B.A.T.M.A.N

b.a.t.m.a.n@lists.open-mesh.org

15 participants
4308 discussions

[B.A.T.M.A.N.] Possible null pointer dereference in batman's update_routes
by Sven Eckelmann 27 Sep '08

27 Sep '08

Hi, I am not sure but I think it could be possible that there is a null pointer dereference at batman.c:420 I assume that it is possible that neigh_node is NULL and orig_node->router is also NULL in batman.c:412. Now we dereference neigh_node in batman.c:420 as third parameter of add_del_route. I don't know if the third parameter should be set to 0 if neigh_node is NULL or if the "if"-statement is wrong - so i will not send a patch this time. Best regards, Sven

2 1

[B.A.T.M.A.N.] [PATCH] Sync hash implementation of batgat and batman-adv
by Sven Eckelmann 26 Sep '08

26 Sep '08

The compare functions had a different interpretation of its return value and kmalloc can sleep inside batgat because we are running in user context of kernel. --- batman/linux/modules/gateway.c | 4 +- batman/linux/modules/gateway24.c | 4 +- batman/linux/modules/hash.c | 266 ++++++++++++++++++++------------------ batman/linux/modules/hash.h | 9 +- 4 files changed, 149 insertions(+), 134 deletions(-) diff --git a/batman/linux/modules/gateway.c b/batman/linux/modules/gateway.c index 41d75b5..1f2dc24 100644 --- a/batman/linux/modules/gateway.c +++ b/batman/linux/modules/gateway.c @@ -713,12 +713,12 @@ static struct gw_client *get_ip_addr(struct sockaddr_in *client_addr) * the ip address is the first/second field in the struct */ int compare_wip(void *data1, void *data2) { - return ( memcmp( data1, data2, 4 ) ); + return ( !memcmp( data1, data2, 4 ) ); } int compare_vip(void *data1, void *data2) { - return ( memcmp( data1 + 4, data2 + 4, 4 ) ); + return ( !memcmp( data1 + 4, data2 + 4, 4 ) ); } /* hashfunction to choose an entry in a hash table of given size */ diff --git a/batman/linux/modules/gateway24.c b/batman/linux/modules/gateway24.c index dbd1f42..a8d58e6 100644 --- a/batman/linux/modules/gateway24.c +++ b/batman/linux/modules/gateway24.c @@ -693,12 +693,12 @@ static int kernel_recvmsg(struct socket *sock, struct msghdr *msg, struct iovec int compare_wip(void *data1, void *data2) { - return ( memcmp( data1, data2, 4 ) ); + return ( !memcmp( data1, data2, 4 ) ); } int compare_vip(void *data1, void *data2) { - return ( memcmp( data1 + 4, data2 + 4, 4 ) ); + return ( !memcmp( data1 + 4, data2 + 4, 4 ) ); } int choose_wip(void *data, int32_t size) diff --git a/batman/linux/modules/hash.c b/batman/linux/modules/hash.c index ae009be..e88c6e0 100644 --- a/batman/linux/modules/hash.c +++ b/batman/linux/modules/hash.c @@ -1,6 +1,6 @@ -/* Copyright (C) 2006 B.A.T.M.A.N. contributors: +/* + * Copyright (C) 2006-2008 B.A.T.M.A.N. contributors: * Simon Wunderlich, Marek Lindner - * * This program is free software; you can redistribute it and/or * modify it under the terms of version 2 of the GNU General Public * License as published by the Free Software Foundation. @@ -17,294 +17,304 @@ * */ + + + + #include <linux/string.h> /* strlen, strstr, strncmp ... */ #include <linux/slab.h> #include "hash.h" + /* clears the hash */ -void hash_init(struct hashtable_t *hash) { +void hash_init(struct hashtable_t *hash) +{ int i; - hash->elements=0; - for (i=0 ; i<hash->size ; i++) { + + hash->elements = 0; + + for (i = 0 ; i < hash->size; i++) hash->table[i] = NULL; - } } - /* remove the hash structure. if hashdata_free_cb != NULL, * this function will be called to remove the elements inside of the hash. * if you don't remove the elements, memory might be leaked. */ -void hash_delete(struct hashtable_t *hash, hashdata_free_cb free_cb) { +void hash_delete(struct hashtable_t *hash, hashdata_free_cb free_cb) +{ struct element_t *bucket, *last_bucket; int i; - for (i=0; i<hash->size; i++) { + for (i = 0; i < hash->size; i++) { + bucket = hash->table[i]; - bucket= hash->table[i]; while (bucket != NULL) { + if (free_cb != NULL) + free_cb(bucket->data); - if (free_cb!=NULL) - free_cb( bucket->data ); - - last_bucket= bucket; - bucket= bucket->next; + last_bucket = bucket; + bucket = bucket->next; kfree(last_bucket); - } } + hash_destroy(hash); } - - /* free only the hashtable and the hash itself. */ -void hash_destroy(struct hashtable_t *hash) { - - kfree( hash->table ); - kfree( hash ); - +void hash_destroy(struct hashtable_t *hash) +{ + kfree(hash->table); + kfree(hash); } - - - /* iterate though the hash. first element is selected with iter_in NULL. * use the returned iterator to access the elements until hash_it_t returns NULL. */ -struct hash_it_t *hash_iterate(struct hashtable_t *hash, struct hash_it_t *iter_in) { +struct hash_it_t *hash_iterate(struct hashtable_t *hash, struct hash_it_t *iter_in) +{ struct hash_it_t *iter; if (iter_in == NULL) { - iter= kmalloc(sizeof(struct hash_it_t), GFP_KERNEL); - iter->index = -1; + iter = kmalloc(sizeof(struct hash_it_t), GFP_KERNEL); + iter->index = -1; iter->bucket = NULL; iter->prev_bucket = NULL; - } else + } else { iter= iter_in; + } /* sanity checks first (if our bucket got deleted in the last iteration): */ - if (iter->bucket!=NULL) { + if (iter->bucket != NULL) { if (iter->first_bucket != NULL) { - /* we're on the first element and it got removed after the last iteration. */ if ((*iter->first_bucket) != iter->bucket) { - /* there are still other elements in the list */ - if ( (*iter->first_bucket) != NULL ) { + if ((*iter->first_bucket) != NULL) { iter->prev_bucket = NULL; - iter->bucket= (*iter->first_bucket); - iter->first_bucket = &hash->table[ iter->index ]; - return(iter); + iter->bucket = (*iter->first_bucket); + iter->first_bucket = &hash->table[iter->index]; + return iter; } else { iter->bucket = NULL; } - } - - } else if ( iter->prev_bucket != NULL ) { - - /* we're not on the first element, and the bucket got removed after the last iteration. + } else if (iter->prev_bucket != NULL) { + /* + * we're not on the first element, and the bucket got removed after the last iteration. * the last bucket's next pointer is not pointing to our actual bucket anymore. - * select the next. */ - if ( iter->prev_bucket->next != iter->bucket ) - iter->bucket= iter->prev_bucket; - + * select the next. + */ + if (iter->prev_bucket->next != iter->bucket) + iter->bucket = iter->prev_bucket; } - } /* now as we are sane, select the next one if there is some */ - if (iter->bucket!=NULL) { - if (iter->bucket->next!=NULL) { - iter->prev_bucket= iter->bucket; - iter->bucket= iter->bucket->next; + if (iter->bucket != NULL) { + if (iter->bucket->next != NULL) { + iter->prev_bucket = iter->bucket; + iter->bucket = iter->bucket->next; iter->first_bucket = NULL; - return(iter); + return iter; } } - /* if not returned yet, we've reached the last one on the index and have to search forward */ + /* if not returned yet, we've reached the last one on the index and have to search forward */ iter->index++; - while ( iter->index < hash->size ) { /* go through the entries of the hash table */ - if ((hash->table[ iter->index ]) != NULL){ + /* go through the entries of the hash table */ + while (iter->index < hash->size) { + if ((hash->table[iter->index]) != NULL){ iter->prev_bucket = NULL; - iter->bucket = hash->table[ iter->index ]; - iter->first_bucket = &hash->table[ iter->index ]; - return(iter); /* if this table entry is not null, return it */ - } else - iter->index++; /* else, go to the next */ + iter->bucket = hash->table[iter->index]; + iter->first_bucket = &hash->table[iter->index]; + return iter; + } else { + iter->index++; + } } + /* nothing to iterate over anymore */ kfree(iter); - return(NULL); + return NULL; } - /* allocates and clears the hash */ -struct hashtable_t *hash_new(int size, hashdata_compare_cb compare, hashdata_choose_cb choose) { +struct hashtable_t *hash_new(int size, hashdata_compare_cb compare, hashdata_choose_cb choose) +{ struct hashtable_t *hash; - hash= kmalloc( sizeof(struct hashtable_t) , GFP_KERNEL); - if ( hash == NULL ) /* could not allocate the hash control structure */ - return (NULL); + hash = kmalloc(sizeof(struct hashtable_t) , GFP_KERNEL); + + if (hash == NULL) + return NULL; - hash->size= size; - hash->table= kmalloc( sizeof(struct element_t *) * size, GFP_KERNEL); - if ( hash->table == NULL ) { /* could not allocate the table */ + hash->size = size; + hash->table = kmalloc(sizeof(struct element_t *) * size, GFP_KERNEL); + + if (hash->table == NULL) { kfree(hash); - return(NULL); + return NULL; } + hash_init(hash); - hash->compare= compare; - hash->choose= choose; - return(hash); -} + hash->compare = compare; + hash->choose = choose; + + return hash; +} /* adds data to the hashtable. returns 0 on success, -1 on error */ -int hash_add(struct hashtable_t *hash, void *data) { +int hash_add(struct hashtable_t *hash, void *data) +{ int index; struct element_t *bucket, *prev_bucket = NULL; - index = hash->choose( data, hash->size ); + index = hash->choose(data, hash->size); bucket = hash->table[index]; - while ( bucket!=NULL ) { - if (0 == hash->compare( bucket->data, data )) - return(-1); + while (bucket != NULL) { + if (hash->compare(bucket->data, data)) + return -1; prev_bucket = bucket; - bucket= bucket->next; + bucket = bucket->next; } /* found the tail of the list, add new element */ - if (NULL == (bucket= kmalloc(sizeof(struct element_t),GFP_KERNEL))) - return(-1); /* debugMalloc failed */ + bucket = kmalloc(sizeof(struct element_t),GFP_KERNEL); + + if (bucket == NULL) + return -1; - bucket->data= data; /* init the new bucket */ - bucket->next= NULL; + bucket->data = data; + bucket->next = NULL; /* and link it */ - if ( prev_bucket == NULL ) { + if (prev_bucket == NULL) hash->table[index] = bucket; - } else { + else prev_bucket->next = bucket; - } hash->elements++; - return(0); - + return 0; } + /* finds data, based on the key in keydata. returns the found data on success, or NULL on error */ -void *hash_find(struct hashtable_t *hash, void *keydata) { +void *hash_find(struct hashtable_t *hash, void *keydata) +{ int index; struct element_t *bucket; - index = hash->choose( keydata , hash->size ); + index = hash->choose(keydata , hash->size); bucket = hash->table[index]; - while ( bucket!=NULL ) { - if (0 == hash->compare( bucket->data, keydata )) - return( bucket->data ); + while (bucket != NULL) { + if (hash->compare(bucket->data, keydata)) + return bucket->data; - bucket= bucket->next; + bucket = bucket->next; } - return(NULL); - + return NULL; } /* remove bucket (this might be used in hash_iterate() if you already found the bucket * you want to delete and don't need the overhead to find it again with hash_remove(). * But usually, you don't want to use this function, as it fiddles with hash-internals. */ -void *hash_remove_bucket(struct hashtable_t *hash, struct hash_it_t *hash_it_t) { +void *hash_remove_bucket(struct hashtable_t *hash, struct hash_it_t *hash_it_t) +{ void *data_save; - data_save = hash_it_t->bucket->data; /* save the pointer to the data */ + data_save = hash_it_t->bucket->data; - if ( hash_it_t->prev_bucket != NULL ) { + if (hash_it_t->prev_bucket != NULL) hash_it_t->prev_bucket->next = hash_it_t->bucket->next; - } else if ( hash_it_t->first_bucket != NULL ) { + else if (hash_it_t->first_bucket != NULL) (*hash_it_t->first_bucket) = hash_it_t->bucket->next; - } kfree(hash_it_t->bucket); - hash->elements--; - return( data_save ); + return data_save; } - /* removes data from hash, if found. returns pointer do data on success, * so you can remove the used structure yourself, or NULL on error . * data could be the structure you use with just the key filled, * we just need the key for comparing. */ -void *hash_remove(struct hashtable_t *hash, void *data) { +void *hash_remove(struct hashtable_t *hash, void *data) +{ struct hash_it_t hash_it_t; - hash_it_t.index = hash->choose( data, hash->size ); + hash_it_t.index = hash->choose(data, hash->size); hash_it_t.bucket = hash->table[hash_it_t.index]; hash_it_t.prev_bucket = NULL; - while ( hash_it_t.bucket!=NULL ) { - if (0 == hash->compare( hash_it_t.bucket->data, data )) { + while (hash_it_t.bucket != NULL) { + if (hash->compare(hash_it_t.bucket->data, data)) { hash_it_t.first_bucket = (hash_it_t.bucket == hash->table[hash_it_t.index] ? &hash->table[ hash_it_t.index ] : NULL); - return( hash_remove_bucket(hash, &hash_it_t) ); + return hash_remove_bucket(hash, &hash_it_t); } hash_it_t.prev_bucket = hash_it_t.bucket; hash_it_t.bucket= hash_it_t.bucket->next; } - return(NULL); - + return NULL; } - /* resize the hash, returns the pointer to the new hash or NULL on error. removes the old hash on success. */ -struct hashtable_t *hash_resize(struct hashtable_t *hash, int size) { +struct hashtable_t *hash_resize(struct hashtable_t *hash, int size) +{ struct hashtable_t *new_hash; struct element_t *bucket; int i; /* initialize a new hash with the new size */ - if (NULL == (new_hash= hash_new(size, hash->compare, hash->choose))) - return(NULL); + new_hash = hash_new(size, hash->compare, hash->choose); + + if (new_hash == NULL) + return NULL; /* copy the elements */ - for (i=0; i<hash->size; i++) { - bucket= hash->table[i]; + for (i = 0; i < hash->size; i++) { + bucket = hash->table[i]; + while (bucket != NULL) { - hash_add( new_hash, bucket->data ); - bucket= bucket->next; + hash_add(new_hash, bucket->data); + bucket = bucket->next; } } - hash_delete(hash, NULL); /* remove hash and eventual overflow buckets but not the content itself. */ - return( new_hash); + /* remove hash and eventual overflow buckets but not the content itself. */ + hash_delete(hash, NULL); + return new_hash; } -/* print the hash table for debugging */ -void hash_debug(struct hashtable_t *hash) { +/* print the hash table for debugging +void hash_debug(struct hashtable_t *hash) +{ int i; struct element_t *bucket; for (i=0; i<hash->size;i++) { - printk("[%d] ",i); + printf("[%d] ",i); bucket= hash->table[i]; while (bucket != NULL) { - printk("-> [%10p] ", bucket); + printf("-> [%10p] ", bucket); bucket= bucket->next; } - printk("\n"); + printf("\n"); } - printk("\n"); + printf("\n"); } + */ diff --git a/batman/linux/modules/hash.h b/batman/linux/modules/hash.h index a87cdcb..a778f04 100644 --- a/batman/linux/modules/hash.h +++ b/batman/linux/modules/hash.h @@ -1,6 +1,6 @@ -/* Copyright (C) 2006 B.A.T.M.A.N. contributors: +/* + * Copyright (C) 2006-2008 B.A.T.M.A.N. contributors: * Simon Wunderlich, Marek Lindner - * * This program is free software; you can redistribute it and/or * modify it under the terms of version 2 of the GNU General Public * License as published by the Free Software Foundation. @@ -16,6 +16,11 @@ * 02110-1301, USA * */ + + + + + #ifndef _BATMAN_HASH_H #define _BATMAN_HASH_H -- 1.6.0.1

2 2

[B.A.T.M.A.N.] [PATCH] Send TUNNEL_IP_REQUEST as response of TUNNEL_IP_REQUEST
by Sven Eckelmann 26 Sep '08

26 Sep '08

Userspace gateway sends TUNNEL_IP_REQUEST when he receives TUNNEL_IP_REQUEST and will not start to send new IP as TUNNEL_DATA --- batman/linux/modules/gateway.c | 1 - batman/linux/modules/gateway24.c | 1 - 2 files changed, 0 insertions(+), 2 deletions(-) diff --git a/batman/linux/modules/gateway.c b/batman/linux/modules/gateway.c index 154497e..9411575 100644 --- a/batman/linux/modules/gateway.c +++ b/batman/linux/modules/gateway.c @@ -405,7 +405,6 @@ static int packet_recv_thread(void *data) if(client_data != NULL) { - buffer[0] = TUNNEL_DATA; memcpy( &buffer[1], &client_data->vip_addr, sizeof( client_data->vip_addr ) ); iov.iov_base = buffer; diff --git a/batman/linux/modules/gateway24.c b/batman/linux/modules/gateway24.c index 585fe85..9b60fe4 100644 --- a/batman/linux/modules/gateway24.c +++ b/batman/linux/modules/gateway24.c @@ -385,7 +385,6 @@ static int packet_recv_thread(void *data) if(client_data != NULL) { - buffer[0] = TUNNEL_DATA; memcpy( &buffer[1], &client_data->vip_addr, sizeof( client_data->vip_addr ) ); iov.iov_base = buffer; -- 1.6.0.1

3 8

[B.A.T.M.A.N.] [PATCH] Don't use iterator of wip_hash to delete bucket in vip_hash
by Sven Eckelmann 25 Sep '08

25 Sep '08

The hash iterator of a hash has different pointers inside of it. When somebody tries to delete a bucket in another hash with hash_remove_bucket most data will be changed in the hash the iterator belongs and not the target hash. --- batman/linux/modules/gateway.c | 2 +- batman/linux/modules/gateway24.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/batman/linux/modules/gateway.c b/batman/linux/modules/gateway.c index 1f2dc24..fcf4dd2 100644 --- a/batman/linux/modules/gateway.c +++ b/batman/linux/modules/gateway.c @@ -383,7 +383,7 @@ static int packet_recv_thread(void *data) if( ( jiffies - client_data->last_keep_alive ) / HZ > LEASE_TIME ) { hash_remove_bucket(wip_hash, hashit); - hash_remove_bucket(vip_hash, hashit); + hash_remove(vip_hash, client_data); tmp_entry = kmalloc(sizeof(struct free_client_data), GFP_KERNEL); if(tmp_entry != NULL) { diff --git a/batman/linux/modules/gateway24.c b/batman/linux/modules/gateway24.c index a8d58e6..e26154b 100644 --- a/batman/linux/modules/gateway24.c +++ b/batman/linux/modules/gateway24.c @@ -364,7 +364,7 @@ static int packet_recv_thread(void *data) if( ( jiffies - client_data->last_keep_alive ) / HZ > LEASE_TIME ) { hash_remove_bucket(wip_hash, hashit); - hash_remove_bucket(vip_hash, hashit); + hash_remove(vip_hash, client_data); tmp_entry = kmalloc(sizeof(struct free_client_data), GFP_KERNEL); if(tmp_entry != NULL) { -- 1.6.0.1

1 0

[B.A.T.M.A.N.] [PATCH] Allow unoptimized builds of batgat
by Sven Eckelmann 25 Sep '08

25 Sep '08

Currently htons is a functions provided by userspace libraries and will only be replaced by a special builtin functions of gcc when optimization is enabled. Linux v2.6.27-rc2-497-gbc2aa80 will provide these function symbols as macros for in-kernel usage. --- batman/linux/modules/gateway.c | 4 ++-- batman/linux/modules/gateway24.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/batman/linux/modules/gateway.c b/batman/linux/modules/gateway.c index 9411575..41d75b5 100644 --- a/batman/linux/modules/gateway.c +++ b/batman/linux/modules/gateway.c @@ -313,7 +313,7 @@ static int packet_recv_thread(void *data) server_addr.sin_family = AF_INET; server_addr.sin_addr.s_addr = INADDR_ANY; - server_addr.sin_port = htons( (unsigned short) BATMAN_PORT ); + server_addr.sin_port = __constant_htons( (unsigned short) BATMAN_PORT ); if ( ( sock_create_kern( PF_INET, SOCK_RAW, IPPROTO_RAW, &inet_sock ) ) < 0 ) { @@ -551,7 +551,7 @@ static int bat_netdev_xmit( struct sk_buff *skb, struct net_device *dev ) sa.sin_family = AF_INET; sa.sin_addr.s_addr = client_data->wip_addr; - sa.sin_port = htons( (unsigned short)BATMAN_PORT ); + sa.sin_port = __constant_htons( (unsigned short)BATMAN_PORT ); msg.msg_flags = MSG_NOSIGNAL | MSG_DONTWAIT; msg.msg_name = &sa; diff --git a/batman/linux/modules/gateway24.c b/batman/linux/modules/gateway24.c index 9b60fe4..dbd1f42 100644 --- a/batman/linux/modules/gateway24.c +++ b/batman/linux/modules/gateway24.c @@ -291,7 +291,7 @@ static int packet_recv_thread(void *data) server_addr.sin_family = AF_INET; server_addr.sin_addr.s_addr = INADDR_ANY; - server_addr.sin_port = htons( (unsigned short) BATMAN_PORT ); + server_addr.sin_port = __constant_htons( (unsigned short) BATMAN_PORT ); if ( ( sock_create( PF_INET, SOCK_RAW, IPPROTO_RAW, &inet_sock ) ) < 0 ) { @@ -509,7 +509,7 @@ static int bat_netdev_xmit( struct sk_buff *skb, struct net_device *dev ) sa.sin_family = AF_INET; sa.sin_addr.s_addr = client_data->wip_addr; - sa.sin_port = htons( (unsigned short)BATMAN_PORT ); + sa.sin_port = __constant_htons( (unsigned short)BATMAN_PORT ); msg.msg_flags = MSG_NOSIGNAL | MSG_DONTWAIT; msg.msg_name = &sa; -- 1.6.0.1

1 0

[B.A.T.M.A.N.] [PATCHv2] Move more linux 2.6 compat stuff to compat26.h
by Sven Eckelmann 25 Sep '08

25 Sep '08

--- batman/linux/modules/compat26.h | 12 ++++++++++++ batman/linux/modules/gateway.c | 8 -------- batman/linux/modules/mod_batman.c | 22 ++-------------------- 3 files changed, 14 insertions(+), 28 deletions(-) diff --git a/batman/linux/modules/compat26.h b/batman/linux/modules/compat26.h index a95b229..f1fdc67 100644 --- a/batman/linux/modules/compat26.h +++ b/batman/linux/modules/compat26.h @@ -31,6 +31,7 @@ static inline struct iphdr *ip_hdr(const struct sk_buff *skb) { return (struct iphdr *)skb_network_header(skb); } + #endif /* KERNEL_VERSION(2, 6, 22) */ #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19) @@ -39,4 +40,15 @@ static inline int kernel_bind(struct socket *sock, struct sockaddr *addr, int ad { return sock->ops->bind(sock, addr, addrlen); } + #endif /* KERNEL_VERSION(2, 6, 19) */ + +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,26) + +#define device_create_drvdata \ + class_device_create + +#define device_destroy \ + class_device_destroy + +#endif /* KERNEL_VERSION(2,6,26) */ diff --git a/batman/linux/modules/gateway.c b/batman/linux/modules/gateway.c index 965f87b..154497e 100644 --- a/batman/linux/modules/gateway.c +++ b/batman/linux/modules/gateway.c @@ -91,11 +91,7 @@ int init_module() if ( IS_ERR( batman_class ) ) DBG( "could not register class 'batgat'" ); else -#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,25) device_create_drvdata(batman_class, NULL, MKDEV(Major, 0), NULL, "batgat"); -#else - class_device_create(batman_class, NULL, MKDEV(Major, 0), NULL, "batgat"); -#endif DBG( "batgat loaded %s", strlen(REVISION_VERSION) > 3 ? REVISION_VERSION : "" ); @@ -120,11 +116,7 @@ void cleanup_module() struct free_client_data *entry, *next; struct gw_client *gw_client; -#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,25) device_destroy( batman_class, MKDEV( Major, 0 ) ); -#else - class_device_destroy( batman_class, MKDEV( Major, 0 ) ); -#endif class_destroy( batman_class ); /* Unregister the device */ diff --git a/batman/linux/modules/mod_batman.c b/batman/linux/modules/mod_batman.c index d34b05e..1b9ecda 100644 --- a/batman/linux/modules/mod_batman.c +++ b/batman/linux/modules/mod_batman.c @@ -50,6 +50,8 @@ #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0) #include <linux/devfs_fs_kernel.h> #else +#include "compat26.h" + static struct class *batman_class; #endif @@ -117,11 +119,7 @@ int init_module( void ) { if ( IS_ERR(batman_class) ) printk( "B.A.T.M.A.N.: Could not register class 'batman' \n" ); else -#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,25) device_create_drvdata( batman_class, NULL, MKDEV( Major, 0 ), NULL, "batman" ); -#else - class_device_create( batman_class, NULL, MKDEV( Major, 0 ), NULL, "batman" ); -#endif #endif for ( i = 0; i < 255; i++ ) { @@ -143,11 +141,7 @@ void cleanup_module( void ) { #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0) devfs_remove( "batman", 0 ); #else -#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,25) device_destroy_drvdata( batman_class, MKDEV( Major, 0 ) ); -#else - class_device_destroy( batman_class, MKDEV( Major, 0 ) ); -#endif class_destroy( batman_class ); #endif @@ -247,11 +241,7 @@ static int device_release( struct inode *inode, struct file *file ) { #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0) devfs_remove( "batman", minor_num ); #else -#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,25) device_destroy(minor->minor_class, MKDEV(Major, minor_num)); -#else - class_device_destroy( minor->minor_class, MKDEV( Major, minor_num ) ); -#endif class_destroy( minor->minor_class ); #endif sock_release( minor->raw_sock ); @@ -367,11 +357,7 @@ static int device_ioctl( struct inode *inode, struct file *file, unsigned int cm if ( IS_ERR(minor->minor_class) ) printk( "B.A.T.M.A.N.: Could not register class '%s' \n", filename ); else -#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,25) device_create_drvdata( minor->minor_class, NULL, MKDEV( Major, minor_num ), NULL, "batman%d", minor_num ); -#else - class_device_create( minor->minor_class, NULL, MKDEV( Major, minor_num ), NULL, "batman%d", minor_num ); -#endif #endif /* let udev create the device file */ set_current_state(TASK_INTERRUPTIBLE); @@ -395,11 +381,7 @@ static int device_ioctl( struct inode *inode, struct file *file, unsigned int cm #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0) devfs_remove( "batman", minor_num ); #else -#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,25) device_destroy( minor->minor_class, MKDEV(Major, minor_num )); -#else - class_device_destroy( minor->minor_class, MKDEV(Major, minor_num )); -#endif class_destroy( minor->minor_class ); #endif kfree( minor ); -- 1.6.0.1

1 0

[B.A.T.M.A.N.] [PATCH] Move more linux 2.6 compat stuff to compat26.h
by Sven Eckelmann 25 Sep '08

25 Sep '08

--- batman/linux/modules/gateway.c | 8 -------- batman/linux/modules/mod_batman.c | 22 ++-------------------- 2 files changed, 2 insertions(+), 28 deletions(-) diff --git a/batman/linux/modules/gateway.c b/batman/linux/modules/gateway.c index 965f87b..154497e 100644 --- a/batman/linux/modules/gateway.c +++ b/batman/linux/modules/gateway.c @@ -91,11 +91,7 @@ int init_module() if ( IS_ERR( batman_class ) ) DBG( "could not register class 'batgat'" ); else -#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,25) device_create_drvdata(batman_class, NULL, MKDEV(Major, 0), NULL, "batgat"); -#else - class_device_create(batman_class, NULL, MKDEV(Major, 0), NULL, "batgat"); -#endif DBG( "batgat loaded %s", strlen(REVISION_VERSION) > 3 ? REVISION_VERSION : "" ); @@ -120,11 +116,7 @@ void cleanup_module() struct free_client_data *entry, *next; struct gw_client *gw_client; -#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,25) device_destroy( batman_class, MKDEV( Major, 0 ) ); -#else - class_device_destroy( batman_class, MKDEV( Major, 0 ) ); -#endif class_destroy( batman_class ); /* Unregister the device */ diff --git a/batman/linux/modules/mod_batman.c b/batman/linux/modules/mod_batman.c index d34b05e..1b9ecda 100644 --- a/batman/linux/modules/mod_batman.c +++ b/batman/linux/modules/mod_batman.c @@ -50,6 +50,8 @@ #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0) #include <linux/devfs_fs_kernel.h> #else +#include "compat26.h" + static struct class *batman_class; #endif @@ -117,11 +119,7 @@ int init_module( void ) { if ( IS_ERR(batman_class) ) printk( "B.A.T.M.A.N.: Could not register class 'batman' \n" ); else -#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,25) device_create_drvdata( batman_class, NULL, MKDEV( Major, 0 ), NULL, "batman" ); -#else - class_device_create( batman_class, NULL, MKDEV( Major, 0 ), NULL, "batman" ); -#endif #endif for ( i = 0; i < 255; i++ ) { @@ -143,11 +141,7 @@ void cleanup_module( void ) { #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0) devfs_remove( "batman", 0 ); #else -#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,25) device_destroy_drvdata( batman_class, MKDEV( Major, 0 ) ); -#else - class_device_destroy( batman_class, MKDEV( Major, 0 ) ); -#endif class_destroy( batman_class ); #endif @@ -247,11 +241,7 @@ static int device_release( struct inode *inode, struct file *file ) { #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0) devfs_remove( "batman", minor_num ); #else -#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,25) device_destroy(minor->minor_class, MKDEV(Major, minor_num)); -#else - class_device_destroy( minor->minor_class, MKDEV( Major, minor_num ) ); -#endif class_destroy( minor->minor_class ); #endif sock_release( minor->raw_sock ); @@ -367,11 +357,7 @@ static int device_ioctl( struct inode *inode, struct file *file, unsigned int cm if ( IS_ERR(minor->minor_class) ) printk( "B.A.T.M.A.N.: Could not register class '%s' \n", filename ); else -#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,25) device_create_drvdata( minor->minor_class, NULL, MKDEV( Major, minor_num ), NULL, "batman%d", minor_num ); -#else - class_device_create( minor->minor_class, NULL, MKDEV( Major, minor_num ), NULL, "batman%d", minor_num ); -#endif #endif /* let udev create the device file */ set_current_state(TASK_INTERRUPTIBLE); @@ -395,11 +381,7 @@ static int device_ioctl( struct inode *inode, struct file *file, unsigned int cm #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0) devfs_remove( "batman", minor_num ); #else -#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,25) device_destroy( minor->minor_class, MKDEV(Major, minor_num )); -#else - class_device_destroy( minor->minor_class, MKDEV(Major, minor_num )); -#endif class_destroy( minor->minor_class ); #endif kfree( minor ); -- 1.6.0.1

1 1

[B.A.T.M.A.N.] [PATCH] Backport gateway module to 2.6.18
by Sven Eckelmann 24 Sep '08

24 Sep '08

kernel_bind and other kernel socket api functions were defined by linux v2.6.18-310-gac5a488 and ip_hdr first appeared in linux v2.6.21-122-geddc9ec. To provide these functions a new compatibility header file with the name compat26.h was added to provide an easy way to support older kernels. Other "#if LINUX_VERSION_CODE" should be copied into this file. --- batman/linux/modules/compat26.h | 42 +++++++++++++++++++++++++++++++++++++++ batman/linux/modules/gateway.c | 1 + 2 files changed, 43 insertions(+), 0 deletions(-) create mode 100644 batman/linux/modules/compat26.h diff --git a/batman/linux/modules/compat26.h b/batman/linux/modules/compat26.h new file mode 100644 index 0000000..a95b229 --- /dev/null +++ b/batman/linux/modules/compat26.h @@ -0,0 +1,42 @@ +/* + * Copyright (C) 2008 BATMAN contributors: + * Thomas Lopatic, Corinna 'Elektra' Aichele, Axel Neumann, Marek Lindner, Andreas Langer + * This program is free software; you can redistribute it and/or + * modify it under the terms of version 2 of the GNU General Public + * License as published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA + * + * + * This file contains macros for maintaining compatibility with older versions + * of the Linux kernel. + */ + +#include <linux/version.h> /* LINUX_VERSION_CODE */ + +#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 22) + +#define skb_network_header(_skb) \ + ((_skb)->nh.raw) + +static inline struct iphdr *ip_hdr(const struct sk_buff *skb) +{ + return (struct iphdr *)skb_network_header(skb); +} +#endif /* KERNEL_VERSION(2, 6, 22) */ + +#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19) + +static inline int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen) +{ + return sock->ops->bind(sock, addr, addrlen); +} +#endif /* KERNEL_VERSION(2, 6, 19) */ diff --git a/batman/linux/modules/gateway.c b/batman/linux/modules/gateway.c index 7272c50..965f87b 100644 --- a/batman/linux/modules/gateway.c +++ b/batman/linux/modules/gateway.c @@ -19,6 +19,7 @@ #include "gateway.h" #include "hash.h" +#include "compat26.h" static struct class *batman_class; -- 1.6.0.1

1 0

[B.A.T.M.A.N.] Batmand dies
by Gustavo Lindberg 14 Sep '08

14 Sep '08

I just tried the last openwrt-kamikaze trunk with the svn v1109 of batman on ubnt NS2. Batmand die as follows: root@OpenWrt:~# batmand -d 4 -g 5000 ath2 WARNING: You are using the unstable batman branch. If you are interested in *using* batman get the latest stable release ! Interface activated: ath2 Using interface ath2 with address 5.0.0.1 and broadcast address 5.255.255.255 B.A.T.M.A.N. 0.3-beta (compatibility version 5) [ 80] Error - can't set IFFLAGS for gate0: Cannot assign requested address [ 80] Error - can't set IFFLAGS for gate0: Cannot assign requested address dmesg output: Atheros HAL provided by OpenWrt, DD-WRT and MakSat Technologies wifi0: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps wifi0: 11g rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps wifi0: H/W encryption support: WEP AES AES_CCM TKIP ath_ahb: wifi0: Atheros 2315 WiSoC: mem=0xb0000000, irq=3 gpio-buttons driver version 0.1.1 batgat: [batgat_ioctl:224] name gate0 index 7 batgat: [batgat_ioctl:244] disconnect daemon batgat: [packet_recv_thread:508] thread stop batgat: [batgat_ioctl:256] thread shutdown batgat: [batgat_ioctl:263] gate shutdown batgat: [batgat_ioctl:277] device unregistered successfully batgat: [batgat_ioctl:224] name gate0 index 8 batgat: [batgat_ioctl:244] disconnect daemon batgat: [packet_recv_thread:508] thread stop batgat: [batgat_ioctl:256] thread shutdown batgat: [batgat_ioctl:263] gate shutdown batgat: [batgat_ioctl:277] device unregistered successfully batgat: [batgat_ioctl:224] name gate0 index 9 batgat: [batgat_ioctl:244] disconnect daemon batgat: [packet_recv_thread:508] thread stop batgat: [batgat_ioctl:256] thread shutdown batgat: [batgat_ioctl:263] gate shutdown batgat: [batgat_ioctl:277] device unregistered successfully batgat: [batgat_ioctl:224] name gate0 index 10 batgat: [batgat_ioctl:244] disconnect daemon batgat: [packet_recv_thread:508] thread stop batgat: [batgat_ioctl:256] thread shutdown batgat: [batgat_ioctl:263] gate shutdown batgat: [batgat_ioctl:277] device unregistered successfully root@OpenWrt:~# No iptables rules at all. All policy ACCEPT. BATGAT dont crash anymore, Greetings. Gustavo.

3 2

[B.A.T.M.A.N.] [PATCH] Make batman debug allocation function thread safe
by Sven Eckelmann 12 Sep '08

12 Sep '08

Different list structures are manually managed inside the debug malloc functions of batman. When different threads try to allocate and free memory it is possible that lists get corrupted and we get a segfault. Also the memory usage pointer can hold a wrong value and removeMemory could stop batman without any real reason. Signed-off-by: Sven Eckelmann <sven.eckelmann(a)gmx.de> --- batman/allocate.c | 27 +++++++++++++++++++++++++-- 1 files changed, 25 insertions(+), 2 deletions(-) diff --git a/batman/allocate.c b/batman/allocate.c index d51bec0..c845431 100644 --- a/batman/allocate.c +++ b/batman/allocate.c @@ -31,6 +31,8 @@ #if defined DEBUG_MALLOC +static pthread_mutex_t chunk_mutex = PTHREAD_MUTEX_INITIALIZER; + struct chunkHeader *chunkList = NULL; struct chunkHeader @@ -51,6 +53,7 @@ struct chunkTrailer #if defined MEMORY_USAGE struct memoryUsage *memoryList = NULL; +static pthread_mutex_t memory_mutex = PTHREAD_MUTEX_INITIALIZER; struct memoryUsage @@ -66,7 +69,7 @@ void addMemory( uint32_t length, int32_t tag ) { struct memoryUsage *walker; - + pthread_mutex_lock(&memory_mutex); for ( walker = memoryList; walker != NULL; walker = walker->next ) { if ( walker->tag == tag ) { @@ -90,6 +93,7 @@ void addMemory( uint32_t length, int32_t tag ) { memoryList = walker; } + pthread_mutex_unlock(&memory_mutex); } @@ -98,7 +102,7 @@ void removeMemory( int32_t tag, int32_t freetag ) { struct memoryUsage *walker; - + pthread_mutex_lock(&memory_mutex); for ( walker = memoryList; walker != NULL; walker = walker->next ) { if ( walker->tag == tag ) { @@ -106,6 +110,7 @@ void removeMemory( int32_t tag, int32_t freetag ) { if ( walker->counter == 0 ) { debug_output( 0, "Freeing more memory than was allocated: malloc tag = %d, free tag = %d\n", tag, freetag ); + pthread_mutex_unlock(&memory_mutex); restore_and_exit(0); } @@ -120,9 +125,11 @@ void removeMemory( int32_t tag, int32_t freetag ) { if ( walker == NULL ) { debug_output( 0, "Freeing memory that was never allocated: malloc tag = %d, free tag = %d\n", tag, freetag ); + pthread_mutex_unlock(&memory_mutex); restore_and_exit(0); } + pthread_mutex_unlock(&memory_mutex); } @@ -143,21 +150,25 @@ void checkIntegrity(void) debug_output( 5, " \nMemory usage information:\n" ); + pthread_mutex_lock(&memory_mutex); for ( memoryWalker = memoryList; memoryWalker != NULL; memoryWalker = memoryWalker->next ) { if ( memoryWalker->counter != 0 ) debug_output( 5, " tag: %''4i, num malloc: %4i, bytes per malloc: %''4i, total: %6i\n", memoryWalker->tag, memoryWalker->counter, memoryWalker->length, memoryWalker->counter * memoryWalker->length ); } + pthread_mutex_unlock(&memory_mutex); #endif + pthread_mutex_lock(&chunk_mutex); for (walker = chunkList; walker != NULL; walker = walker->next) { if (walker->magicNumber != MAGIC_NUMBER) { debug_output( 0, "checkIntegrity - invalid magic number in header: %08x, malloc tag = %d\n", walker->magicNumber, walker->tag ); + pthread_mutex_unlock(&chunk_mutex); restore_and_exit(0); } @@ -168,17 +179,23 @@ void checkIntegrity(void) if (chunkTrailer->magicNumber != MAGIC_NUMBER) { debug_output( 0, "checkIntegrity - invalid magic number in trailer: %08x, malloc tag = %d\n", chunkTrailer->magicNumber, walker->tag ); + pthread_mutex_unlock(&chunk_mutex); restore_and_exit(0); } } + + pthread_mutex_unlock(&chunk_mutex); } void checkLeak(void) { struct chunkHeader *walker; + pthread_mutex_lock(&chunk_mutex); for (walker = chunkList; walker != NULL; walker = walker->next) debug_output( 0, "Memory leak detected, malloc tag = %d\n", walker->tag ); + + pthread_mutex_unlock(&chunk_mutex); } void *debugMalloc(uint32_t length, int32_t tag) @@ -208,8 +225,10 @@ void *debugMalloc(uint32_t length, int32_t tag) chunkTrailer->magicNumber = MAGIC_NUMBER; + pthread_mutex_lock(&chunk_mutex); chunkHeader->next = chunkList; chunkList = chunkHeader; + pthread_mutex_unlock(&chunk_mutex); #if defined MEMORY_USAGE @@ -282,6 +301,7 @@ void debugFree(void *memoryParameter, int tag) previous = NULL; + pthread_mutex_lock(&chunk_mutex); for (walker = chunkList; walker != NULL; walker = walker->next) { if (walker == chunkHeader) @@ -293,6 +313,7 @@ void debugFree(void *memoryParameter, int tag) if (walker == NULL) { debug_output( 0, "Double free detected, malloc tag = %d, free tag = %d\n", chunkHeader->tag, tag ); + pthread_mutex_unlock(&chunk_mutex); restore_and_exit(0); } @@ -302,6 +323,8 @@ void debugFree(void *memoryParameter, int tag) else previous->next = walker->next; + pthread_mutex_unlock(&chunk_mutex); + chunkTrailer = (struct chunkTrailer *)(memory + chunkHeader->length); if (chunkTrailer->magicNumber != MAGIC_NUMBER) -- 1.6.0.1

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

B.A.T.M.A.N