Hi,
here are patches targeted for 2.6.36. They are smaller bugfixes and add no new features.
I already send you 5 Patches two weeks ago which fixes problems in 2.6.36 and one of them also in 2.6.35, but got no reply till now. So here is the reminder you asked me before.
The patches for 2.6.37 will follow later.
thanks, Sven
Sven Eckelmann (3): Staging: batman-adv: Create batman_if only on register event Staging: batman-adv: Don't use net_dev after dev_put Staging: batman-adv: Don't write in not allocated packet_buff
drivers/staging/batman-adv/hard-interface.c | 21 ++++++++++++--------- 1 files changed, 12 insertions(+), 9 deletions(-)
We try to get all events for all net_devices to be able to add special sysfs folders for the batman-adv configuration. This also includes such events like NETDEV_POST_INIT which has no valid kobject according to v2.6.32-rc3-13-g7ffbe3f. This would create an oops in that situation.
It is enough to create the batman_if only on NETDEV_REGISTER events because we will also receive those events for devices which already existed when we registered the notifier call.
Signed-off-by: Sven Eckelmann sven.eckelmann@gmx.de Cc: stable stable@kernel.org --- drivers/staging/batman-adv/hard-interface.c | 6 ++---- 1 files changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/staging/batman-adv/hard-interface.c b/drivers/staging/batman-adv/hard-interface.c index f6345c4..892166b 100644 --- a/drivers/staging/batman-adv/hard-interface.c +++ b/drivers/staging/batman-adv/hard-interface.c @@ -393,15 +393,13 @@ static int hard_if_event(struct notifier_block *this, /* FIXME: each batman_if will be attached to a softif */ struct bat_priv *bat_priv = netdev_priv(soft_device);
- if (!batman_if) - batman_if = hardif_add_interface(net_dev); + if (!batman_if && event == NETDEV_REGISTER) + batman_if = hardif_add_interface(net_dev);
if (!batman_if) goto out;
switch (event) { - case NETDEV_REGISTER: - break; case NETDEV_UP: hardif_activate_interface(soft_device, bat_priv, batman_if); break;
dev_put allows a device to be freed when all its references are dropped. After that we are not allowed to access that information anymore. Access to the data structure of a net_device must be surrounded a dev_hold and ended using dev_put.
batman-adv adds a device to its own management structure in hardif_add_interface and will release it in hardif_remove_interface. Thus it must hold a reference all the time between those functions to prevent any access to the already released net_device structure.
Reported-by: Tim Glaremin Tim.Glaremin@web.de Signed-off-by: Sven Eckelmann sven.eckelmann@gmx.de Cc: stable stable@kernel.org --- drivers/staging/batman-adv/hard-interface.c | 11 ++++++----- 1 files changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/staging/batman-adv/hard-interface.c b/drivers/staging/batman-adv/hard-interface.c index 892166b..d08491e 100644 --- a/drivers/staging/batman-adv/hard-interface.c +++ b/drivers/staging/batman-adv/hard-interface.c @@ -194,8 +194,6 @@ static void hardif_activate_interface(struct net_device *net_dev, if (batman_if->if_status != IF_INACTIVE) return;
- dev_hold(batman_if->net_dev); - update_mac_addresses(batman_if); batman_if->if_status = IF_TO_BE_ACTIVATED;
@@ -222,8 +220,6 @@ static void hardif_deactivate_interface(struct net_device *net_dev, (batman_if->if_status != IF_TO_BE_ACTIVATED)) return;
- dev_put(batman_if->net_dev); - batman_if->if_status = IF_INACTIVE;
bat_info(net_dev, "Interface deactivated: %s\n", batman_if->dev); @@ -318,11 +314,13 @@ static struct batman_if *hardif_add_interface(struct net_device *net_dev) if (ret != 1) goto out;
+ dev_hold(net_dev); + batman_if = kmalloc(sizeof(struct batman_if), GFP_ATOMIC); if (!batman_if) { pr_err("Can't add interface (%s): out of memory\n", net_dev->name); - goto out; + goto release_dev; }
batman_if->dev = kstrdup(net_dev->name, GFP_ATOMIC); @@ -346,6 +344,8 @@ free_dev: kfree(batman_if->dev); free_if: kfree(batman_if); +release_dev: + dev_put(net_dev); out: return NULL; } @@ -374,6 +374,7 @@ static void hardif_remove_interface(struct batman_if *batman_if) batman_if->if_status = IF_TO_BE_REMOVED; list_del_rcu(&batman_if->list); sysfs_del_hardif(&batman_if->hardif_obj); + dev_put(batman_if->net_dev); call_rcu(&batman_if->rcu, hardif_free_interface); }
Each net_device in a system will automatically managed as a possible batman_if and holds different informations like a buffer with a prepared originator messages. To reduce the memory usage, the packet_buff will only be allocated when the interface is really added/enabled for batman-adv.
The function to update the hw address information inside the packet_buff just assumes that the packet_buff is always initialised and thus the kernel will just oops when we try to change the hw address of a not already fully enabled interface.
We must always check if the packet_buff is allocated before we try to change information inside of it.
Reported-by: Tim Glaremin Tim.Glaremin@web.de Reported-by: Kazuki Shimada zukky@bb.banban.jp Signed-off-by: Sven Eckelmann sven.eckelmann@gmx.de Cc: stable stable@kernel.org --- drivers/staging/batman-adv/hard-interface.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/drivers/staging/batman-adv/hard-interface.c b/drivers/staging/batman-adv/hard-interface.c index d08491e..baa8b05 100644 --- a/drivers/staging/batman-adv/hard-interface.c +++ b/drivers/staging/batman-adv/hard-interface.c @@ -129,6 +129,9 @@ static bool hardif_is_iface_up(struct batman_if *batman_if)
static void update_mac_addresses(struct batman_if *batman_if) { + if (!batman_if || !batman_if->packet_buff) + return; + addr_to_string(batman_if->addr_str, batman_if->net_dev->dev_addr);
memcpy(((struct batman_packet *)(batman_if->packet_buff))->orig, @@ -334,6 +337,7 @@ static struct batman_if *hardif_add_interface(struct net_device *net_dev) batman_if->if_num = -1; batman_if->net_dev = net_dev; batman_if->if_status = IF_NOT_IN_USE; + batman_if->packet_buff = NULL; INIT_LIST_HEAD(&batman_if->list);
check_known_mac_addr(batman_if->net_dev->dev_addr);
On Sat, Aug 21, 2010 at 02:18:07PM +0200, Sven Eckelmann wrote:
Hi,
here are patches targeted for 2.6.36. They are smaller bugfixes and add no new features.
I already send you 5 Patches two weeks ago which fixes problems in 2.6.36 and one of them also in 2.6.35, but got no reply till now. So here is the reminder you asked me before.
Sorry about that, they are all queued up now.
thanks,
greg k-h
b.a.t.m.a.n@lists.open-mesh.org
-
Greg KH -
Sven Eckelmann