B.A.T.M.A.N

b.a.t.m.a.n@lists.open-mesh.org

15 participants
4308 discussions

[PATCH 0/2] pull request for net: batman-adv 2019-08-30
by Simon Wunderlich 31 Aug '19

31 Aug '19

Hi David, here is another small batman-adv pull request for net. Please pull or let me know of any problem! Thank you, Simon The following changes since commit 3ee1bb7aae97324ec9078da1f00cb2176919563f: batman-adv: fix uninit-value in batadv_netlink_get_ifindex() (2019-08-14 19:27:07 +0200) are available in the Git repository at: git://git.open-mesh.org/linux-merge.git tags/batadv-net-for-davem-20190830 for you to fetch changes up to 0ff0f15a32c093381ad1abc06abe85afb561ab28: batman-adv: Only read OGM2 tvlv_len after buffer len check (2019-08-23 18:20:31 +0200) ---------------------------------------------------------------- Here are two batman-adv bugfixes: - Fix OGM and OGMv2 header read boundary check, by Sven Eckelmann (2 patches) ---------------------------------------------------------------- Sven Eckelmann (2): batman-adv: Only read OGM tvlv_len after buffer len check batman-adv: Only read OGM2 tvlv_len after buffer len check net/batman-adv/bat_iv_ogm.c | 20 +++++++++++++------- net/batman-adv/bat_v_ogm.c | 18 ++++++++++++------ 2 files changed, 25 insertions(+), 13 deletions(-)

2 3

[PATCH 0/1] pull request for net-next: batman-adv 2019-08-30
by Simon Wunderlich 31 Aug '19

31 Aug '19

Hi David, here is a small maintenance pull request of batman-adv to go into net-next. Please pull or let me know of any problem! Thank you, Simon The following changes since commit 9cb9a17813bf0de1f8ad6deb9538296d5148b5a8: batman-adv: BATMAN_V: aggregate OGMv2 packets (2019-08-04 22:22:00 +0200) are available in the Git repository at: git://git.open-mesh.org/linux-merge.git tags/batadv-next-for-davem-20190830 for you to fetch changes up to 2a813f1392205654aea28098f3bcc3e6e2478fa5: batman-adv: Add Sven to MAINTAINERS file (2019-08-17 13:11:50 +0200) ---------------------------------------------------------------- This maintenance patchset includes the following patches: - Add Sven to the MAINTAINERS file, by Simon Wunderlich ---------------------------------------------------------------- Simon Wunderlich (1): batman-adv: Add Sven to MAINTAINERS file MAINTAINERS | 1 + 1 file changed, 1 insertion(+)

2 2

[PATCH v2 1/2] batman-adv: Only read OGM tvlv_len after buffer len check
by Sven Eckelmann 23 Aug '19

23 Aug '19

Multiple batadv_ogm_packet can be stored in an skbuff. The functions batadv_iv_ogm_send_to_if()/batadv_iv_ogm_receive() use batadv_iv_ogm_aggr_packet() to check if there is another additional batadv_ogm_packet in the skb or not before they continue processing the packet. The length for such an OGM is BATADV_OGM_HLEN + batadv_ogm_packet->tvlv_len. The check must first check that at least BATADV_OGM_HLEN bytes are available before it accesses tvlv_len (which is part of the header. Otherwise it might try read outside of the currently available skbuff to get the content of tvlv_len. Fixes: 0b6aa0d43767 ("batman-adv: tvlv - basic infrastructure") Reported-by: syzbot+355cab184197dbbfa384(a)syzkaller.appspotmail.com Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- v2: * change __be16 pointer parameter to const const struct batadv_ogm_packet net/batman-adv/bat_iv_ogm.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c index 240ed709..d78938e3 100644 --- a/net/batman-adv/bat_iv_ogm.c +++ b/net/batman-adv/bat_iv_ogm.c @@ -277,17 +277,23 @@ static u8 batadv_hop_penalty(u8 tq, const struct batadv_priv *bat_priv) * batadv_iv_ogm_aggr_packet() - checks if there is another OGM attached * @buff_pos: current position in the skb * @packet_len: total length of the skb - * @tvlv_len: tvlv length of the previously considered OGM + * @ogm_packet: potential OGM in buffer * * Return: true if there is enough space for another OGM, false otherwise. */ -static bool batadv_iv_ogm_aggr_packet(int buff_pos, int packet_len, - __be16 tvlv_len) +static bool +batadv_iv_ogm_aggr_packet(int buff_pos, int packet_len, + const struct batadv_ogm_packet *ogm_packet) { int next_buff_pos = 0; - next_buff_pos += buff_pos + BATADV_OGM_HLEN; - next_buff_pos += ntohs(tvlv_len); + /* check if there is enough space for the header */ + next_buff_pos += buff_pos + sizeof(*ogm_packet); + if (next_buff_pos > packet_len) + return false; + + /* check if there is enough space for the optional TVLV */ + next_buff_pos += ntohs(ogm_packet->tvlv_len); return (next_buff_pos <= packet_len) && (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES); @@ -315,7 +321,7 @@ static void batadv_iv_ogm_send_to_if(struct batadv_forw_packet *forw_packet, /* adjust all flags and log packets */ while (batadv_iv_ogm_aggr_packet(buff_pos, forw_packet->packet_len, - batadv_ogm_packet->tvlv_len)) { + batadv_ogm_packet)) { /* we might have aggregated direct link packets with an * ordinary base packet */ @@ -1704,7 +1710,7 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb, /* unpack the aggregated packets and process them one by one */ while (batadv_iv_ogm_aggr_packet(ogm_offset, skb_headlen(skb), - ogm_packet->tvlv_len)) { + ogm_packet)) { batadv_iv_ogm_process(skb, ogm_offset, if_incoming); ogm_offset += BATADV_OGM_HLEN; -- 2.20.1

2 2

[PATCH maint] batman-adv: Only read tvlv_len after checking buffer size
by Sven Eckelmann 23 Aug '19

23 Aug '19

Multiple batadv_ogm_packet can be stored in an skbuff. The functions batadv_iv_ogm_send_to_if()/batadv_iv_ogm_receive() use batadv_iv_ogm_aggr_packet() to check if there is another additional batadv_ogm_packet in the skb or not before they continue processing the packet. The length for such an OGM is BATADV_OGM_HLEN + batadv_ogm_packet->tvlv_len. The check must first check that at least BATADV_OGM_HLEN bytes are available before it accesses tvlv_len (which is part of the header. Otherwise it might try read outside of the currently available skbuff to get the content of tvlv_len. Fixes: 0b6aa0d43767 ("batman-adv: tvlv - basic infrastructure") Reported-by: syzbot+355cab184197dbbfa384(a)syzkaller.appspotmail.com Signed-off-by: Sven Eckelmann <sven(a)narfation.org> --- Please check this thoroughly. I just made this change while waiting for something else to finish. So I have not tested it at all. Bug for this can be found under https://www.open-mesh.org/issues/398 --- net/batman-adv/bat_iv_ogm.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c index 240ed709..61836143 100644 --- a/net/batman-adv/bat_iv_ogm.c +++ b/net/batman-adv/bat_iv_ogm.c @@ -277,17 +277,22 @@ static u8 batadv_hop_penalty(u8 tq, const struct batadv_priv *bat_priv) * batadv_iv_ogm_aggr_packet() - checks if there is another OGM attached * @buff_pos: current position in the skb * @packet_len: total length of the skb - * @tvlv_len: tvlv length of the previously considered OGM + * @tvlv_len: tvlv length of the considered OGM * * Return: true if there is enough space for another OGM, false otherwise. */ static bool batadv_iv_ogm_aggr_packet(int buff_pos, int packet_len, - __be16 tvlv_len) + __be16 *tvlv_len) { int next_buff_pos = 0; + /* check if there is enough space for the header */ next_buff_pos += buff_pos + BATADV_OGM_HLEN; - next_buff_pos += ntohs(tvlv_len); + if (next_buff_pos > packet_len) + return false; + + /* check if there is enough space for the optional TVLV */ + next_buff_pos += ntohs(*tvlv_len); return (next_buff_pos <= packet_len) && (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES); @@ -315,7 +320,7 @@ static void batadv_iv_ogm_send_to_if(struct batadv_forw_packet *forw_packet, /* adjust all flags and log packets */ while (batadv_iv_ogm_aggr_packet(buff_pos, forw_packet->packet_len, - batadv_ogm_packet->tvlv_len)) { + &batadv_ogm_packet->tvlv_len)) { /* we might have aggregated direct link packets with an * ordinary base packet */ @@ -1704,7 +1709,7 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb, /* unpack the aggregated packets and process them one by one */ while (batadv_iv_ogm_aggr_packet(ogm_offset, skb_headlen(skb), - ogm_packet->tvlv_len)) { + &ogm_packet->tvlv_len)) { batadv_iv_ogm_process(skb, ogm_offset, if_incoming); ogm_offset += BATADV_OGM_HLEN; -- 2.20.1

2 1

KMSAN: uninit-value in batadv_iv_send_outstanding_bat_ogm_packet
by syzbot 21 Aug '19

21 Aug '19

Hello, syzbot found the following crash on: HEAD commit: 61ccdad1 Revert "drm/bochs: Use shadow buffer for bochs fr.. git tree: https://github.com/google/kmsan.git master console output: https://syzkaller.appspot.com/x/log.txt?x=13d6909c600000 kernel config: https://syzkaller.appspot.com/x/.config?x=27abc558ecb16a3b dashboard link: https://syzkaller.appspot.com/bug?extid=355cab184197dbbfa384 compiler: clang version 9.0.0 (/home/glider/llvm/clang 80fee25776c2fb61e74c1ecb1a523375c2500b69) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1612b9d2600000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d388ac600000 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+355cab184197dbbfa384(a)syzkaller.appspotmail.com ================================================================== BUG: KMSAN: uninit-value in batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:317 [inline] BUG: KMSAN: uninit-value in batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:383 [inline] BUG: KMSAN: uninit-value in batadv_iv_send_outstanding_bat_ogm_packet+0x6cd/0xcc0 net/batman-adv/bat_iv_ogm.c:1657 CPU: 1 PID: 290 Comm: kworker/u4:7 Not tainted 5.3.0-rc3+ #17 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x191/0x1f0 lib/dump_stack.c:113 kmsan_report+0x162/0x2d0 mm/kmsan/kmsan_report.c:109 __msan_warning+0x75/0xe0 mm/kmsan/kmsan_instr.c:294 batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:317 [inline] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:383 [inline] batadv_iv_send_outstanding_bat_ogm_packet+0x6cd/0xcc0 net/batman-adv/bat_iv_ogm.c:1657 process_one_work+0x1572/0x1ef0 kernel/workqueue.c:2269 worker_thread+0x111b/0x2460 kernel/workqueue.c:2415 kthread+0x4b5/0x4f0 kernel/kthread.c:256 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355 Uninit was created at: kmsan_save_stack_with_flags+0x37/0x70 mm/kmsan/kmsan.c:187 kmsan_internal_alloc_meta_for_pages+0x123/0x510 mm/kmsan/kmsan_hooks.c:114 kmsan_alloc_page+0x7a/0xf0 mm/kmsan/kmsan_hooks.c:244 __alloc_pages_nodemask+0x142d/0x5fa0 mm/page_alloc.c:4768 __alloc_pages include/linux/gfp.h:475 [inline] __alloc_pages_node include/linux/gfp.h:488 [inline] alloc_pages_node include/linux/gfp.h:502 [inline] __page_frag_cache_refill mm/page_alloc.c:4843 [inline] page_frag_alloc+0x35b/0x890 mm/page_alloc.c:4873 __napi_alloc_skb+0x195/0x980 net/core/skbuff.c:519 napi_alloc_skb include/linux/skbuff.h:2808 [inline] page_to_skb+0x134/0x1150 drivers/net/virtio_net.c:384 receive_mergeable drivers/net/virtio_net.c:924 [inline] receive_buf+0xe7b/0x8810 drivers/net/virtio_net.c:1033 virtnet_receive drivers/net/virtio_net.c:1323 [inline] virtnet_poll+0x666/0x19d0 drivers/net/virtio_net.c:1428 napi_poll net/core/dev.c:6347 [inline] net_rx_action+0x74b/0x1950 net/core/dev.c:6413 __do_softirq+0x4a1/0x83a kernel/softirq.c:293 invoke_softirq kernel/softirq.c:375 [inline] irq_exit+0x230/0x280 kernel/softirq.c:416 exiting_irq arch/x86/include/asm/apic.h:537 [inline] do_IRQ+0x20d/0x3a0 arch/x86/kernel/irq.c:259 ret_from_intr+0x0/0x33 kmsan_get_shadow_origin_ptr+0x6/0x3a0 mm/kmsan/kmsan.c:656 __msan_metadata_ptr_for_load_8+0x10/0x20 mm/kmsan/kmsan_instr.c:55 compound_head include/linux/compiler.h:206 [inline] PageReferenced include/linux/page-flags.h:315 [inline] mark_page_accessed+0x30c/0xa00 mm/swap.c:391 touch_buffer fs/buffer.c:60 [inline] __find_get_block+0x1681/0x19e0 fs/buffer.c:1303 __getblk_gfp+0xc5/0x1080 fs/buffer.c:1321 sb_getblk include/linux/buffer_head.h:325 [inline] __ext4_get_inode_loc+0x647/0x1c80 fs/ext4/inode.c:4611 ext4_get_inode_loc fs/ext4/inode.c:4726 [inline] ext4_reserve_inode_write+0x15d/0x430 fs/ext4/inode.c:5919 ext4_mark_inode_dirty+0x2dd/0xca0 fs/ext4/inode.c:6071 ext4_dirty_inode+0x187/0x1d0 fs/ext4/inode.c:6110 __mark_inode_dirty+0x486/0x1380 fs/fs-writeback.c:2170 mark_inode_dirty include/linux/fs.h:2138 [inline] generic_write_end+0x3f7/0x460 fs/buffer.c:2164 ext4_da_write_end+0x1050/0x1240 fs/ext4/inode.c:3217 generic_perform_write+0x618/0x990 mm/filemap.c:3341 __generic_file_write_iter+0x421/0xa30 mm/filemap.c:3459 ext4_file_write_iter+0xc97/0x2010 fs/ext4/file.c:270 call_write_iter include/linux/fs.h:1870 [inline] new_sync_write fs/read_write.c:483 [inline] __vfs_write+0xa2c/0xcb0 fs/read_write.c:496 vfs_write+0x481/0x920 fs/read_write.c:558 ksys_write+0x265/0x430 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write+0x92/0xb0 fs/read_write.c:620 __x64_sys_write+0x4a/0x70 fs/read_write.c:620 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x63/0xe7 ================================================================== --- This bug is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this bug report. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this bug, for details see: https://goo.gl/tpsmEJ#testing-patches

1 0

[PATCH 0/1] pull request for net: batman-adv 2019-08-21
by Simon Wunderlich 21 Aug '19

21 Aug '19

Hi David, here is a pull request with Erics bugfix from last week which we would like to have integrated into net. We didn't get anything else, so it's a short one this time. :) Please pull or let me know of any problem! Thank you, Simon The following changes since commit f7af86ccf1882084293b11077deec049fd01da63: batman-adv: Fix deletion of RTR(4|6) mcast list entries (2019-07-22 21:34:58 +0200) are available in the Git repository at: git://git.open-mesh.org/linux-merge.git tags/batadv-net-for-davem-20190821 for you to fetch changes up to 3ee1bb7aae97324ec9078da1f00cb2176919563f: batman-adv: fix uninit-value in batadv_netlink_get_ifindex() (2019-08-14 19:27:07 +0200) ---------------------------------------------------------------- Here is a batman-adv bugfix: - fix uninit-value in batadv_netlink_get_ifindex(), by Eric Dumazet ---------------------------------------------------------------- Eric Dumazet (1): batman-adv: fix uninit-value in batadv_netlink_get_ifindex() net/batman-adv/netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

2 2

[PATCH] batman-adv: Add Sven to MAINTAINERS file
by Simon Wunderlich 21 Aug '19

21 Aug '19

Sven is taking care of tracking our patches and merging most of them in our tree. Let's add him to the MAINTAINERS file so he will get all patch e-mails. Signed-off-by: Simon Wunderlich <sw(a)simonwunderlich.de> --- MAINTAINERS | 1 + 1 file changed, 1 insertion(+) diff --git a/MAINTAINERS b/MAINTAINERS index 4b1b53d5..9f0f421e 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -2,6 +2,7 @@ BATMAN ADVANCED M: Marek Lindner <mareklindner(a)neomailbox.ch> M: Simon Wunderlich <sw(a)simonwunderlich.de> M: Antonio Quartulli <a(a)unstable.cc> +M: Sven Eckelmann <sven(a)narfation.org> L: b.a.t.m.a.n(a)lists.open-mesh.org (moderated for non-subscribers) W: https://www.open-mesh.org/ B: https://www.open-mesh.org/projects/batman-adv/issues -- 2.20.1

3 2

Using two interfaces to increase bandwidth with bonding
by Emin Savaş 21 Aug '19

21 Aug '19

Greetings, I want to ask about bonding feature. For example considering the following configuration; PC0 ---> eth [100 mbits/s] ----------------------------- eth [100 mbits/s] <--- PC1 |----> wifi_5ghz [110 mbits/s] ----------------------------- wifi_5ghz [110 mbits/s] <----| if the two interfaces(eth, wifi5ghz) are on the batman if I enable the bonding feature on both ends, is it possible to see a bandwidth more than 100 mbits/s ? Thanks in advance.

1 0

[RFC] batman-adv: ELP - use wifi tx bitrate as fallback throughput
by Marek Lindner 11 Aug '19

11 Aug '19

From: René Treffer <treffer(a)measite.de> Some wifi drivers (e.g. ath10k) provide per-station rx/tx values but no estimated throughput. Setting a better estimate than the default 1 MBit makes these devices work well with B.A.T.M.A.N. V. Signed-off-by: René Treffer <treffer(a)measite.de> Signed-off-by: Marek Lindner <mareklindner(a)neomailbox.ch> --- net/batman-adv/bat_v_elp.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c index 2614a9ca..1e852d4b 100644 --- a/net/batman-adv/bat_v_elp.c +++ b/net/batman-adv/bat_v_elp.c @@ -107,10 +107,15 @@ static u32 batadv_v_elp_get_throughput(struct batadv_hardif_neigh_node *neigh) } if (ret) goto default_throughput; - if (!(sinfo.filled & BIT(NL80211_STA_INFO_EXPECTED_THROUGHPUT))) - goto default_throughput; - return sinfo.expected_throughput / 100; + if (sinfo.filled & BIT(NL80211_STA_INFO_EXPECTED_THROUGHPUT)) + return sinfo.expected_throughput / 100; + + /* try to estimate en expected throughput based on reported tx rates */ + if (sinfo.filled & BIT(NL80211_STA_INFO_TX_BITRATE)) + return cfg80211_calculate_bitrate(&sinfo.txrate) / 3; + + goto default_throughput; } /* if not a wifi interface, check if this device provides data via -- 2.20.1

2 1

batman_v default throughput
by Moritz Warning 11 Aug '19

11 Aug '19

Hi, the Freifunk network in Ulm has a batman_V network of >80 nodes. [0] For the map, we use the link throughput value from batman-adv to calculate a link value (capped at 40 MBit/s for 100%). The default for VPN connections seem to be 1 MBit/s - when batman-adv doesn't know the throughput from the driver. Is there a way to the set this throughput or can batman-adv measure it? Thanks! [0]: https://map11.freifunk-ulm.de/meshviewer

3 4

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

B.A.T.M.A.N