The annotated tag, batman-adv-fix-for-davem has been deleted
was cf1637a15d200b9b72e924d4884a5689f3b79d99
-----------------------------------------------------------------------
tag batman-adv-fix-for-davem
Included changes:
- fix soft-interface MTU computation
- fix bogus pointer mangling when parsing the TT-TVLV
container. This bug led to a wrong memory access.
- fix memory leak by properly releasing the VLAN object
after CRC check
- properly check pskb_may_pull() return value
- avoid potential race condition while adding new neighbour
- fix potential memory leak by removing all the references
to the orig_node object in case of initialization failure
- fix the TT CRC computation by ensuring that every node uses
the same byte order when hosts with different endianess are
part of the same network
- fix severe memory leak by freeing skb after a successful
TVLV parsing
- avoid potential double free when orig_node initialization
fails
- fix potential kernel paging error caused by the usage of
the old value of skb->data after skb reallocation
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAABCAAGBQJTAj4LAAoJEEKTMo6mOh1VXoQP/2WVjuIrB7rd4mpq5MSXjkWm
qCRRmuU9MVSbwBPvKcNAT4sDb9KliodqMu7jtUNKJ118afTK5VIh1EmbFGIm2vA+
QowpfvSOFaDVrd6pB1bKlPlX5Xi9OF+hj82LalfMRWvsdvQUN00fkCMjyrxPivhR
zq7ucyff1YTft/mSmD+X0gqNK1L99om2xNcWzPjl+CZ0LOBFe411/sWf8Ujldgl0
F6jTPXckNBToukmYO8wwmtG8PFrIWNBRUEfpY/P+VNp+Cg7GF9KOts4mdym9PviI
//PkonRNylfeTvBlztmCdTQB9vHhlT3e/9KTd/lXBQ669Mz/eQ6H1MascDZ8e0Ib
1IeqL6cyOaEDIOh8Bgr2WcRTH/JCx0F0cy+PISJx0DEVYKLWZedm8ECIU9eXWMr6
hnTcBue51IoVbDE5SJ0apoDmQOZZF2euaYBPXtRrziZBzcHubt69rQKOqQ/A5atR
m5kuA7E14NR7F/FOTdKsfLyAVqx9j5mw7NQYAhlbXex0Lp+qQQ9YMtHBv4pgzYA3
UYE9pnuMkr3EXOQ9wAt/ldq+hWBkXDFkg5nd3bzY8aKw5QLBPHZdrTgFtOmVO1RP
Fa7fJSwt2ImCa50w59u4f22U870QK7AYK7xvHeLHbvIzthTDgA71OKRePcRu9EU3
yN6J5h/+A4X7fGgz0Z/X
=6IO8
-----END PGP SIGNATURE-----
70b271a78beba787155d6696aacd7c4d4a251c50 batman-adv: fix potential kernel paging error for unicast transmissions
-----------------------------------------------------------------------
--
linux integration
The annotated tag, v3.15-rc4 has been created
at d75c1fc4bcb7a77ad05a6ade92604781b52cc8c4 (tag)
tagging 89ca3b881987f5a4be4c5dbaa7f0df12bbdde2fd (commit)
replaces v3.15-rc3
tagged by Linus Torvalds
on Sun May 4 18:14:55 2014 -0700
- Shortlog ------------------------------------------------------------
Linux 3.15-rc4
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAABAgAGBQJTZuYPAAoJEHm+PkMAQRiGC/wIAJhgGkofnbEv4x0QEXJuNQOv
rXxId3RQpLQ2PGjJHbrYRvwyK9X7L+JREDJGMyKh8VCMHaYQ1safpI6KII+BvkVb
9FxcledNEB4sDNiShsckG39iBGBAsi2R630XgygLoydfrvNnCrhPB5vi1TbWE37t
xTsaMJxZncSZ6nMsO8w5klVhSOlBPGUp9cVLZhvKTR66eF4JGX3hZHVPwlpZZd2J
ExhxmhnwBATuP3IexRyZ/3/J/zGdJJ9e5JLlEwdLo2hKVgqVosDu7teEucLGzZL1
YdGz7Ndl+Ky9rG/RSuZSCfG7XF5DCroqcDNhT+sqvoTWXU0iunAjFIKavy3CxNA=
=7moZ
-----END PGP SIGNATURE-----
-----------------------------------------------------------------------
--
linux integration
Repository : ssh://git@open-mesh.org/batman-adv
Branch 'master' now includes:
8dbdee5 batman-adv: increase orig refcount when storing ref in gw_node
9fb6f30 Merge branch 'maint' into next
Repository : ssh://git@open-mesh.org/batman-adv
Branch 'next' now includes:
8dbdee5 batman-adv: increase orig refcount when storing ref in gw_node
9fb6f30 Merge branch 'maint' into next
Repository : ssh://git@open-mesh.org/batman-adv
On branch : maint
>---------------------------------------------------------------
commit 8dbdee55810adceecf51548d44da893076c99219
Author: Antonio Quartulli <antonio(a)open-mesh.com>
Date: Fri May 2 01:35:13 2014 +0200
batman-adv: increase orig refcount when storing ref in gw_node
A pointer to the orig_node representing a bat-gateway is
stored in the gw_node->orig_node member, but the refcount
for such orig_node is never increased.
This leads to memory faults when gw_node->orig_node is accessed
and the originator has already been freed.
Fix this by increasing the refcount on gw_node creation
and decreasing it on gw_node free.
Signed-off-by: Antonio Quartulli <antonio(a)open-mesh.com>
Signed-off-by: Marek Lindner <mareklindner(a)neomailbox.ch>
>---------------------------------------------------------------
8dbdee55810adceecf51548d44da893076c99219
gateway_client.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/gateway_client.c b/gateway_client.c
index d7fafc1..d5a40ab 100644
--- a/gateway_client.c
+++ b/gateway_client.c
@@ -42,8 +42,10 @@
static void batadv_gw_node_free_ref(struct batadv_gw_node *gw_node)
{
- if (atomic_dec_and_test(&gw_node->refcount))
+ if (atomic_dec_and_test(&gw_node->refcount)) {
+ batadv_orig_node_free_ref(gw_node->orig_node);
kfree_rcu(gw_node, rcu);
+ }
}
static struct batadv_gw_node *
@@ -406,9 +408,14 @@ static void batadv_gw_node_add(struct batadv_priv *bat_priv,
if (gateway->bandwidth_down == 0)
return;
+ if (!atomic_inc_not_zero(&orig_node->refcount))
+ return;
+
gw_node = kzalloc(sizeof(*gw_node), GFP_ATOMIC);
- if (!gw_node)
+ if (!gw_node) {
+ batadv_orig_node_free_ref(orig_node);
return;
+ }
INIT_HLIST_NODE(&gw_node->list);
gw_node->orig_node = orig_node;
Repository : ssh://git@open-mesh.org/batman-adv
Branch 'master' now includes:
113f264 batman-adv: fix reference counting imbalance while sending fragment
06566d8 Merge branch 'maint' into next