B.A.T.M.A.N

b.a.t.m.a.n@lists.open-mesh.org

15 participants
4308 discussions

Re: KASAN: use-after-free Read in ext4_xattr_set_entry (2)
by syzbot 16 Dec '19

16 Dec '19

syzbot has bisected this bug to: commit 8835cae5f2abd7f7a3143afe357f416aff5517a4 Author: Chris Lapa <chris(a)lapa.com.au> Date: Wed Jan 11 01:44:47 2017 +0000 power: supply: bq27xxx: adds specific support for bq27520-g4 revision. bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=16661f41e00000 start commit: ae4b064e Merge tag 'afs-fixes-20191211' of git://git.kerne.. git tree: upstream final crash: https://syzkaller.appspot.com/x/report.txt?x=15661f41e00000 console output: https://syzkaller.appspot.com/x/log.txt?x=11661f41e00000 kernel config: https://syzkaller.appspot.com/x/.config?x=79f79de2a27d3e3d dashboard link: https://syzkaller.appspot.com/bug?extid=4a39a025912b265cacef syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15ec1332e00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=163455dee00000 Reported-by: syzbot+4a39a025912b265cacef(a)syzkaller.appspotmail.com Fixes: 8835cae5f2ab ("power: supply: bq27xxx: adds specific support for bq27520-g4 revision.") For information about bisection process see: https://goo.gl/tpsmEJ#bisection

3 3

KCSAN: data-race in add_timer / timer_clear_idle (2)
by syzbot 12 Dec '19

12 Dec '19

Hello, syzbot found the following crash on: HEAD commit: ef798c30 x86, kcsan: Enable KCSAN for x86 git tree: https://github.com/google/ktsan.git kcsan console output: https://syzkaller.appspot.com/x/log.txt?x=156e052ee00000 kernel config: https://syzkaller.appspot.com/x/.config?x=8077a73bd604a9d4 dashboard link: https://syzkaller.appspot.com/bug?extid=c051abeff5e2e8ac40f0 compiler: gcc (GCC) 9.0.0 20181231 (experimental) Unfortunately, I don't have any reproducer for this crash yet. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+c051abeff5e2e8ac40f0(a)syzkaller.appspotmail.com ================================================================== BUG: KCSAN: data-race in add_timer / timer_clear_idle read to 0xffff88812be1b6e4 of 1 bytes by task 23 on cpu 1: forward_timer_base kernel/time/timer.c:892 [inline] __mod_timer kernel/time/timer.c:1009 [inline] mod_timer kernel/time/timer.c:1100 [inline] add_timer+0x3a6/0x550 kernel/time/timer.c:1136 __queue_delayed_work+0x13b/0x1d0 kernel/workqueue.c:1649 queue_delayed_work_on+0xf3/0x110 kernel/workqueue.c:1674 queue_delayed_work include/linux/workqueue.h:509 [inline] batadv_mcast_start_timer net/batman-adv/multicast.c:71 [inline] batadv_mcast_mla_update+0x11ad/0x19e0 net/batman-adv/multicast.c:949 process_one_work+0x3d4/0x890 kernel/workqueue.c:2269 worker_thread+0xa0/0x800 kernel/workqueue.c:2415 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352 write to 0xffff88812be1b6e4 of 1 bytes by task 0 on cpu 0: timer_clear_idle+0x42/0x50 kernel/time/timer.c:1675 tick_nohz_restart_sched_tick kernel/time/tick-sched.c:839 [inline] __tick_nohz_idle_restart_tick+0x36/0x1b0 kernel/time/tick-sched.c:1140 tick_nohz_idle_exit+0x1af/0x1e0 kernel/time/tick-sched.c:1181 do_idle+0xb1/0x280 kernel/sched/idle.c:276 cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:355 rest_init+0xec/0xf6 init/main.c:452 arch_call_rest_init+0x17/0x37 start_kernel+0x838/0x85e init/main.c:786 x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:490 x86_64_start_kernel+0x72/0x76 arch/x86/kernel/head64.c:471 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ================================================================== --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

1 0

Re: BUG: corrupted list in __dentry_kill (2)
by syzbot 12 Dec '19

12 Dec '19

syzbot has bisected this bug to: commit ab92d68fc22f9afab480153bd82a20f6e2533769 Author: Taehee Yoo <ap420073(a)gmail.com> Date: Mon Oct 21 18:47:51 2019 +0000 net: core: add generic lockdep keys bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=12d37cb6e00000 start commit: 938f49c8 Add linux-next specific files for 20191211 git tree: linux-next final crash: https://syzkaller.appspot.com/x/report.txt?x=11d37cb6e00000 console output: https://syzkaller.appspot.com/x/log.txt?x=16d37cb6e00000 kernel config: https://syzkaller.appspot.com/x/.config?x=96834c884ba7bb81 dashboard link: https://syzkaller.appspot.com/bug?extid=31043da7725b6ec210f1 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12dc83dae00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16ac8396e00000 Reported-by: syzbot+31043da7725b6ec210f1(a)syzkaller.appspotmail.com Fixes: ab92d68fc22f ("net: core: add generic lockdep keys") For information about bisection process see: https://goo.gl/tpsmEJ#bisection

1 0

[PATCH] batman-adv: Replace FIELD_SIZEOF with sizeof_field
by Sven Eckelmann 11 Dec '19

11 Dec '19

The prefered way of getting the size of a member of a struct is the common macro sizeof_field from stddef.h and not the FIELD_SIZEOF (with multiple definitions). Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- compat-include/linux/stddef.h | 24 ++++++++++++++++++++++++ net/batman-adv/main.c | 2 +- 2 files changed, 25 insertions(+), 1 deletion(-) create mode 100644 compat-include/linux/stddef.h diff --git a/compat-include/linux/stddef.h b/compat-include/linux/stddef.h new file mode 100644 index 00000000..dd18840e --- /dev/null +++ b/compat-include/linux/stddef.h @@ -0,0 +1,24 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* Copyright (C) 2007-2019 B.A.T.M.A.N. contributors: + * + * Marek Lindner, Simon Wunderlich + * + * This file contains macros for maintaining compatibility with older versions + * of the Linux kernel. + */ + +#ifndef _NET_BATMAN_ADV_COMPAT_LINUX_STDDEF_H_ +#define _NET_BATMAN_ADV_COMPAT_LINUX_STDDEF_H_ + +#include <linux/version.h> +#include_next <linux/stddef.h> + +#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 16, 0) + +#ifndef sizeof_field +#define sizeof_field(TYPE, MEMBER) sizeof((((TYPE *)0)->MEMBER)) +#endif + +#endif /* < KERNEL_VERSION(4, 16, 0) */ + +#endif /* _NET_BATMAN_ADV_COMPAT_LINUX_STDDEF_H_ */ diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c index 4a89177d..4811ec65 100644 --- a/net/batman-adv/main.c +++ b/net/batman-adv/main.c @@ -548,7 +548,7 @@ static void batadv_recv_handler_init(void) BUILD_BUG_ON(sizeof(struct batadv_tvlv_tt_change) != 12); BUILD_BUG_ON(sizeof(struct batadv_tvlv_roam_adv) != 8); - i = FIELD_SIZEOF(struct sk_buff, cb); + i = sizeof_field(struct sk_buff, cb); BUILD_BUG_ON(sizeof(struct batadv_skb_cb) > i); /* broadcast packet */ -- 2.20.1

1 0

Re: BUG: sleeping function called from invalid context in __alloc_pages_nodemask
by syzbot 02 Dec '19

02 Dec '19

syzbot has bisected this bug to: commit ab92d68fc22f9afab480153bd82a20f6e2533769 Author: Taehee Yoo <ap420073(a)gmail.com> Date: Mon Oct 21 18:47:51 2019 +0000 net: core: add generic lockdep keys bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=15769712e00000 start commit: 419593da Add linux-next specific files for 20191129 git tree: linux-next final crash: https://syzkaller.appspot.com/x/report.txt?x=17769712e00000 console output: https://syzkaller.appspot.com/x/log.txt?x=13769712e00000 kernel config: https://syzkaller.appspot.com/x/.config?x=7c04b0959e75c206 dashboard link: https://syzkaller.appspot.com/bug?extid=4925d60532bf4c399608 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16148e9ce00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12a1f786e00000 Reported-by: syzbot+4925d60532bf4c399608(a)syzkaller.appspotmail.com Fixes: ab92d68fc22f ("net: core: add generic lockdep keys") For information about bisection process see: https://goo.gl/tpsmEJ#bisection

1 0

general protection fault in smack_socket_sendmsg (2)
by syzbot 29 Nov '19

29 Nov '19

Hello, syzbot found the following crash on: HEAD commit: 0be0ee71 vfs: properly and reliably lock f_pos in fdget_po.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=12c49ef2e00000 kernel config: https://syzkaller.appspot.com/x/.config?x=330a1f54d1edb817 dashboard link: https://syzkaller.appspot.com/bug?extid=131d2229316b7012ac06 compiler: clang version 9.0.0 (/home/glider/llvm/clang 80fee25776c2fb61e74c1ecb1a523375c2500b69) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13bb67cee00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12460136e00000 The bug was bisected to: commit 8ae5bcdc5d98a99e59f194101e7acd2e9d055758 Author: Vivien Didelot <vivien.didelot(a)savoirfairelinux.com> Date: Fri May 19 21:00:54 2017 +0000 net: dsa: add MDB notifier bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=17ec2f5ae00000 final crash: https://syzkaller.appspot.com/x/report.txt?x=141c2f5ae00000 console output: https://syzkaller.appspot.com/x/log.txt?x=101c2f5ae00000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+131d2229316b7012ac06(a)syzkaller.appspotmail.com Fixes: 8ae5bcdc5d98 ("net: dsa: add MDB notifier") kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 7989 Comm: kworker/1:4 Not tainted 5.4.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: krxrpcd rxrpc_peer_keepalive_worker RIP: 0010:smack_socket_sendmsg+0x5b/0x480 security/smack/smack_lsm.c:3675 Code: e8 fa 03 6b fe 4c 89 e8 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 ef e8 74 46 a4 fe 4d 8b 65 00 48 83 c3 18 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 56 46 a4 fe 4c 8b 33 49 8d 9e 08 RSP: 0018:ffff88808a58f9c8 EFLAGS: 00010206 RAX: 0000000000000003 RBX: 0000000000000018 RCX: ffff8880a1270280 RDX: 0000000000000000 RSI: ffff88808a58fb18 RDI: 0000000000000000 RBP: ffff88808a58fa80 R08: ffffffff83442500 R09: ffff88808a58fb86 R10: ffffed10114b1f72 R11: 0000000000000000 R12: ffff8880a124c114 R13: ffff88808a58fb18 R14: dffffc0000000000 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe2d48c9e78 CR3: 0000000098a23000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: security_socket_sendmsg+0x6c/0xd0 security/security.c:2013 sock_sendmsg net/socket.c:655 [inline] kernel_sendmsg+0x77/0x140 net/socket.c:678 rxrpc_send_keepalive+0x254/0x3c0 net/rxrpc/output.c:655 rxrpc_peer_keepalive_dispatch net/rxrpc/peer_event.c:376 [inline] rxrpc_peer_keepalive_worker+0x76e/0xb40 net/rxrpc/peer_event.c:437 process_one_work+0x7ef/0x10e0 kernel/workqueue.c:2269 worker_thread+0xc01/0x1630 kernel/workqueue.c:2415 kthread+0x332/0x350 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Modules linked in: ---[ end trace 8b748724da7e3b28 ]--- RIP: 0010:smack_socket_sendmsg+0x5b/0x480 security/smack/smack_lsm.c:3675 Code: e8 fa 03 6b fe 4c 89 e8 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 ef e8 74 46 a4 fe 4d 8b 65 00 48 83 c3 18 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 56 46 a4 fe 4c 8b 33 49 8d 9e 08 RSP: 0018:ffff88808a58f9c8 EFLAGS: 00010206 RAX: 0000000000000003 RBX: 0000000000000018 RCX: ffff8880a1270280 RDX: 0000000000000000 RSI: ffff88808a58fb18 RDI: 0000000000000000 RBP: ffff88808a58fa80 R08: ffffffff83442500 R09: ffff88808a58fb86 R10: ffffed10114b1f72 R11: 0000000000000000 R12: ffff8880a124c114 R13: ffff88808a58fb18 R14: dffffc0000000000 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880aeb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe2d48c9e78 CR3: 0000000098a23000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. For information about bisection process see: https://goo.gl/tpsmEJ#bisection syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches

2 1

[PATCH maint] batman-adv: Fix DAT candidate selection on little endian systems
by Sven Eckelmann 28 Nov '19

28 Nov '19

The distributed arp table is using a DHT to store and retrieve MAC address information for an IP address. This is done using unicast messages to selected peers. The potential peers are looked up using the IP address and the VID. While the IP address is always stored in big endian byte order, it is not the case of the VID. It can (depending on the host system) either be big endian or little endian. The host must therefore always convert it to big endian to ensure that all devices calculate the same peers for the same lookup data. Fixes: 3e26722bc9f2 ("batman-adv: make the Distributed ARP Table vlan aware") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- net/batman-adv/distributed-arp-table.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c index 5004e38f..581b3181 100644 --- a/net/batman-adv/distributed-arp-table.c +++ b/net/batman-adv/distributed-arp-table.c @@ -287,6 +287,7 @@ static u32 batadv_hash_dat(const void *data, u32 size) u32 hash = 0; const struct batadv_dat_entry *dat = data; const unsigned char *key; + __be16 vid; u32 i; key = (__force const unsigned char *)&dat->ip; @@ -296,7 +297,8 @@ static u32 batadv_hash_dat(const void *data, u32 size) hash ^= (hash >> 6); } - key = (const unsigned char *)&dat->vid; + vid = htons(dat->vid); + key = (__force const unsigned char *)&vid; for (i = 0; i < sizeof(dat->vid); i++) { hash += key[i]; hash += (hash << 10); -- 2.20.1

2 1

[PATCH] batman-adv: Annotate bitwise integer pointer casts
by Sven Eckelmann 28 Nov '19

28 Nov '19

The sparse commit 6002ded74587 ("add a flag to warn on casts to/from bitwise pointers") introduced a check for non-direct casts from/to restricted datatypes (when -Wbitwise-pointer is enabled). This triggered various warnings in batman-adv when some (already big endian) buffer content was casted to/from the corresponding big endian integer data types. But these were correct and can therefore be marked with __force to signalize sparse an intended cast from/to a bitwise type. Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- net/batman-adv/bridge_loop_avoidance.c | 2 +- net/batman-adv/distributed-arp-table.c | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c index 663a53b6..0eff3358 100644 --- a/net/batman-adv/bridge_loop_avoidance.c +++ b/net/batman-adv/bridge_loop_avoidance.c @@ -844,7 +844,7 @@ static bool batadv_handle_announce(struct batadv_priv *bat_priv, u8 *an_addr, /* handle as ANNOUNCE frame */ backbone_gw->lasttime = jiffies; - crc = ntohs(*((__be16 *)(&an_addr[4]))); + crc = ntohs(*((__force __be16 *)(&an_addr[4]))); batadv_dbg(BATADV_DBG_BLA, bat_priv, "%s(): ANNOUNCE vid %d (sent by %pM)... CRC = %#.4x\n", diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c index b0af3a11..5004e38f 100644 --- a/net/batman-adv/distributed-arp-table.c +++ b/net/batman-adv/distributed-arp-table.c @@ -246,7 +246,7 @@ static u8 *batadv_arp_hw_src(struct sk_buff *skb, int hdr_size) */ static __be32 batadv_arp_ip_src(struct sk_buff *skb, int hdr_size) { - return *(__be32 *)(batadv_arp_hw_src(skb, hdr_size) + ETH_ALEN); + return *(__force __be32 *)(batadv_arp_hw_src(skb, hdr_size) + ETH_ALEN); } /** @@ -270,7 +270,9 @@ static u8 *batadv_arp_hw_dst(struct sk_buff *skb, int hdr_size) */ static __be32 batadv_arp_ip_dst(struct sk_buff *skb, int hdr_size) { - return *(__be32 *)(batadv_arp_hw_src(skb, hdr_size) + ETH_ALEN * 2 + 4); + u8 *dst = batadv_arp_hw_src(skb, hdr_size) + ETH_ALEN * 2 + 4; + + return *(__force __be32 *)dst; } /** @@ -287,7 +289,7 @@ static u32 batadv_hash_dat(const void *data, u32 size) const unsigned char *key; u32 i; - key = (const unsigned char *)&dat->ip; + key = (__force const unsigned char *)&dat->ip; for (i = 0; i < sizeof(dat->ip); i++) { hash += key[i]; hash += (hash << 10); -- 2.20.1

1 0

Host endianness dependent DHT lookup
by Sven Eckelmann 28 Nov '19

28 Nov '19

Hi, I just saw following in batadv_hash_dat(): key = (const unsigned char *)&dat->vid; for (i = 0; i < sizeof(dat->vid); i++) { hash += key[i]; hash += (hash << 10); hash ^= (hash >> 6); } But the vid is in host order - not big endian like the IP part. So the batadv_dat_select_candidates will select different candidates depending on whether it is a little or big endian system, right? If this is a correct assumption, then we would have this problem since 3e26722bc9f2 ("batman-adv: make the Distributed ARP Table vlan aware") Kind regards, Sven

2 2

Re: WARNING in mark_lock (3)
by syzbot 28 Nov '19

28 Nov '19

syzbot has bisected this bug to: commit d665c1281bc89ac85b8b0c058c22a3f94640a1d6 Author: Yi Wang <wang.yi59(a)zte.com.cn> Date: Mon Oct 21 23:57:42 2019 +0000 net: sched: taprio: fix -Wmissing-prototypes warnings bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=132ee536e00000 start commit: 89d57ddd Merge tag 'media/v5.5-1' of git://git.kernel.org/.. git tree: upstream final crash: https://syzkaller.appspot.com/x/report.txt?x=10aee536e00000 console output: https://syzkaller.appspot.com/x/log.txt?x=172ee536e00000 kernel config: https://syzkaller.appspot.com/x/.config?x=595c15c951695d1b dashboard link: https://syzkaller.appspot.com/bug?extid=a229d8d995b74f8c4b6c syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1511af5ee00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16e0f17ae00000 Reported-by: syzbot+a229d8d995b74f8c4b6c(a)syzkaller.appspotmail.com Fixes: d665c1281bc8 ("net: sched: taprio: fix -Wmissing-prototypes warnings") For information about bisection process see: https://goo.gl/tpsmEJ#bisection

3 5

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

B.A.T.M.A.N