B.A.T.M.A.N

b.a.t.m.a.n@lists.open-mesh.org

15 participants
4308 discussions

INFO: rcu detected stall in netlink_sendmsg (4)
by syzbot 24 Jul '20

24 Jul '20

Hello, syzbot found the following crash on: HEAD commit: ae661dec Merge branch 'ifla_xdp_expected_fd' git tree: bpf-next console output: https://syzkaller.appspot.com/x/log.txt?x=12245647e00000 kernel config: https://syzkaller.appspot.com/x/.config?x=b5acf5ac38a50651 dashboard link: https://syzkaller.appspot.com/bug?extid=0fb70e87d8e0ac278fe9 compiler: gcc (GCC) 9.0.0 20181231 (experimental) Unfortunately, I don't have any reproducer for this crash yet. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+0fb70e87d8e0ac278fe9(a)syzkaller.appspotmail.com rcu: INFO: rcu_preempt self-detected stall on CPU rcu: 0-....: (1 GPs behind) idle=5c2/1/0x4000000000000002 softirq=376075/376076 fqs=5176 (t=10500 jiffies g=506061 q=176208) NMI backtrace for cpu 0 CPU: 0 PID: 17281 Comm: syz-executor.5 Not tainted 5.6.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 nmi_cpu_backtrace.cold+0x70/0xb1 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x231/0x27e lib/nmi_backtrace.c:62 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline] rcu_dump_cpu_stacks+0x169/0x1b3 kernel/rcu/tree_stall.h:254 print_cpu_stall kernel/rcu/tree_stall.h:475 [inline] check_cpu_stall kernel/rcu/tree_stall.h:549 [inline] rcu_pending kernel/rcu/tree.c:3030 [inline] rcu_sched_clock_irq.cold+0x518/0xc55 kernel/rcu/tree.c:2276 update_process_times+0x25/0x60 kernel/time/timer.c:1726 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:171 tick_sched_timer+0x4e/0x140 kernel/time/tick-sched.c:1314 __run_hrtimer kernel/time/hrtimer.c:1517 [inline] __hrtimer_run_queues+0x32c/0xdd0 kernel/time/hrtimer.c:1579 hrtimer_interrupt+0x312/0x770 kernel/time/hrtimer.c:1641 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1119 [inline] smp_apic_timer_interrupt+0x15b/0x600 arch/x86/kernel/apic/apic.c:1144 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829 </IRQ> RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:759 [inline] RIP: 0010:lock_release+0x45f/0x7c0 kernel/locking/lockdep.c:4505 Code: 94 08 00 00 00 00 00 00 48 c1 e8 03 80 3c 10 00 0f 85 d0 02 00 00 48 83 3d 6d 1d 1b 08 00 0f 84 71 01 00 00 48 8b 3c 24 57 9d <0f> 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 48 01 c3 48 c7 03 00 RSP: 0018:ffffc90003d9ec30 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 RAX: 1ffffffff12e7698 RBX: 1ffff920007b3d89 RCX: 1ffff110098769b9 RDX: dffffc0000000000 RSI: 1ffff110098769c5 RDI: 0000000000000282 RBP: ffff88804c3b4540 R08: 0000000000000004 R09: fffffbfff14cc269 R10: fffffbfff14cc268 R11: ffffffff8a661347 R12: bc95c6993a9665e0 R13: ffffffff87a36fb1 R14: ffff88804c3b4dd0 R15: 0000000000000003 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:174 [inline] _raw_spin_unlock_bh+0x12/0x30 kernel/locking/spinlock.c:207 spin_unlock_bh include/linux/spinlock.h:383 [inline] batadv_tt_local_purge_pending_clients+0x2a1/0x3b0 net/batman-adv/translation-table.c:3914 batadv_tt_local_resize_to_mtu+0x96/0x130 net/batman-adv/translation-table.c:4198 batadv_update_min_mtu net/batman-adv/hard-interface.c:626 [inline] batadv_hardif_activate_interface.part.0.cold+0xc6/0x294 net/batman-adv/hard-interface.c:653 batadv_hardif_activate_interface net/batman-adv/hard-interface.c:800 [inline] batadv_hardif_enable_interface+0x9f2/0xaa0 net/batman-adv/hard-interface.c:792 batadv_softif_slave_add+0x92/0x150 net/batman-adv/soft-interface.c:859 do_set_master net/core/rtnetlink.c:2470 [inline] do_set_master+0x1d7/0x230 net/core/rtnetlink.c:2443 do_setlink+0xaa2/0x3680 net/core/rtnetlink.c:2605 __rtnl_newlink+0xad5/0x1590 net/core/rtnetlink.c:3266 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3391 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5454 netlink_rcv_skb+0x15a/0x410 net/netlink/af_netlink.c:2478 netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline] netlink_unicast+0x537/0x740 net/netlink/af_netlink.c:1329 netlink_sendmsg+0x882/0xe10 net/netlink/af_netlink.c:1918 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:672 ____sys_sendmsg+0x6b9/0x7d0 net/socket.c:2343 ___sys_sendmsg+0x100/0x170 net/socket.c:2397 __sys_sendmsg+0xec/0x1b0 net/socket.c:2430 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45c849 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f043b72fc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f043b7306d4 RCX: 000000000045c849 RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003 RBP: 000000000076bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 00000000000009f5 R14: 00000000004ccac9 R15: 000000000076bf0c --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

1 2

[PATCH maint] batman-adv: Avoid uninitialized chaddr when handling DHCP
by Sven Eckelmann 22 Jul '20

22 Jul '20

The gateway client code can try to optimize the delivery of DHCP packets to avoid broadcasting them through the whole mesh. But also transmissions to the client can be optimized by looking up the destination via the chaddr of the DHCP packet. But the chaddr is currently only done when chaddr is fully inside the non-paged area of the skbuff. Otherwise it will not be initialized and the unoptimized path should have been taken. But the implementation didn't handle this correctly. It didn't retrieve the correct chaddr but still tried to perform the TT lookup with this uninitialized memory. Reported-by: syzbot+ab16e463b903f5a37036(a)syzkaller.appspotmail.com Fixes: 2d5b555644b2 ("batman-adv: send every DHCP packet as bat-unicast") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- net/batman-adv/gateway_client.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c index a18dcc68..ef3f85b5 100644 --- a/net/batman-adv/gateway_client.c +++ b/net/batman-adv/gateway_client.c @@ -703,8 +703,10 @@ batadv_gw_dhcp_recipient_get(struct sk_buff *skb, unsigned int *header_len, chaddr_offset = *header_len + BATADV_DHCP_CHADDR_OFFSET; /* store the client address if the message is going to a client */ - if (ret == BATADV_DHCP_TO_CLIENT && - pskb_may_pull(skb, chaddr_offset + ETH_ALEN)) { + if (ret == BATADV_DHCP_TO_CLIENT) { + if (!pskb_may_pull(skb, chaddr_offset + ETH_ALEN)) + return BATADV_DHCP_NO; + /* check if the DHCP packet carries an Ethernet DHCP */ p = skb->data + *header_len + BATADV_DHCP_HTYPE_OFFSET; if (*p != BATADV_DHCP_HTYPE_ETHERNET) -- 2.20.1

2 1

INFO: rcu detected stall in seq_read (2)
by syzbot 22 Jul '20

22 Jul '20

Hello, syzbot found the following issue on: HEAD commit: 4fa640dc Merge tag 'vfio-v5.8-rc7' of git://github.com/awi.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=145cac30900000 kernel config: https://syzkaller.appspot.com/x/.config?x=f87a5e4232fdb267 dashboard link: https://syzkaller.appspot.com/bug?extid=c28b5fee66fd3b7f766e compiler: gcc (GCC) 10.1.0-syz 20200507 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17e23ac8900000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1198c440900000 The issue was bisected to: commit 53e233ea2fa9fa7e2405e95070981f327d90e519 Author: Vasundhara Volam <vasundhara-v.volam(a)broadcom.com> Date: Thu Oct 4 05:43:52 2018 +0000 devlink: Add Documentation/networking/devlink-params-bnxt.txt bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15e22b94900000 final oops: https://syzkaller.appspot.com/x/report.txt?x=17e22b94900000 console output: https://syzkaller.appspot.com/x/log.txt?x=13e22b94900000 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+c28b5fee66fd3b7f766e(a)syzkaller.appspotmail.com Fixes: 53e233ea2fa9 ("devlink: Add Documentation/networking/devlink-params-bnxt.txt") hrtimer: interrupt took 6305559 ns rcu: INFO: rcu_preempt self-detected stall on CPU rcu: 1-...!: (1 GPs behind) idle=91e/1/0x4000000000000000 softirq=10105/10107 fqs=1 (t=18319 jiffies g=8905 q=457) NMI backtrace for cpu 1 CPU: 1 PID: 4008 Comm: systemd-journal Not tainted 5.8.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x18f/0x20d lib/dump_stack.c:118 nmi_cpu_backtrace.cold+0x70/0xb1 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x1b3/0x223 lib/nmi_backtrace.c:62 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline] rcu_dump_cpu_stacks+0x194/0x1cf kernel/rcu/tree_stall.h:320 print_cpu_stall kernel/rcu/tree_stall.h:553 [inline] check_cpu_stall kernel/rcu/tree_stall.h:627 [inline] rcu_pending kernel/rcu/tree.c:3489 [inline] rcu_sched_clock_irq.cold+0x5b3/0xccc kernel/rcu/tree.c:2504 update_process_times+0x25/0x60 kernel/time/timer.c:1737 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:176 tick_sched_timer+0x108/0x290 kernel/time/tick-sched.c:1320 __run_hrtimer kernel/time/hrtimer.c:1520 [inline] __hrtimer_run_queues+0x1d5/0xfc0 kernel/time/hrtimer.c:1584 hrtimer_interrupt+0x32a/0x930 kernel/time/hrtimer.c:1646 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1080 [inline] __sysvec_apic_timer_interrupt+0x142/0x5e0 arch/x86/kernel/apic/apic.c:1097 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:711 </IRQ> __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline] sysvec_apic_timer_interrupt+0xe0/0x120 arch/x86/kernel/apic/apic.c:1091 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:585 RIP: 0010:format_decode+0x0/0xad0 lib/vsprintf.c:2329 Code: c7 c7 10 05 af 8a be 10 00 00 00 e8 5a c3 46 00 48 c7 c7 20 78 0d 8a e9 6e f2 e2 fd 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 <41> 57 41 56 41 55 41 54 55 48 89 f5 53 48 bb 00 00 00 00 00 fc ff RSP: 0018:ffffc90001077a10 EFLAGS: 00000293 RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffff83b0a497 RDX: ffff888093224040 RSI: ffffc90001077a80 RDI: ffffffff884e6293 RBP: ffffffff884e6293 R08: 0000000000000001 R09: ffff8880952a63d1 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880952a63d2 R13: ffffffff884e6293 R14: 0000000000000025 R15: ffffc90001077b30 vsnprintf+0x155/0x14f0 lib/vsprintf.c:2572 seq_vprintf fs/seq_file.c:379 [inline] seq_printf+0x195/0x240 fs/seq_file.c:394 proc_pid_status+0x1c6d/0x24b0 fs/proc/array.c:424 proc_single_show+0x116/0x1e0 fs/proc/base.c:766 seq_read+0x432/0x1070 fs/seq_file.c:208 vfs_read+0x1df/0x520 fs/read_write.c:479 ksys_read+0x12d/0x250 fs/read_write.c:607 do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:384 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f0fc43d9910 Code: Bad RIP value. RSP: 002b:00007ffdcb193978 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 000055b1476b96f0 RCX: 00007f0fc43d9910 RDX: 0000000000000800 RSI: 000055b1476b8b00 RDI: 0000000000000013 RBP: 00007f0fc4694440 R08: 00007f0fc4697fc8 R09: 0000000000000410 R10: 000055b1476b96f0 R11: 0000000000000246 R12: 0000000000000800 R13: 0000000000000d68 R14: 000055b1476b8b00 R15: 00007f0fc4693900 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. For information about bisection process see: https://goo.gl/tpsmEJ#bisection syzbot can test patches for this issue, for details see: https://goo.gl/tpsmEJ#testing-patches

2 1

[PATCH] net: batman-adv: types.h: delete duplicated words
by Randy Dunlap 19 Jul '20

19 Jul '20

Delete the doubled word "time" in a comment. Delete the doubled word "address" in a comment. Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Cc: Marek Lindner <mareklindner(a)neomailbox.ch> Cc: Simon Wunderlich <sw(a)simonwunderlich.de> Cc: Antonio Quartulli <a(a)unstable.cc> Cc: Sven Eckelmann <sven(a)narfation.org> Cc: b.a.t.m.a.n(a)lists.open-mesh.org --- net/batman-adv/types.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- linux-next-20200717.orig/net/batman-adv/types.h +++ linux-next-20200717/net/batman-adv/types.h @@ -1492,7 +1492,7 @@ struct batadv_tp_vars { /** @unacked_lock: protect unacked_list */ spinlock_t unacked_lock; - /** @last_recv_time: time time (jiffies) a msg was received */ + /** @last_recv_time: time (jiffies) a msg was received */ unsigned long last_recv_time; /** @refcount: number of context where the object is used */ @@ -1996,7 +1996,7 @@ struct batadv_tt_change_node { */ struct batadv_tt_req_node { /** - * @addr: mac address address of the originator this request was sent to + * @addr: mac address of the originator this request was sent to */ u8 addr[ETH_ALEN];

1 0

KMSAN: uninit-value in batadv_tt_hash_find
by syzbot 14 Jul '20

14 Jul '20

Hello, syzbot found the following crash on: HEAD commit: f0d5ec90 kmsan: apply __no_sanitize_memory to dotraplinkag.. git tree: https://github.com/google/kmsan.git master console output: https://syzkaller.appspot.com/x/log.txt?x=10c0883b100000 kernel config: https://syzkaller.appspot.com/x/.config?x=86e4f8af239686c6 dashboard link: https://syzkaller.appspot.com/bug?extid=ab16e463b903f5a37036 compiler: clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81) userspace arch: i386 Unfortunately, I don't have any reproducer for this crash yet. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+ab16e463b903f5a37036(a)syzkaller.appspotmail.com ===================================================== BUG: KMSAN: uninit-value in __read_once_size include/linux/compiler.h:206 [inline] BUG: KMSAN: uninit-value in batadv_tt_hash_find+0x38a/0x810 net/batman-adv/translation-table.c:144 CPU: 0 PID: 23320 Comm: syz-executor.5 Not tainted 5.7.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 __read_once_size include/linux/compiler.h:206 [inline] batadv_tt_hash_find+0x38a/0x810 net/batman-adv/translation-table.c:144 batadv_tt_global_hash_find net/batman-adv/translation-table.c:203 [inline] batadv_transtable_search+0x292/0xa00 net/batman-adv/translation-table.c:2618 batadv_send_skb_via_tt_generic+0x181/0x290 net/batman-adv/send.c:423 batadv_send_skb_via_tt net/batman-adv/send.h:82 [inline] batadv_interface_tx+0x1b3d/0x2450 net/batman-adv/soft-interface.c:378 __netdev_start_xmit include/linux/netdevice.h:4533 [inline] netdev_start_xmit include/linux/netdevice.h:4547 [inline] xmit_one net/core/dev.c:3477 [inline] dev_hard_start_xmit+0x531/0xab0 net/core/dev.c:3493 __dev_queue_xmit+0x2f8d/0x3b20 net/core/dev.c:4052 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4085 neigh_hh_output include/net/neighbour.h:499 [inline] neigh_output include/net/neighbour.h:508 [inline] ip_finish_output2+0x20fd/0x2610 net/ipv4/ip_output.c:228 ip_do_fragment+0x2c98/0x3570 net/ipv4/ip_output.c:849 ip_fragment+0x242/0x400 net/ipv4/ip_output.c:585 __ip_finish_output+0xd34/0xd80 net/ipv4/ip_output.c:304 ip_finish_output+0x166/0x410 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_mc_output+0xfbf/0x1090 net/ipv4/ip_output.c:415 dst_output include/net/dst.h:435 [inline] ip_local_out net/ipv4/ip_output.c:125 [inline] ip_send_skb+0x179/0x360 net/ipv4/ip_output.c:1560 udp_send_skb+0x1046/0x18b0 net/ipv4/udp.c:891 udp_sendmsg+0x3bb5/0x4100 net/ipv4/udp.c:1178 inet_sendmsg+0x276/0x2e0 net/ipv4/af_inet.c:807 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg net/socket.c:672 [inline] ____sys_sendmsg+0x1056/0x1350 net/socket.c:2362 ___sys_sendmsg net/socket.c:2416 [inline] __sys_sendmmsg+0x863/0xd60 net/socket.c:2499 __compat_sys_sendmmsg net/compat.c:672 [inline] __do_compat_sys_sendmmsg net/compat.c:679 [inline] __se_compat_sys_sendmmsg+0xcd/0xf0 net/compat.c:676 __ia32_compat_sys_sendmmsg+0x56/0x70 net/compat.c:676 do_syscall_32_irqs_on arch/x86/entry/common.c:339 [inline] do_fast_syscall_32+0x3bf/0x6d0 arch/x86/entry/common.c:398 entry_SYSENTER_compat+0x68/0x77 arch/x86/entry/entry_64_compat.S:139 RIP: 0023:0xf7f3add9 Code: 90 e8 0b 00 00 00 f3 90 0f ae e8 eb f9 8d 74 26 00 89 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 002b:00000000f5d140cc EFLAGS: 00000296 ORIG_RAX: 0000000000000159 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020007f80 RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was stored to memory at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:144 [inline] kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:310 __msan_chain_origin+0x50/0x90 mm/kmsan/kmsan_instr.c:165 ether_addr_copy include/linux/etherdevice.h:279 [inline] batadv_tt_hash_find+0x333/0x810 net/batman-adv/translation-table.c:137 batadv_tt_global_hash_find net/batman-adv/translation-table.c:203 [inline] batadv_transtable_search+0x292/0xa00 net/batman-adv/translation-table.c:2618 batadv_send_skb_via_tt_generic+0x181/0x290 net/batman-adv/send.c:423 batadv_send_skb_via_tt net/batman-adv/send.h:82 [inline] batadv_interface_tx+0x1b3d/0x2450 net/batman-adv/soft-interface.c:378 __netdev_start_xmit include/linux/netdevice.h:4533 [inline] netdev_start_xmit include/linux/netdevice.h:4547 [inline] xmit_one net/core/dev.c:3477 [inline] dev_hard_start_xmit+0x531/0xab0 net/core/dev.c:3493 __dev_queue_xmit+0x2f8d/0x3b20 net/core/dev.c:4052 dev_queue_xmit+0x4b/0x60 net/core/dev.c:4085 neigh_hh_output include/net/neighbour.h:499 [inline] neigh_output include/net/neighbour.h:508 [inline] ip_finish_output2+0x20fd/0x2610 net/ipv4/ip_output.c:228 ip_do_fragment+0x2c98/0x3570 net/ipv4/ip_output.c:849 ip_fragment+0x242/0x400 net/ipv4/ip_output.c:585 __ip_finish_output+0xd34/0xd80 net/ipv4/ip_output.c:304 ip_finish_output+0x166/0x410 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip_mc_output+0xfbf/0x1090 net/ipv4/ip_output.c:415 dst_output include/net/dst.h:435 [inline] ip_local_out net/ipv4/ip_output.c:125 [inline] ip_send_skb+0x179/0x360 net/ipv4/ip_output.c:1560 udp_send_skb+0x1046/0x18b0 net/ipv4/udp.c:891 udp_sendmsg+0x3bb5/0x4100 net/ipv4/udp.c:1178 inet_sendmsg+0x276/0x2e0 net/ipv4/af_inet.c:807 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg net/socket.c:672 [inline] ____sys_sendmsg+0x1056/0x1350 net/socket.c:2362 ___sys_sendmsg net/socket.c:2416 [inline] __sys_sendmmsg+0x863/0xd60 net/socket.c:2499 __compat_sys_sendmmsg net/compat.c:672 [inline] __do_compat_sys_sendmmsg net/compat.c:679 [inline] __se_compat_sys_sendmmsg+0xcd/0xf0 net/compat.c:676 __ia32_compat_sys_sendmmsg+0x56/0x70 net/compat.c:676 do_syscall_32_irqs_on arch/x86/entry/common.c:339 [inline] do_fast_syscall_32+0x3bf/0x6d0 arch/x86/entry/common.c:398 entry_SYSENTER_compat+0x68/0x77 arch/x86/entry/entry_64_compat.S:139 Local variable ----chaddr@batadv_interface_tx created at: batadv_interface_tx+0x66/0x2450 net/batman-adv/soft-interface.c:191 batadv_interface_tx+0x66/0x2450 net/batman-adv/soft-interface.c:191 ===================================================== --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

1 0

general protection fault in batadv_hardif_get_by_netdev
by syzbot 14 Jul '20

14 Jul '20

Hello, syzbot found the following crash on: HEAD commit: 0aea6d5c Merge tag 'for-linus-5.8b-rc5-tag' of git://git.k.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=1596004f100000 kernel config: https://syzkaller.appspot.com/x/.config?x=66ad203c2bb6d8b dashboard link: https://syzkaller.appspot.com/bug?extid=4a2d01c2df834fe6e86d compiler: gcc (GCC) 10.1.0-syz 20200507 userspace arch: i386 Unfortunately, I don't have any reproducer for this crash yet. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+4a2d01c2df834fe6e86d(a)syzkaller.appspotmail.com netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] CPU: 1 PID: 11316 Comm: syz-executor.4 Not tainted 5.8.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:batadv_hardif_get_by_netdev+0x14c/0x400 net/batman-adv/hard-interface.c:72 Code: 18 00 0f 85 92 02 00 00 4d 8b 24 24 49 81 fc e0 29 4f 8d 0f 84 b4 01 00 00 e8 00 01 ab f9 49 8d 7c 24 18 48 89 f8 48 c1 e8 03 <80> 3c 18 00 0f 85 73 02 00 00 4d 39 6c 24 18 75 b7 e8 de 00 ab f9 RSP: 0018:ffffc900171aeca8 EFLAGS: 00010206 RAX: 0000000000000003 RBX: dffffc0000000000 RCX: ffffc90011a8c000 RDX: 0000000000040000 RSI: ffffffff87c8b900 RDI: 0000000000000018 RBP: ffff88802afd4000 R08: 0000000000000000 R09: ffffffff8c593a27 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff88802afd4000 R14: 0000000000000000 R15: ffffffff8aa441c0 FS: 0000000000000000(0000) GS:ffff8880ae700000(0063) knlGS:00000000f5d6db40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 000055feecf1dcd8 CR3: 0000000027b29000 CR4: 00000000001426e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: batadv_hard_if_event+0x62/0x12f0 net/batman-adv/hard-interface.c:1031 notifier_call_chain+0xb5/0x200 kernel/notifier.c:83 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2027 call_netdevice_notifiers_extack net/core/dev.c:2039 [inline] call_netdevice_notifiers net/core/dev.c:2053 [inline] register_netdevice+0xa52/0x1540 net/core/dev.c:9509 veth_newlink+0x405/0xa00 drivers/net/veth.c:1366 __rtnl_newlink+0x1090/0x1730 net/core/rtnetlink.c:3339 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3397 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5460 netlink_rcv_skb+0x15a/0x430 net/netlink/af_netlink.c:2469 netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1329 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1918 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:672 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2352 ___sys_sendmsg+0xf3/0x170 net/socket.c:2406 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2439 do_syscall_32_irqs_on+0x3f/0x60 arch/x86/entry/common.c:428 __do_fast_syscall_32 arch/x86/entry/common.c:475 [inline] do_fast_syscall_32+0x7f/0x120 arch/x86/entry/common.c:503 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f72569 Code: Bad RIP value. RSP: 002b:00000000f5d6d0cc EFLAGS: 00000296 ORIG_RAX: 0000000000000172 RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000020000040 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

1 0

Batman-adv TTL value
by Maksim Iushchenko 10 Jul '20

10 Jul '20

Hello, batman-adv messages contain TTL value in batman header. So, 1. What is default TTL batman-adv uses? 2. Is it possible to set my own TTL value for each batman-adv packet?

2 1

[PATCH] batman-adv: Drop unused function batadv_hardif_remove_interfaces()
by Sven Eckelmann 07 Jul '20

07 Jul '20

The function batadv_hardif_remove_interfaces was meant to remove all interfaces which are currently in the list of known (compatible) hardifs during module unload. But the function unregister_netdevice_notifier is called in batadv_exit before batadv_hardif_remove_interfaces. This will trigger NETDEV_UNREGISTER events for all available interfaces and in this process remove all interfaces from batadv_hardif_list. And batadv_hardif_remove_interfaces only operated on this (empty) list. Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- net/batman-adv/hard-interface.c | 17 ----------------- net/batman-adv/hard-interface.h | 1 - net/batman-adv/main.c | 1 - 3 files changed, 19 deletions(-) diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c index fa06b51c..f95be90a 100644 --- a/net/batman-adv/hard-interface.c +++ b/net/batman-adv/hard-interface.c @@ -976,23 +976,6 @@ static void batadv_hardif_remove_interface(struct batadv_hard_iface *hard_iface) batadv_hardif_put(hard_iface); } -/** - * batadv_hardif_remove_interfaces() - Remove all hard interfaces - */ -void batadv_hardif_remove_interfaces(void) -{ - struct batadv_hard_iface *hard_iface, *hard_iface_tmp; - - rtnl_lock(); - list_for_each_entry_safe(hard_iface, hard_iface_tmp, - &batadv_hardif_list, list) { - list_del_rcu(&hard_iface->list); - batadv_hardif_generation++; - batadv_hardif_remove_interface(hard_iface); - } - rtnl_unlock(); -} - /** * batadv_hard_if_event_softif() - Handle events for soft interfaces * @event: NETDEV_* event to handle diff --git a/net/batman-adv/hard-interface.h b/net/batman-adv/hard-interface.h index bad2e501..b1855d9d 100644 --- a/net/batman-adv/hard-interface.h +++ b/net/batman-adv/hard-interface.h @@ -100,7 +100,6 @@ int batadv_hardif_enable_interface(struct batadv_hard_iface *hard_iface, struct net *net, const char *iface_name); void batadv_hardif_disable_interface(struct batadv_hard_iface *hard_iface, enum batadv_hard_if_cleanup autodel); -void batadv_hardif_remove_interfaces(void); int batadv_hardif_min_mtu(struct net_device *soft_iface); void batadv_update_min_mtu(struct net_device *soft_iface); void batadv_hardif_release(struct kref *ref); diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c index 519c08c2..70fee9b4 100644 --- a/net/batman-adv/main.c +++ b/net/batman-adv/main.c @@ -137,7 +137,6 @@ static void __exit batadv_exit(void) batadv_netlink_unregister(); rtnl_link_unregister(&batadv_link_ops); unregister_netdevice_notifier(&batadv_hard_if_notifier); - batadv_hardif_remove_interfaces(); flush_workqueue(batadv_event_workqueue); destroy_workqueue(batadv_event_workqueue); -- 2.20.1

1 0

general protection fault in batadv_iv_ogm_schedule_buff (2)
by syzbot 07 Jul '20

07 Jul '20

Hello, syzbot found the following crash on: HEAD commit: 7cc2a8ea Merge tag 'block-5.8-2020-07-01' of git://git.ker.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=130b828f100000 kernel config: https://syzkaller.appspot.com/x/.config?x=7be693511b29b338 dashboard link: https://syzkaller.appspot.com/bug?extid=2eeeb5ad0766b57394d8 compiler: gcc (GCC) 10.1.0-syz 20200507 Unfortunately, I don't have any reproducer for this crash yet. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+2eeeb5ad0766b57394d8(a)syzkaller.appspotmail.com general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 1 PID: 9126 Comm: kworker/u4:9 Not tainted 5.8.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet RIP: 0010:batadv_iv_ogm_schedule_buff+0xd1e/0x1410 net/batman-adv/bat_iv_ogm.c:843 Code: 80 3c 28 00 0f 85 ee 05 00 00 4d 8b 3f 49 81 ff e0 e9 4e 8d 0f 84 dd 02 00 00 e8 bd 80 ae f9 49 8d 7f 70 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 af 06 00 00 48 8b 44 24 08 49 8b 6f 70 80 38 RSP: 0018:ffffc90004e97b98 EFLAGS: 00010202 RAX: 000000000000000e RBX: ffff8880a7471800 RCX: ffffffff87c5394d RDX: ffff88804cf02380 RSI: ffffffff87c536a3 RDI: 0000000000000070 RBP: 0000000000077000 R08: 0000000000000001 R09: ffff8880a875a02b R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000007 R13: dffffc0000000000 R14: ffff888051ad4c40 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000400200 CR3: 0000000061cac000 CR4: 00000000001426e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:869 [inline] batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:862 [inline] batadv_iv_send_outstanding_bat_ogm_packet+0x5c8/0x800 net/batman-adv/bat_iv_ogm.c:1722 process_one_work+0x94c/0x1670 kernel/workqueue.c:2269 worker_thread+0x64c/0x1120 kernel/workqueue.c:2415 kthread+0x3b5/0x4a0 kernel/kthread.c:291 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 Modules linked in: ---[ end trace f5c5eda032070cd1 ]--- RIP: 0010:batadv_iv_ogm_schedule_buff+0xd1e/0x1410 net/batman-adv/bat_iv_ogm.c:843 Code: 80 3c 28 00 0f 85 ee 05 00 00 4d 8b 3f 49 81 ff e0 e9 4e 8d 0f 84 dd 02 00 00 e8 bd 80 ae f9 49 8d 7f 70 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 af 06 00 00 48 8b 44 24 08 49 8b 6f 70 80 38 RSP: 0018:ffffc90004e97b98 EFLAGS: 00010202 RAX: 000000000000000e RBX: ffff8880a7471800 RCX: ffffffff87c5394d RDX: ffff88804cf02380 RSI: ffffffff87c536a3 RDI: 0000000000000070 RBP: 0000000000077000 R08: 0000000000000001 R09: ffff8880a875a02b R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000007 R13: dffffc0000000000 R14: ffff888051ad4c40 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000400200 CR3: 000000009480d000 CR4: 00000000001426e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

2 1

[PATCH 0/4] pull request for net-next: batman-adv 2020-06-26
by Simon Wunderlich 30 Jun '20

30 Jun '20

Hi David, here is a little feature/cleanup pull request of batman-adv to go into net-next. Please pull or let me know of any problem! Thank you, Simon The following changes since commit b3a9e3b9622ae10064826dccb4f7a52bd88c7407: Linux 5.8-rc1 (2020-06-14 12:45:04 -0700) are available in the Git repository at: git://git.open-mesh.org/linux-merge.git tags/batadv-next-for-davem-20200630 for you to fetch changes up to 3bda14d09dc5789a895ab02b7dcfcec19b0a65b3: batman-adv: Introduce a configurable per interface hop penalty (2020-06-26 10:37:11 +0200) ---------------------------------------------------------------- This feature/cleanup patchset includes the following patches: - bump version strings, by Simon Wunderlich - update mailing list URL, by Sven Eckelmann - fix typos and grammar in documentation, by Sven Eckelmann - introduce a configurable per interface hop penalty, by Linus Luessing ---------------------------------------------------------------- Linus Lüssing (1): batman-adv: Introduce a configurable per interface hop penalty Simon Wunderlich (1): batman-adv: Start new development cycle Sven Eckelmann (2): batman-adv: Switch mailing list subscription page batman-adv: Fix typos and grammar in documentation Documentation/networking/batman-adv.rst | 8 +++--- include/uapi/linux/batadv_packet.h | 50 ++++++++++++++++----------------- include/uapi/linux/batman_adv.h | 7 +++-- net/batman-adv/bat_iv_ogm.c | 25 +++++++++-------- net/batman-adv/bat_v_elp.c | 10 +++---- net/batman-adv/bat_v_ogm.c | 27 +++++++++++------- net/batman-adv/bridge_loop_avoidance.c | 6 ++-- net/batman-adv/distributed-arp-table.c | 2 +- net/batman-adv/fragmentation.c | 6 ++-- net/batman-adv/hard-interface.c | 16 ++++++----- net/batman-adv/log.h | 6 ++-- net/batman-adv/main.c | 2 +- net/batman-adv/main.h | 8 +++--- net/batman-adv/multicast.c | 21 +++++++------- net/batman-adv/netlink.c | 14 +++++++-- net/batman-adv/network-coding.c | 14 ++++----- net/batman-adv/originator.c | 8 +++--- net/batman-adv/routing.c | 4 +-- net/batman-adv/send.c | 4 +-- net/batman-adv/soft-interface.c | 2 +- net/batman-adv/tp_meter.c | 12 ++++---- net/batman-adv/translation-table.c | 10 +++---- net/batman-adv/tvlv.c | 4 +-- net/batman-adv/types.h | 18 ++++++++---- 24 files changed, 156 insertions(+), 128 deletions(-)

2 5

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

B.A.T.M.A.N