genlmsg_attrdata(ghdr, 0), + genlmsg_len(ghdr), batadv_netlink_policy)) { + return NL_OK; + } + + if (!attrs[BATADV_ATTR_MULTICAST_MLD_RTR_ONLY_ENABLED]) + return NL_OK; + + printf("%s\n", nla_get_u8(attrs[BATADV_ATTR_MULTICAST_MLD_RTR_ONLY_ENABLED]) ? "enabled" : "disabled"); + + *result = 0; + return NL_STOP; +} + +static int get_multicast_mld_rtr_only(struct state *state) +{ + return sys_simple_nlquery(state, BATADV_CMD_GET_MESH, + NULL, print_multicast_mld_rtr_only); +} + +static int set_attrs_multicast_mld_rtr_only(struct nl_msg *msg, void *arg) +{ + struct state *state = arg; + struct settings_data *settings = state->cmd->arg; + struct simple_boolean_data *data = settings->data; + + if (data->val) + printf("Warning: MLD-RTR-ONLY is experimental and has known, broken scenarios\n"); + + nla_put_u8(msg, BATADV_ATTR_MULTICAST_MLD_RTR_ONLY_ENABLED, data->val); + + return 0; +} + +static int set_multicast_mld_rtr_only(struct state *state) +{ + return sys_simple_nlquery(state, BATADV_CMD_SET_MESH, + set_attrs_multicast_mld_rtr_only, NULL); +} + +static struct settings_data batctl_settings_multicast_mld_rtr_only = { + .data = &multicast_mld_rtr_only, + .parse = parse_simple_boolean, + .netlink_get = get_multicast_mld_rtr_only, + .netlink_set = set_multicast_mld_rtr_only, +}; + +COMMAND_NAMED(SUBCOMMAND_MIF, multicast_mld_rtr_only, "mro", handle_sys_setting, + COMMAND_FLAG_MESH_IFACE | COMMAND_FLAG_NETLINK, + &batctl_settings_multicast_mld_rtr_only, + "[0|1] \tdisplay or modify multicast_mld_rtr_only setting"); -- 2.45.2

1 0

[PATCH] batman-adv: mcast: add option to forward MLD reports only to mcast routers
by Linus Lüssing 31 Aug '24

31 Aug '24

In most setups it is sufficient for us to only send MLD reports to nodes which have a multicast router attached. Which reduces overall overhead, especially in large batman-adv mesh networks, where broadcasts are particularly undesirable. However there is one specific, known issue / broken scenario with this setting: If the IGMP/MLD querier is configured directly on the bridge on top of bat0. But there is no multicast router on or behind this node. Then this bridge will be unable to detect multicast listeners on/behind other nodes which have the MLD-RTR-ONLY setting enabled. (A workaround for this can then in turn be to set multicast_router=2 on the bat0 bridge port on the node with the IGMP/MLD querier.) Therefore MLD report flooding is kept the default and MLD report to multicast routers only forwarding is considered experimental and warned about. Signed-off-by: Linus Lüssing <linus.luessing(a)c0d3.blue> --- An list of scenarios with illustrations and a step-by-step evaluation with this setting for them can be found on the batman-adv wiki: * https://www.open-mesh.org/projects/batman-adv/wiki/Multicast-IGMP-MLD-Repor… This patchset is applied and tested on/between Freifunk Lübeck (180 nodes) and a small Freifunk Vogtland domain. It allowed using layer 3 IPv6 multicast routing here without flooding the whole mesh network with MLD reports. include/uapi/linux/batman_adv.h | 9 ++++++ net/batman-adv/multicast.c | 52 +++++++++++++++++++++++++-------- net/batman-adv/netlink.c | 17 +++++++++++ net/batman-adv/soft-interface.c | 1 + net/batman-adv/types.h | 7 +++++ 5 files changed, 74 insertions(+), 12 deletions(-) diff --git a/include/uapi/linux/batman_adv.h b/include/uapi/linux/batman_adv.h index 35dc016c9bb4..11cd170036ff 100644 --- a/include/uapi/linux/batman_adv.h +++ b/include/uapi/linux/batman_adv.h @@ -481,6 +481,15 @@ enum batadv_nl_attrs { */ BATADV_ATTR_MULTICAST_FANOUT, + /** + * @BATADV_ATTR_MULTICAST_MLD_RTR_ONLY_ENABLED: defines how IGMP/MLD + * reports are forwarded in the mesh. If set to non-zero then IGMP/MLD + * reports are only forwarded to detected multicast routers. If set to + * zero then they are flooded instead. + * Warning: The former is experimental and potentially unsafe! + */ + BATADV_ATTR_MULTICAST_MLD_RTR_ONLY_ENABLED, + /* add attributes above here, update the policy in netlink.c */ /** diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c index 38fab5e46ae2..d5e3f4d90fd1 100644 --- a/net/batman-adv/multicast.c +++ b/net/batman-adv/multicast.c @@ -1008,8 +1008,14 @@ static int batadv_mcast_forw_mode_check_ipv4(struct batadv_priv *bat_priv, if (!pskb_may_pull(skb, sizeof(struct ethhdr) + sizeof(*iphdr))) return -ENOMEM; - if (batadv_mcast_is_report_ipv4(skb)) + if (batadv_mcast_is_report_ipv4(skb)) { + if (atomic_read(&bat_priv->multicast_mld_rtr_only)) { + *is_routable = IGMP_HOST_MEMBERSHIP_REPORT; + return 0; + } + return -EINVAL; + } iphdr = ip_hdr(skb); @@ -1072,8 +1078,14 @@ static int batadv_mcast_forw_mode_check_ipv6(struct batadv_priv *bat_priv, if (!pskb_may_pull(skb, sizeof(struct ethhdr) + sizeof(*ip6hdr))) return -ENOMEM; - if (batadv_mcast_is_report_ipv6(skb)) + if (batadv_mcast_is_report_ipv6(skb)) { + if (atomic_read(&bat_priv->multicast_mld_rtr_only)) { + *is_routable = ICMPV6_MGM_REPORT; + return 0; + } + return -EINVAL; + } ip6hdr = ipv6_hdr(skb); @@ -1160,17 +1172,19 @@ static int batadv_mcast_forw_want_all_ip_count(struct batadv_priv *bat_priv, * @protocol: the ethernet protocol type to count multicast routers for * * Return: the number of nodes which want all routable IPv4 multicast traffic - * if the protocol is ETH_P_IP or the number of nodes which want all routable - * IPv6 traffic if the protocol is ETH_P_IPV6. Otherwise returns 0. + * if the protocol is ETH_P_IP or IGMP_HOST_MEMBERSHIP_REPORT. Or the number of + * nodes which want all routable IPv6 traffic if the protocol is ETH_P_IPV6 or + * ICMPV6_MGM_REPORT. Otherwise returns 0. */ - static int batadv_mcast_forw_rtr_count(struct batadv_priv *bat_priv, int protocol) { switch (protocol) { case ETH_P_IP: + case IGMP_HOST_MEMBERSHIP_REPORT: return atomic_read(&bat_priv->mcast.num_want_all_rtr4); case ETH_P_IPV6: + case ICMPV6_MGM_REPORT: return atomic_read(&bat_priv->mcast.num_want_all_rtr6); default: return 0; @@ -1234,10 +1248,11 @@ enum batadv_forw_mode batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb, unsigned short vid, int *is_routable) { - int ret, tt_count, ip_count, unsnoop_count, total_count; + atomic_t *unsnoop_cnt_atom = &bat_priv->mcast.num_want_all_unsnoopables; + int ret, ip_count, rtr_count, total_count; + int tt_count = 0, unsnoop_count = 0; bool is_unsnoopable = false; struct ethhdr *ethhdr; - int rtr_count = 0; ret = batadv_mcast_forw_mode_check(bat_priv, skb, &is_unsnoopable, is_routable); @@ -1248,11 +1263,17 @@ batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb, ethhdr = eth_hdr(skb); - tt_count = batadv_tt_global_hash_count(bat_priv, ethhdr->h_dest, - BATADV_NO_FLAGS); - ip_count = batadv_mcast_forw_want_all_ip_count(bat_priv, ethhdr); - unsnoop_count = !is_unsnoopable ? 0 : - atomic_read(&bat_priv->mcast.num_want_all_unsnoopables); + if (*is_routable != IGMP_HOST_MEMBERSHIP_REPORT && + *is_routable != ICMPV6_MGM_REPORT) { + tt_count = batadv_tt_global_hash_count(bat_priv, ethhdr->h_dest, + BATADV_NO_FLAGS); + + if (is_unsnoopable) + unsnoop_count = atomic_read(unsnoop_cnt_atom); + } + + ip_count = batadv_mcast_forw_want_all_ip_count(bat_priv, + ethhdr); rtr_count = batadv_mcast_forw_rtr_count(bat_priv, *is_routable); total_count = tt_count + ip_count + unsnoop_count + rtr_count; @@ -1540,8 +1561,10 @@ batadv_mcast_forw_want_rtr(struct batadv_priv *bat_priv, { switch (ntohs(eth_hdr(skb)->h_proto)) { case ETH_P_IP: + case IGMP_HOST_MEMBERSHIP_REPORT: return batadv_mcast_forw_want_all_rtr4(bat_priv, skb, vid); case ETH_P_IPV6: + case ICMPV6_MGM_REPORT: return batadv_mcast_forw_want_all_rtr6(bat_priv, skb, vid); default: /* we shouldn't be here... */ @@ -1571,12 +1594,17 @@ int batadv_mcast_forw_send(struct batadv_priv *bat_priv, struct sk_buff *skb, { int ret; + if (is_routable == IGMP_HOST_MEMBERSHIP_REPORT || + is_routable == ICMPV6_MGM_REPORT) + goto skip_mc_listeners; + ret = batadv_mcast_forw_tt(bat_priv, skb, vid); if (ret != NET_XMIT_SUCCESS) { kfree_skb(skb); return ret; } +skip_mc_listeners: ret = batadv_mcast_forw_want_all(bat_priv, skb, vid); if (ret != NET_XMIT_SUCCESS) { kfree_skb(skb); diff --git a/net/batman-adv/netlink.c b/net/batman-adv/netlink.c index 3f0003fc502c..0923117d63b2 100644 --- a/net/batman-adv/netlink.c +++ b/net/batman-adv/netlink.c @@ -145,6 +145,7 @@ static const struct nla_policy batadv_netlink_policy[NUM_BATADV_ATTR] = { [BATADV_ATTR_LOG_LEVEL] = { .type = NLA_U32 }, [BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED] = { .type = NLA_U8 }, [BATADV_ATTR_MULTICAST_FANOUT] = { .type = NLA_U32 }, + [BATADV_ATTR_MULTICAST_MLD_RTR_ONLY_ENABLED] = { .type = NLA_U8 }, [BATADV_ATTR_NETWORK_CODING_ENABLED] = { .type = NLA_U8 }, [BATADV_ATTR_ORIG_INTERVAL] = { .type = NLA_U32 }, [BATADV_ATTR_ELP_INTERVAL] = { .type = NLA_U32 }, @@ -345,6 +346,10 @@ static int batadv_netlink_mesh_fill(struct sk_buff *msg, if (nla_put_u32(msg, BATADV_ATTR_MULTICAST_FANOUT, atomic_read(&bat_priv->multicast_fanout))) goto nla_put_failure; + + if (nla_put_u8(msg, BATADV_ATTR_MULTICAST_MLD_RTR_ONLY_ENABLED, + atomic_read(&bat_priv->multicast_mld_rtr_only))) + goto nla_put_failure; #endif /* CONFIG_BATMAN_ADV_MCAST */ #ifdef CONFIG_BATMAN_ADV_NC @@ -588,6 +593,18 @@ static int batadv_netlink_set_mesh(struct sk_buff *skb, struct genl_info *info) atomic_set(&bat_priv->multicast_fanout, nla_get_u32(attr)); } + + if (info->attrs[BATADV_ATTR_MULTICAST_MLD_RTR_ONLY_ENABLED]) { + u8 mld_rtr_only; + + attr = info->attrs[BATADV_ATTR_MULTICAST_MLD_RTR_ONLY_ENABLED]; + mld_rtr_only = !!nla_get_u8(attr); + if (mld_rtr_only) + batadv_info(bat_priv->soft_iface, + "Warning: MLD-RTR-ONLY is experimental and has known, broken scenarios\n"); + + atomic_set(&bat_priv->multicast_mld_rtr_only, mld_rtr_only); + } #endif /* CONFIG_BATMAN_ADV_MCAST */ #ifdef CONFIG_BATMAN_ADV_NC diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c index 30ecbc2ef1fd..bd9168450995 100644 --- a/net/batman-adv/soft-interface.c +++ b/net/batman-adv/soft-interface.c @@ -762,6 +762,7 @@ static int batadv_softif_init_late(struct net_device *dev) #ifdef CONFIG_BATMAN_ADV_MCAST atomic_set(&bat_priv->multicast_mode, 1); atomic_set(&bat_priv->multicast_fanout, 16); + atomic_set(&bat_priv->multicast_mld_rtr_only, 0); atomic_set(&bat_priv->mcast.num_want_all_unsnoopables, 0); atomic_set(&bat_priv->mcast.num_want_all_ipv4, 0); atomic_set(&bat_priv->mcast.num_want_all_ipv6, 0); diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h index 00840d5784fe..bf8eab36e43b 100644 --- a/net/batman-adv/types.h +++ b/net/batman-adv/types.h @@ -1683,6 +1683,13 @@ struct batadv_priv { * multicast-to-unicast conversion */ atomic_t multicast_fanout; + + /** + * @multicast_mld_rtr_only: bool indicating whether to send IGMP/MLD + * reports only to multicast routers or to flood them otherwise. + * Warning: The former is experimental and potentially unsafe! + */ + atomic_t multicast_mld_rtr_only; #endif /** @orig_interval: OGM broadcast interval in milliseconds */ -- 2.45.2

1 0

BUG: general protection fault in batadv_bla_del_backbone_claims
by Xingyu Li 29 Aug '24

29 Aug '24

Hi, We found a bug in Linux 6.10 using syzkaller. It is probably a null pointer dereference bug. In line 307 of net/batman-adv/bridge_loop_avoidance, when executing "hash = backbone_gw->bat_priv->bla.claim_hash;", it does not check if "backbone_gw->bat_priv==NULL". The bug report and syzkaller reproducer are as follows: bug report: Oops: general protection fault, probably for non-canonical address 0xdffffc000000004a: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000250-0x0000000000000257] CPU: 0 PID: 45 Comm: kworker/u4:3 Not tainted 6.10.0 #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: bat_events batadv_bla_periodic_work RIP: 0010:batadv_bla_del_backbone_claims+0x4e/0x360 net/batman-adv/bridge_loop_avoidance.c:307 Code: 18 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 01 72 33 f7 bd 50 02 00 00 48 03 2b 48 89 e8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 ef e8 e3 71 33 f7 48 8b 6d 00 48 85 ed RSP: 0018:ffffc9000090f9b0 EFLAGS: 00010202 RAX: 000000000000004a RBX: ffff88802cd7c018 RCX: ffff888015370000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88802cd7c000 RBP: 0000000000000250 R08: ffffffff8ac0433d R09: 1ffff110059af805 R10: dffffc0000000000 R11: ffffed10059af806 R12: dffffc0000000000 R13: ffff88802cd7c008 R14: 00000000ffffcf80 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888063a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000556956047f2c CR3: 000000000d932000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> batadv_bla_purge_backbone_gw+0x285/0x4c0 net/batman-adv/bridge_loop_avoidance.c:1254 batadv_bla_periodic_work+0xc3/0xa80 net/batman-adv/bridge_loop_avoidance.c:1445 process_one_work kernel/workqueue.c:3248 [inline] process_scheduled_works+0x977/0x1410 kernel/workqueue.c:3329 worker_thread+0xaa0/0x1020 kernel/workqueue.c:3409 kthread+0x2eb/0x380 kernel/kthread.c:389 ret_from_fork+0x49/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:batadv_bla_del_backbone_claims+0x4e/0x360 net/batman-adv/bridge_loop_avoidance.c:307 Code: 18 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 01 72 33 f7 bd 50 02 00 00 48 03 2b 48 89 e8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 ef e8 e3 71 33 f7 48 8b 6d 00 48 85 ed RSP: 0018:ffffc9000090f9b0 EFLAGS: 00010202 RAX: 000000000000004a RBX: ffff88802cd7c018 RCX: ffff888015370000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88802cd7c000 RBP: 0000000000000250 R08: ffffffff8ac0433d R09: 1ffff110059af805 R10: dffffc0000000000 R11: ffffed10059af806 R12: dffffc0000000000 R13: ffff88802cd7c008 R14: 00000000ffffcf80 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888063a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000556956047f2c CR3: 000000000d932000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 18 48 83 sbb %cl,-0x7d(%rax) 3: c3 ret 4: 18 48 89 sbb %cl,-0x77(%rax) 7: d8 48 c1 fmuls -0x3f(%rax) a: e8 03 42 80 3c call 0x3c804212 f: 20 00 and %al,(%rax) 11: 74 08 je 0x1b 13: 48 89 df mov %rbx,%rdi 16: e8 01 72 33 f7 call 0xf733721c 1b: bd 50 02 00 00 mov $0x250,%ebp 20: 48 03 2b add (%rbx),%rbp 23: 48 89 e8 mov %rbp,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 48 89 ef mov %rbp,%rdi 34: e8 e3 71 33 f7 call 0xf733721c 39: 48 8b 6d 00 mov 0x0(%rbp),%rbp 3d: 48 85 ed test %rbp,%rbp Syzkaller reproducer: # {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}} write$syz_spec_1342568572_346(0xffffffffffffffff, &(0x7f0000000080)={{0x0, 0x4, 0x6}, {0x5, 0x0, 0x111, 0xe, "c2beae5c4e"}}, 0x20) write$syz_spec_18446744072532934322_80(0xffffffffffffffff, &(0x7f0000000000)="2b952480c7ca55097d1707935ba64b20f3026c03d658026b81bf264340512b3cb4e01afda2de754299ea7a113343ab7b9bda2fc0a2e2cdbfecbca0233a0772b12ebde5d98a1203cb871672dff7e4c86ec1dccef0a76312fbe8d45dc2bd0f8fc2ebeb2a6be6a300916c5281da2c1ef64d66267091b82429976c019da3645557ed1d439c5a637f6bf58c53bc414539dd87c69098d671402586b631f9ac5c2fe9cedc281a6f005b5c4d1dd5ed9be400", 0xb4) r0 = syz_open_dev$sg(&(0x7f0000000180), 0x0, 0x109400) ioctl$syz_spec_1724254976_2866(r0, 0x1, &(0x7f0000000080)={0x0, 0x2, [0x85, 0x8, 0x15, 0xd]}) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f00000000c0), 0x109841, 0x0) r1 = openat$ttynull(0xffffffffffffff9c, 0x0, 0x109841, 0x0) ioctl$TIOCSTI(r1, 0x5412, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x1) write$syz_spec_1342568572_233(0xffffffffffffffff, 0x0, 0x0) ioctl$syz_spec_1101043199_396(0xffffffffffffffff, 0x80104d12, 0x0) ioctl$syz_spec_1342803520_149(0xffffffffffffffff, 0x5501, 0xf9d) write$syz_spec_18446744073706268967_8(0xffffffffffffffff, &(0x7f00000002c0)=0xfd80, 0xfffffc34) ioctl$syz_spec_18446744073707301390_3197(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$syz_spec_18446744073707301390_3092(0xffffffffffffffff, 0x40a85321, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x200, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f00003ff000/0xc00000)=nil, 0xc00000, 0xe, 0x9a172, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1000019, 0x42832, 0xffffffffffffffff, 0x10000000) -- Yours sincerely, Xingyu

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

B.A.T.M.A.N August 2024