B.A.T.M.A.N

b.a.t.m.a.n@lists.open-mesh.org

6 participants
4255 discussions

[PATCH] batman-adv: prefer kfree_rcu() over call_rcu() with free-only callbacks
by Dmitry Antipov 12 Mar '24

12 Mar '24

Drop 'batadv_tt_local_entry_free_rcu()', 'batadv_tt_global_entry_free_rcu()' and 'batadv_tt_orig_list_entry_free_rcu()' in favor of 'kfree_rcu()' in 'batadv_tt_local_entry_release()', 'batadv_tt_global_entry_release()' and 'batadv_tt_orig_list_entry_release()', respectively. Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru> --- net/batman-adv/translation-table.c | 47 ++---------------------------- 1 file changed, 3 insertions(+), 44 deletions(-) diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index b95c36765d04..0555cb611489 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -208,20 +208,6 @@ batadv_tt_global_hash_find(struct batadv_priv *bat_priv, const u8 *addr, return tt_global_entry; } -/** - * batadv_tt_local_entry_free_rcu() - free the tt_local_entry - * @rcu: rcu pointer of the tt_local_entry - */ -static void batadv_tt_local_entry_free_rcu(struct rcu_head *rcu) -{ - struct batadv_tt_local_entry *tt_local_entry; - - tt_local_entry = container_of(rcu, struct batadv_tt_local_entry, - common.rcu); - - kmem_cache_free(batadv_tl_cache, tt_local_entry); -} - /** * batadv_tt_local_entry_release() - release tt_local_entry from lists and queue * for free after rcu grace period @@ -236,7 +222,7 @@ static void batadv_tt_local_entry_release(struct kref *ref) batadv_softif_vlan_put(tt_local_entry->vlan); - call_rcu(&tt_local_entry->common.rcu, batadv_tt_local_entry_free_rcu); + kfree_rcu(tt_local_entry, common.rcu); } /** @@ -254,20 +240,6 @@ batadv_tt_local_entry_put(struct batadv_tt_local_entry *tt_local_entry) batadv_tt_local_entry_release); } -/** - * batadv_tt_global_entry_free_rcu() - free the tt_global_entry - * @rcu: rcu pointer of the tt_global_entry - */ -static void batadv_tt_global_entry_free_rcu(struct rcu_head *rcu) -{ - struct batadv_tt_global_entry *tt_global_entry; - - tt_global_entry = container_of(rcu, struct batadv_tt_global_entry, - common.rcu); - - kmem_cache_free(batadv_tg_cache, tt_global_entry); -} - /** * batadv_tt_global_entry_release() - release tt_global_entry from lists and * queue for free after rcu grace period @@ -282,7 +254,7 @@ void batadv_tt_global_entry_release(struct kref *ref) batadv_tt_global_del_orig_list(tt_global_entry); - call_rcu(&tt_global_entry->common.rcu, batadv_tt_global_entry_free_rcu); + kfree_rcu(tt_global_entry, common.rcu); } /** @@ -407,19 +379,6 @@ static void batadv_tt_global_size_dec(struct batadv_orig_node *orig_node, batadv_tt_global_size_mod(orig_node, vid, -1); } -/** - * batadv_tt_orig_list_entry_free_rcu() - free the orig_entry - * @rcu: rcu pointer of the orig_entry - */ -static void batadv_tt_orig_list_entry_free_rcu(struct rcu_head *rcu) -{ - struct batadv_tt_orig_list_entry *orig_entry; - - orig_entry = container_of(rcu, struct batadv_tt_orig_list_entry, rcu); - - kmem_cache_free(batadv_tt_orig_cache, orig_entry); -} - /** * batadv_tt_orig_list_entry_release() - release tt orig entry from lists and * queue for free after rcu grace period @@ -433,7 +392,7 @@ static void batadv_tt_orig_list_entry_release(struct kref *ref) refcount); batadv_orig_node_put(orig_entry->orig_node); - call_rcu(&orig_entry->rcu, batadv_tt_orig_list_entry_free_rcu); + kfree_rcu(orig_entry, rcu); } /** -- 2.44.0

2 1

[PATCH] batman-adv: Avoid infinite loop trying to resize local TT
by Sven Eckelmann 12 Feb '24

12 Feb '24

If the MTU of one of an attached interface becomes too small to transmit the local translation table then it must be resized to fit inside all fragments (when enabled) or a single packet. But if the MTU becomes too low to transmit even the header + the VLAN specific part then the resizing of the local TT will never succeed. This can for example happen when the usable space is 110 bytes and 11 VLANs are on top of batman-adv. In this case, at least 116 byte would be needed. There will just be an endless spam of batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (110) in the log but the function will never finish. Problem here is that the timeout will be halved all the time and will then stagnate at 0 and therefore never be able to reduce the table even more. There are other scenarios possible with a similar result. The number of BATADV_TT_CLIENT_NOPURGE entries in the local TT can for example be too high to fit inside a packet. Such a scenario can therefore happen also with only a single VLAN + 7 non-purgable addresses - requiring at least 120 bytes. While this should be handled proactively when: * interface with too low MTU is added * VLAN is added * non-purgeable local mac is added * MTU of an attached interface is reduced * fragmentation setting gets disabled (which most likely requires dropping attached interfaces) not all of these scenarios can be prevented because batman-adv is only consuming events without the the possibility to prevent these actions (non-purgable MAC address added, MTU of an attached interface is reduced). It is therefore necessary to also make sure that the code is able to handle also the situations when there were already incompatible system configuration are present. Cc: <stable(a)vger.kernel.org> Fixes: f7f2fe494388 ("batman-adv: limit local translation table max size") Reported-by: <syzbot+a6a4b5bb3da165594cff(a)syzkaller.appspotmail.com> Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- net/batman-adv/translation-table.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index b95c3676..2243cec1 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -3948,7 +3948,7 @@ void batadv_tt_local_resize_to_mtu(struct net_device *soft_iface) spin_lock_bh(&bat_priv->tt.commit_lock); - while (true) { + while (timeout) { table_size = batadv_tt_local_table_transmit_size(bat_priv); if (packet_size_max >= table_size) break; --- base-commit: 7d30b5a06020e8c4e53968e4086a0fa6e9fdd947 change-id: 20240212-infinite-tt-resize-285a0d33fff8 Best regards, -- Sven Eckelmann <sven(a)narfation.org>

1 0

[PATCH 0/4] pull request for net-next: batman-adv 2024-02-01
by Simon Wunderlich 02 Feb '24

02 Feb '24

Hi Jakub, hi David, here is a cleanup pull request of batman-adv to go into net-next. Please pull or let me know of any problem! Thank you, Simon The following changes since commit 6613476e225e090cc9aad49be7fa504e290dd33d: Linux 6.8-rc1 (2024-01-21 14:11:32 -0800) are available in the Git repository at: git://git.open-mesh.org/linux-merge.git tags/batadv-next-pullrequest-20240201 for you to fetch changes up to db60ad8b21cee0394cb0a1092d9f9190d310562c: batman-adv: Drop usage of export.h (2024-01-27 09:13:59 +0100) ---------------------------------------------------------------- This cleanup patchset includes the following patches: - bump version strings, by Simon Wunderlich - Improve error handling in DAT and uevent generator, by Markus Elfring (2 patches) - Drop usage of export.h, by Sven Eckelmann ---------------------------------------------------------------- Markus Elfring (2): batman-adv: Return directly after a failed batadv_dat_select_candidates() in batadv_dat_forward_data() batman-adv: Improve exception handling in batadv_throw_uevent() Simon Wunderlich (1): batman-adv: Start new development cycle Sven Eckelmann (1): batman-adv: Drop usage of export.h net/batman-adv/distributed-arp-table.c | 3 +-- net/batman-adv/main.c | 14 ++++++++------ net/batman-adv/main.h | 2 +- net/batman-adv/netlink.c | 1 - 4 files changed, 10 insertions(+), 10 deletions(-)

2 5

[PATCH 0/2] pull request for net: batman-adv 2024-02-01
by Simon Wunderlich 01 Feb '24

01 Feb '24

Hi David, hi Jakub, here are two bugfixes for batman-adv which we would like to have integrated into net. Please pull or let me know of any problem! Thank you, Simon The following changes since commit 6613476e225e090cc9aad49be7fa504e290dd33d: Linux 6.8-rc1 (2024-01-21 14:11:32 -0800) are available in the Git repository at: git://git.open-mesh.org/linux-merge.git tags/batadv-net-pullrequest-20240201 for you to fetch changes up to 0a186b49bba596b81de5a686ce5bfc9cd48ab3ef: batman-adv: mcast: fix memory leak on deleting a batman-adv interface (2024-01-27 09:13:39 +0100) ---------------------------------------------------------------- Here are some batman-adv bugfixes: - fix a timeout issue and a memory leak in batman-adv multicast, by Linus Lüssing (2 patches) ---------------------------------------------------------------- Linus Lüssing (2): batman-adv: mcast: fix mcast packet type counter on timeouted nodes batman-adv: mcast: fix memory leak on deleting a batman-adv interface net/batman-adv/multicast.c | 3 +++ 1 file changed, 3 insertions(+)

2 3

[PATCH net v2] bridge: mcast: fix disabled snooping after long uptime
by Linus Lüssing 31 Jan '24

31 Jan '24

The original idea of the delay_time check was to not apply multicast snooping too early when an MLD querier appears. And to instead wait at least for MLD reports to arrive before switching from flooding to group based, MLD snooped forwarding, to avoid temporary packet loss. However in a batman-adv mesh network it was noticed that after 248 days of uptime 32bit MIPS based devices would start to signal that they had stopped applying multicast snooping due to missing queriers - even though they were the elected querier and still sending MLD queries themselves. While time_is_before_jiffies() generally is safe against jiffies wrap-arounds, like the code comments in jiffies.h explain, it won't be able to track a difference larger than ULONG_MAX/2. With a 32bit large jiffies and one jiffies tick every 10ms (CONFIG_HZ=100) on these MIPS devices running OpenWrt this would result in a difference larger than ULONG_MAX/2 after 248 (= 2^32/100/60/60/24/2) days and time_is_before_jiffies() would then start to return false instead of true. Leading to multicast snooping not being applied to multicast packets anymore. Fix this issue by using a proper timer_list object which won't have this ULONG_MAX/2 difference limitation. Fixes: b00589af3b04 ("bridge: disable snooping if there is no querier") Signed-off-by: Linus Lüssing <linus.luessing(a)c0d3.blue> --- Changelog v2: * removed "inline" from br_multicast_query_delay_expired() net/bridge/br_multicast.c | 20 +++++++++++++++----- net/bridge/br_private.h | 4 ++-- 2 files changed, 17 insertions(+), 7 deletions(-) diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c index d7d021af1029..2d7b73242958 100644 --- a/net/bridge/br_multicast.c +++ b/net/bridge/br_multicast.c @@ -1762,6 +1762,10 @@ static void br_ip6_multicast_querier_expired(struct timer_list *t) } #endif +static void br_multicast_query_delay_expired(struct timer_list *t) +{ +} + static void br_multicast_select_own_querier(struct net_bridge_mcast *brmctx, struct br_ip *ip, struct sk_buff *skb) @@ -3198,7 +3202,7 @@ br_multicast_update_query_timer(struct net_bridge_mcast *brmctx, unsigned long max_delay) { if (!timer_pending(&query->timer)) - query->delay_time = jiffies + max_delay; + mod_timer(&query->delay_timer, jiffies + max_delay); mod_timer(&query->timer, jiffies + brmctx->multicast_querier_interval); } @@ -4041,13 +4045,11 @@ void br_multicast_ctx_init(struct net_bridge *br, brmctx->multicast_querier_interval = 255 * HZ; brmctx->multicast_membership_interval = 260 * HZ; - brmctx->ip4_other_query.delay_time = 0; brmctx->ip4_querier.port_ifidx = 0; seqcount_spinlock_init(&brmctx->ip4_querier.seq, &br->multicast_lock); brmctx->multicast_igmp_version = 2; #if IS_ENABLED(CONFIG_IPV6) brmctx->multicast_mld_version = 1; - brmctx->ip6_other_query.delay_time = 0; brmctx->ip6_querier.port_ifidx = 0; seqcount_spinlock_init(&brmctx->ip6_querier.seq, &br->multicast_lock); #endif @@ -4056,6 +4058,8 @@ void br_multicast_ctx_init(struct net_bridge *br, br_ip4_multicast_local_router_expired, 0); timer_setup(&brmctx->ip4_other_query.timer, br_ip4_multicast_querier_expired, 0); + timer_setup(&brmctx->ip4_other_query.delay_timer, + br_multicast_query_delay_expired, 0); timer_setup(&brmctx->ip4_own_query.timer, br_ip4_multicast_query_expired, 0); #if IS_ENABLED(CONFIG_IPV6) @@ -4063,6 +4067,8 @@ void br_multicast_ctx_init(struct net_bridge *br, br_ip6_multicast_local_router_expired, 0); timer_setup(&brmctx->ip6_other_query.timer, br_ip6_multicast_querier_expired, 0); + timer_setup(&brmctx->ip6_other_query.delay_timer, + br_multicast_query_delay_expired, 0); timer_setup(&brmctx->ip6_own_query.timer, br_ip6_multicast_query_expired, 0); #endif @@ -4197,10 +4203,12 @@ static void __br_multicast_stop(struct net_bridge_mcast *brmctx) { del_timer_sync(&brmctx->ip4_mc_router_timer); del_timer_sync(&brmctx->ip4_other_query.timer); + del_timer_sync(&brmctx->ip4_other_query.delay_timer); del_timer_sync(&brmctx->ip4_own_query.timer); #if IS_ENABLED(CONFIG_IPV6) del_timer_sync(&brmctx->ip6_mc_router_timer); del_timer_sync(&brmctx->ip6_other_query.timer); + del_timer_sync(&brmctx->ip6_other_query.delay_timer); del_timer_sync(&brmctx->ip6_own_query.timer); #endif } @@ -4643,13 +4651,15 @@ int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val) max_delay = brmctx->multicast_query_response_interval; if (!timer_pending(&brmctx->ip4_other_query.timer)) - brmctx->ip4_other_query.delay_time = jiffies + max_delay; + mod_timer(&brmctx->ip4_other_query.delay_timer, + jiffies + max_delay); br_multicast_start_querier(brmctx, &brmctx->ip4_own_query); #if IS_ENABLED(CONFIG_IPV6) if (!timer_pending(&brmctx->ip6_other_query.timer)) - brmctx->ip6_other_query.delay_time = jiffies + max_delay; + mod_timer(&brmctx->ip6_other_query.delay_timer, + jiffies + max_delay); br_multicast_start_querier(brmctx, &brmctx->ip6_own_query); #endif diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h index b0a92c344722..86ea5e6689b5 100644 --- a/net/bridge/br_private.h +++ b/net/bridge/br_private.h @@ -78,7 +78,7 @@ struct bridge_mcast_own_query { /* other querier */ struct bridge_mcast_other_query { struct timer_list timer; - unsigned long delay_time; + struct timer_list delay_timer; }; /* selected querier */ @@ -1159,7 +1159,7 @@ __br_multicast_querier_exists(struct net_bridge_mcast *brmctx, own_querier_enabled = false; } - return time_is_before_jiffies(querier->delay_time) && + return !timer_pending(&querier->delay_timer) && (own_querier_enabled || timer_pending(&querier->timer)); } -- 2.43.0

3 2

Problem starting A.L.F.R.E.D on batman-adv?
by doug.fajardo＠gmail.com 29 Jan '24

29 Jan '24

I cant seem to get A.L.F.R.E.D. to start: doug@dougwork:~/sdshome/alfred$ sudo alfred -b bat0 Can't start server: interface missing batman-adv module is from the Unix kernel distribution (Alfred was added thru the apt package manager, identified as version 2022.0-1 ( I also tried downloading and compiling; no warnings or errors compiling, I saw identical symptoms). The batman-adv network seems to be working properly. It correctly sees two other nodes. Can anyone point out what I am missing ? Thanks! *** Doug OS is Ubuntu bookworm, with latest patches as of today (1/28/2023) doug@dougwork: uname -a Linux dougwork 6.5.0-15-generic #15~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Fri Jan 12 18:54:30 UTC 2 x86_64 x86_64 x86_64 GNU/Linux doug@dougwork: sudo batctl n [B.A.T.M.A.N. adv 2023.1, MainIF/MAC: enp6s0/5c:62:8b:ea:33:b8 (bat0/6e:d4:b2:77:d1:85 BATMAN_IV)] IF Neighbor last-seen enp6s0 d8:3a:dd:4d:35:c4 0.192s enp6s0 dc:a6:32:0b:49:35 0.392s doug@dougwork: ifconfig enp6s0 enp6s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 ether 5c:62:8b:ea:33:b8 txqueuelen 1000 (Ethernet) RX packets 85660 bytes 5364556 (5.3 MB) RX errors 0 dropped 4109 overruns 0 frame 0 TX packets 75996 bytes 104561707 (104.5 MB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

4 3

[PATCH 0/6] batctl: tcpdump: Fix problems detected during fuzzing
by Sven Eckelmann 27 Jan '24

27 Jan '24

While many parts of batctl are rather simple, tcpdump is one of the most complex parts - which unfortunately is also dealing all the time with potentially harmful input. It is therefore a good idea to perform some tests to figure out how bad the current state of the code is. The findings will be presented here - including some information how other people can reproduce these problems. With afl++, it is possible to fuzz batctl tcpdump and find parsing errors (easier). But it needs an entry point to actually send data to. So for simplicity, a fuzzme subcommand was added which just gets new data from afl++ and then runs the main ethernet parsing function. diff --git a/split_pcap.py b/split_pcap.py new file mode 100755 index 0000000000000000000000000000000000000000..11a1f5ce8ec60fac141693b0449d5c3955f9ad28 --- /dev/null +++ b/split_pcap.py @@ -0,0 +1,21 @@ +#!/usr/bin/env python3 + +import sys + +from hashlib import sha256 +from scapy.utils import rdpcap + + +def main(): + for pcap in sys.argv[1:]: + packets = rdpcap(pcap) + for packet in packets: + m = sha256() + m.update(packet.load) + fname = m.hexdigest() + with open(fname, "wb") as f: + f.write(packet.load) + + +if __name__ == "__main__": + main() diff --git a/tcpdump.c b/tcpdump.c index 5e7c76c69bd192d7485958aafabc0e9264b41b90..d340af986f99bdf2e8e6dae0d91a641bc80e82a2 100644 --- a/tcpdump.c +++ b/tcpdump.c @@ -1556,3 +1556,41 @@ static int tcpdump(struct state *state __maybe_unused, int argc, char **argv) COMMAND(SUBCOMMAND, tcpdump, "td", 0, NULL, "<interface> \ttcpdump layer 2 traffic on the given interface"); + +__AFL_FUZZ_INIT(); + +static int fuzzme(struct state *state __maybe_unused, int argc, char **argv) +{ + dump_level = dump_level_all; + +#ifdef __AFL_HAVE_MANUAL_CONTROL + __AFL_INIT(); +#endif + + unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF; + while (__AFL_LOOP(10000)) { + int len = __AFL_FUZZ_TESTCASE_LEN; + + /* safety check from tcpdump */ + if ((size_t)len < sizeof(struct ether_header)) + continue; + + /* move into new buffer to allow ASAN to detect invalid memory access */ + unsigned char *p = malloc(len); + if (!p) + continue; + + memcpy(p, buf, len); + + /* function under test */ + parse_eth_hdr(p, len, 0, 0); + + /* drop buffer from asan */ + free(p); + } + + return 0; +} + +COMMAND(SUBCOMMAND, fuzzme, "fz", 0, NULL, To build the fuzzing test, it is necessary to build batctl slightly differently: make clean export AFL_USE_ASAN=1; CC=afl-clang-fast make V=s And the some input files (containing raw ethernet fames have to be generated from existing pcaps): mkdir in cd in ../split_pcap.py ~/wireshark-batman-adv/tests/* cd .. And then multiple afl++ fuzzer instances can be started. if [ -z "${STY}" ]; then echo "must be started inside a screen session" >&2 exit 1 fi for i in $(seq 1 $(nproc)); do start_mode=-M [ "${i}" = "1" ] || start_mode=-S screen afl-fuzz "${start_mode}" "fuzzer${i}" -i in -o out ./batctl fuzzme done The crashes can then be analyzed further by sending them to the fuzzme subcommand: ./batctl fuzzme < out/fuzzer1/crashes/id:000000,sig:06,src:000528,time:12,execs:23992,op:havoc,rep:8 Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- Sven Eckelmann (6): batctl: tcpdump: Fix missing sanity check for batman-adv header batctl: tcpdump: Add missing throughput header length check batctl: tcpdump: Fix IPv4 header length check batctl: tcpdump: Add missing ICMPv6 Neighbor Advert length check batctl: tcpdump: Add missing ICMPv6 Neighbor Solicit length check batctl: tcpdump: Fix ICMPv4 inner IPv4 header length check tcpdump.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-) --- base-commit: a57de3183e67ec27cf96f1761e69d542e6dfac03 change-id: 20240127-tcpdump_fuzzing-736774906f60 Best regards, -- Sven Eckelmann <sven(a)narfation.org>

1 7

[PATCH net] bridge: mcast: fix disabled snooping after long uptime
by Linus Lüssing 27 Jan '24

27 Jan '24

The original idea of the delay_time check was to not apply multicast snooping too early when an MLD querier appears. And to instead wait at least for MLD reports to arrive before switching from flooding to group based, MLD snooped forwarding, to avoid temporary packet loss. However in a batman-adv mesh network it was noticed that after 248 days of uptime 32bit MIPS based devices would start to signal that they had stopped applying multicast snooping due to missing queriers - even though they were the elected querier and still sending MLD queries themselves. While time_is_before_jiffies() generally is safe against jiffies wrap-arounds, like the code comments in jiffies.h explain, it won't be able to track a difference larger than ULONG_MAX/2. With a 32bit large jiffies and one jiffies tick every 10ms (CONFIG_HZ=100) on these MIPS devices running OpenWrt this would result in a difference larger than ULONG_MAX/2 after 248 (= 2^32/100/60/60/24/2) days and time_is_before_jiffies() would then start to return false instead of true. Leading to multicast snooping not being applied to multicast packets anymore. Fix this issue by using a proper timer_list object which won't have this ULONG_MAX/2 difference limitation. Fixes: b00589af3b04 ("bridge: disable snooping if there is no querier") Signed-off-by: Linus Lüssing <linus.luessing(a)c0d3.blue> --- net/bridge/br_multicast.c | 20 +++++++++++++++----- net/bridge/br_private.h | 4 ++-- 2 files changed, 17 insertions(+), 7 deletions(-) diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c index d7d021af1029..df14ee36ea20 100644 --- a/net/bridge/br_multicast.c +++ b/net/bridge/br_multicast.c @@ -1762,6 +1762,10 @@ static void br_ip6_multicast_querier_expired(struct timer_list *t) } #endif +static inline void br_multicast_query_delay_expired(struct timer_list *t) +{ +} + static void br_multicast_select_own_querier(struct net_bridge_mcast *brmctx, struct br_ip *ip, struct sk_buff *skb) @@ -3198,7 +3202,7 @@ br_multicast_update_query_timer(struct net_bridge_mcast *brmctx, unsigned long max_delay) { if (!timer_pending(&query->timer)) - query->delay_time = jiffies + max_delay; + mod_timer(&query->delay_timer, jiffies + max_delay); mod_timer(&query->timer, jiffies + brmctx->multicast_querier_interval); } @@ -4041,13 +4045,11 @@ void br_multicast_ctx_init(struct net_bridge *br, brmctx->multicast_querier_interval = 255 * HZ; brmctx->multicast_membership_interval = 260 * HZ; - brmctx->ip4_other_query.delay_time = 0; brmctx->ip4_querier.port_ifidx = 0; seqcount_spinlock_init(&brmctx->ip4_querier.seq, &br->multicast_lock); brmctx->multicast_igmp_version = 2; #if IS_ENABLED(CONFIG_IPV6) brmctx->multicast_mld_version = 1; - brmctx->ip6_other_query.delay_time = 0; brmctx->ip6_querier.port_ifidx = 0; seqcount_spinlock_init(&brmctx->ip6_querier.seq, &br->multicast_lock); #endif @@ -4056,6 +4058,8 @@ void br_multicast_ctx_init(struct net_bridge *br, br_ip4_multicast_local_router_expired, 0); timer_setup(&brmctx->ip4_other_query.timer, br_ip4_multicast_querier_expired, 0); + timer_setup(&brmctx->ip4_other_query.delay_timer, + br_multicast_query_delay_expired, 0); timer_setup(&brmctx->ip4_own_query.timer, br_ip4_multicast_query_expired, 0); #if IS_ENABLED(CONFIG_IPV6) @@ -4063,6 +4067,8 @@ void br_multicast_ctx_init(struct net_bridge *br, br_ip6_multicast_local_router_expired, 0); timer_setup(&brmctx->ip6_other_query.timer, br_ip6_multicast_querier_expired, 0); + timer_setup(&brmctx->ip6_other_query.delay_timer, + br_multicast_query_delay_expired, 0); timer_setup(&brmctx->ip6_own_query.timer, br_ip6_multicast_query_expired, 0); #endif @@ -4197,10 +4203,12 @@ static void __br_multicast_stop(struct net_bridge_mcast *brmctx) { del_timer_sync(&brmctx->ip4_mc_router_timer); del_timer_sync(&brmctx->ip4_other_query.timer); + del_timer_sync(&brmctx->ip4_other_query.delay_timer); del_timer_sync(&brmctx->ip4_own_query.timer); #if IS_ENABLED(CONFIG_IPV6) del_timer_sync(&brmctx->ip6_mc_router_timer); del_timer_sync(&brmctx->ip6_other_query.timer); + del_timer_sync(&brmctx->ip6_other_query.delay_timer); del_timer_sync(&brmctx->ip6_own_query.timer); #endif } @@ -4643,13 +4651,15 @@ int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val) max_delay = brmctx->multicast_query_response_interval; if (!timer_pending(&brmctx->ip4_other_query.timer)) - brmctx->ip4_other_query.delay_time = jiffies + max_delay; + mod_timer(&brmctx->ip4_other_query.delay_timer, + jiffies + max_delay); br_multicast_start_querier(brmctx, &brmctx->ip4_own_query); #if IS_ENABLED(CONFIG_IPV6) if (!timer_pending(&brmctx->ip6_other_query.timer)) - brmctx->ip6_other_query.delay_time = jiffies + max_delay; + mod_timer(&brmctx->ip6_other_query.delay_timer, + jiffies + max_delay); br_multicast_start_querier(brmctx, &brmctx->ip6_own_query); #endif diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h index b0a92c344722..86ea5e6689b5 100644 --- a/net/bridge/br_private.h +++ b/net/bridge/br_private.h @@ -78,7 +78,7 @@ struct bridge_mcast_own_query { /* other querier */ struct bridge_mcast_other_query { struct timer_list timer; - unsigned long delay_time; + struct timer_list delay_timer; }; /* selected querier */ @@ -1159,7 +1159,7 @@ __br_multicast_querier_exists(struct net_bridge_mcast *brmctx, own_querier_enabled = false; } - return time_is_before_jiffies(querier->delay_time) && + return !timer_pending(&querier->delay_timer) && (own_querier_enabled || timer_pending(&querier->timer)); } -- 2.43.0

2 1

[PATCH] batman-adv: Drop usage of export.h
by Sven Eckelmann 22 Jan '24

22 Jan '24

The linux/export.h include was introduced in commit f6977d91a992 ("batman-adv: Introduce missing headers for genetlink restructure") to have access to THIS_MODULE. But with commit 5b20755b7780 ("init: move THIS_MODULE from <linux/export.h> to <linux/init.h>"), it was moved and the include for export.h is no longer needed. Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- net/batman-adv/netlink.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/batman-adv/netlink.c b/net/batman-adv/netlink.c index cda99753..6aff7cc1 100644 --- a/net/batman-adv/netlink.c +++ b/net/batman-adv/netlink.c @@ -15,7 +15,6 @@ #include <linux/cache.h> #include <linux/err.h> #include <linux/errno.h> -#include <linux/export.h> #include <linux/genetlink.h> #include <linux/gfp.h> #include <linux/if_ether.h> --- base-commit: ecdc425a87d40eba44c9c094293d50d3e9a38b45 change-id: 20240122-no-export-header-0293ee4ccd11 Best regards, -- Sven Eckelmann <sven(a)narfation.org>

1 0

[syzbot] [btrfs?] memory leak in corrupted
by syzbot 17 Jan '24

17 Jan '24

Hello, syzbot found the following issue on: HEAD commit: 052d534373b7 Merge tag 'exfat-for-6.8-rc1' of git://git.ke.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=14620debe80000 kernel config: https://syzkaller.appspot.com/x/.config?x=a7031f9e71583b4a dashboard link: https://syzkaller.appspot.com/bug?extid=ebe64cc5950868e77358 compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16a344c1e80000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/82a7201eef4c/disk-052d5343.raw… vmlinux: https://storage.googleapis.com/syzbot-assets/ca12b4c31826/vmlinux-052d5343.… kernel image: https://storage.googleapis.com/syzbot-assets/3f07360ba5a8/bzImage-052d5343.… IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+ebe64cc5950868e77358(a)syzkaller.appspotmail.com BUG: memory leak unreferenced object 0xffff88811c71a980 (size 64): comm "syz-executor.7", pid 5063, jiffies 4294953937 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 20 8e 7e 1c 81 88 ff ff ........ .~..... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 9f8721dd): [<ffffffff815f7d53>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff815f7d53>] slab_post_alloc_hook mm/slub.c:3817 [inline] [<ffffffff815f7d53>] slab_alloc_node mm/slub.c:3860 [inline] [<ffffffff815f7d53>] kmalloc_trace+0x283/0x330 mm/slub.c:4007 [<ffffffff84aae617>] kmalloc include/linux/slab.h:590 [inline] [<ffffffff84aae617>] kzalloc include/linux/slab.h:711 [inline] [<ffffffff84aae617>] batadv_tvlv_handler_register+0xf7/0x2a0 net/batman-adv/tvlv.c:560 [<ffffffff84a8d09f>] batadv_mcast_init+0x4f/0xc0 net/batman-adv/multicast.c:1926 [<ffffffff84a895b9>] batadv_mesh_init+0x209/0x2f0 net/batman-adv/main.c:231 [<ffffffff84a9fa88>] batadv_softif_init_late+0x1f8/0x280 net/batman-adv/soft-interface.c:812 [<ffffffff83f48559>] register_netdevice+0x189/0xca0 net/core/dev.c:10188 [<ffffffff84a9f255>] batadv_softif_newlink+0x55/0x70 net/batman-adv/soft-interface.c:1088 [<ffffffff83f61dc0>] rtnl_newlink_create net/core/rtnetlink.c:3515 [inline] [<ffffffff83f61dc0>] __rtnl_newlink+0xb10/0xec0 net/core/rtnetlink.c:3735 [<ffffffff83f621bc>] rtnl_newlink+0x4c/0x70 net/core/rtnetlink.c:3748 [<ffffffff83f5cd1f>] rtnetlink_rcv_msg+0x22f/0x5b0 net/core/rtnetlink.c:6615 [<ffffffff84093291>] netlink_rcv_skb+0x91/0x1d0 net/netlink/af_netlink.c:2543 [<ffffffff84092242>] netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] [<ffffffff84092242>] netlink_unicast+0x2c2/0x440 net/netlink/af_netlink.c:1367 [<ffffffff84092701>] netlink_sendmsg+0x341/0x690 net/netlink/af_netlink.c:1908 [<ffffffff83ef2912>] sock_sendmsg_nosec net/socket.c:730 [inline] [<ffffffff83ef2912>] __sock_sendmsg+0x52/0xa0 net/socket.c:745 [<ffffffff83ef5af4>] __sys_sendto+0x164/0x1e0 net/socket.c:2191 [<ffffffff83ef5b98>] __do_sys_sendto net/socket.c:2203 [inline] [<ffffffff83ef5b98>] __se_sys_sendto net/socket.c:2199 [inline] [<ffffffff83ef5b98>] __x64_sys_sendto+0x28/0x30 net/socket.c:2199 BUG: memory leak unreferenced object 0xffff88811c8561c0 (size 64): comm "syz-executor.0", pid 5062, jiffies 4294953941 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 20 ce 7e 1c 81 88 ff ff ........ .~..... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 7256c890): [<ffffffff815f7d53>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff815f7d53>] slab_post_alloc_hook mm/slub.c:3817 [inline] [<ffffffff815f7d53>] slab_alloc_node mm/slub.c:3860 [inline] [<ffffffff815f7d53>] kmalloc_trace+0x283/0x330 mm/slub.c:4007 [<ffffffff84aae617>] kmalloc include/linux/slab.h:590 [inline] [<ffffffff84aae617>] kzalloc include/linux/slab.h:711 [inline] [<ffffffff84aae617>] batadv_tvlv_handler_register+0xf7/0x2a0 net/batman-adv/tvlv.c:560 [<ffffffff84a8d09f>] batadv_mcast_init+0x4f/0xc0 net/batman-adv/multicast.c:1926 [<ffffffff84a895b9>] batadv_mesh_init+0x209/0x2f0 net/batman-adv/main.c:231 [<ffffffff84a9fa88>] batadv_softif_init_late+0x1f8/0x280 net/batman-adv/soft-interface.c:812 [<ffffffff83f48559>] register_netdevice+0x189/0xca0 net/core/dev.c:10188 [<ffffffff84a9f255>] batadv_softif_newlink+0x55/0x70 net/batman-adv/soft-interface.c:1088 [<ffffffff83f61dc0>] rtnl_newlink_create net/core/rtnetlink.c:3515 [inline] [<ffffffff83f61dc0>] __rtnl_newlink+0xb10/0xec0 net/core/rtnetlink.c:3735 [<ffffffff83f621bc>] rtnl_newlink+0x4c/0x70 net/core/rtnetlink.c:3748 [<ffffffff83f5cd1f>] rtnetlink_rcv_msg+0x22f/0x5b0 net/core/rtnetlink.c:6615 [<ffffffff84093291>] netlink_rcv_skb+0x91/0x1d0 net/netlink/af_netlink.c:2543 [<ffffffff84092242>] netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] [<ffffffff84092242>] netlink_unicast+0x2c2/0x440 net/netlink/af_netlink.c:1367 [<ffffffff84092701>] netlink_sendmsg+0x341/0x690 net/netlink/af_netlink.c:1908 [<ffffffff83ef2912>] sock_sendmsg_nosec net/socket.c:730 [inline] [<ffffffff83ef2912>] __sock_sendmsg+0x52/0xa0 net/socket.c:745 [<ffffffff83ef5af4>] __sys_sendto+0x164/0x1e0 net/socket.c:2191 [<ffffffff83ef5b98>] __do_sys_sendto net/socket.c:2203 [inline] [<ffffffff83ef5b98>] __se_sys_sendto net/socket.c:2199 [inline] [<ffffffff83ef5b98>] __x64_sys_sendto+0x28/0x30 net/socket.c:2199 BUG: memory leak unreferenced object 0xffff88811cd88cc0 (size 64): comm "syz-executor.5", pid 5078, jiffies 4294953981 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 20 8e 05 1d 81 88 ff ff ........ ....... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc a919e6d6): [<ffffffff815f7d53>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff815f7d53>] slab_post_alloc_hook mm/slub.c:3817 [inline] [<ffffffff815f7d53>] slab_alloc_node mm/slub.c:3860 [inline] [<ffffffff815f7d53>] kmalloc_trace+0x283/0x330 mm/slub.c:4007 [<ffffffff84aae617>] kmalloc include/linux/slab.h:590 [inline] [<ffffffff84aae617>] kzalloc include/linux/slab.h:711 [inline] [<ffffffff84aae617>] batadv_tvlv_handler_register+0xf7/0x2a0 net/batman-adv/tvlv.c:560 [<ffffffff84a8d09f>] batadv_mcast_init+0x4f/0xc0 net/batman-adv/multicast.c:1926 [<ffffffff84a895b9>] batadv_mesh_init+0x209/0x2f0 net/batman-adv/main.c:231 [<ffffffff84a9fa88>] batadv_softif_init_late+0x1f8/0x280 net/batman-adv/soft-interface.c:812 [<ffffffff83f48559>] register_netdevice+0x189/0xca0 net/core/dev.c:10188 [<ffffffff84a9f255>] batadv_softif_newlink+0x55/0x70 net/batman-adv/soft-interface.c:1088 [<ffffffff83f61dc0>] rtnl_newlink_create net/core/rtnetlink.c:3515 [inline] [<ffffffff83f61dc0>] __rtnl_newlink+0xb10/0xec0 net/core/rtnetlink.c:3735 [<ffffffff83f621bc>] rtnl_newlink+0x4c/0x70 net/core/rtnetlink.c:3748 [<ffffffff83f5cd1f>] rtnetlink_rcv_msg+0x22f/0x5b0 net/core/rtnetlink.c:6615 [<ffffffff84093291>] netlink_rcv_skb+0x91/0x1d0 net/netlink/af_netlink.c:2543 [<ffffffff84092242>] netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] [<ffffffff84092242>] netlink_unicast+0x2c2/0x440 net/netlink/af_netlink.c:1367 [<ffffffff84092701>] netlink_sendmsg+0x341/0x690 net/netlink/af_netlink.c:1908 [<ffffffff83ef2912>] sock_sendmsg_nosec net/socket.c:730 [inline] [<ffffffff83ef2912>] __sock_sendmsg+0x52/0xa0 net/socket.c:745 [<ffffffff83ef5af4>] __sys_sendto+0x164/0x1e0 net/socket.c:2191 [<ffffffff83ef5b98>] __do_sys_sendto net/socket.c:2203 [inline] [<ffffffff83ef5b98>] __se_sys_sendto net/socket.c:2199 [inline] [<ffffffff83ef5b98>] __x64_sys_sendto+0x28/0x30 net/socket.c:2199 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup

2 3

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

B.A.T.M.A.N