Repository : ssh://git@open-mesh.org/batman-adv
On branch : maint
>---------------------------------------------------------------
commit 789b846af6a9471982b181687a1cba8dc996b269
Author: Sven Eckelmann <sven.eckelmann(a)open-mesh.com>
Date: Tue Feb 16 10:47:07 2016 +0100
batman-adv: Fix integer overflow in batadv_iv_ogm_calc_tq
The undefined behavior sanatizer detected an signed integer overflow in a
setup with near perfect link quality
UBSAN: Undefined behaviour in net/batman-adv/bat_iv_ogm.c:1246:25
signed integer overflow:
8713350 * 255 cannot be represented in type 'int'
The problems happens because the calculation of mixed unsigned and signed
integers resulted in an integer multiplication.
batadv_ogm_packet::tq (u8 255)
* tq_own (u8 255)
* tq_asym_penalty (int 134; max 255)
* tq_iface_penalty (int 255; max 255)
The tq_iface_penalty, tq_asym_penalty and inv_asym_penalty can just be
changed to unsigned int because they are not expected to become negative.
Fixes: 46e44fdb96ef ("batman-adv: add WiFi penalty")
Signed-off-by: Sven Eckelmann <sven.eckelmann(a)open-mesh.com>
Signed-off-by: Marek Lindner <mareklindner(a)neomailbox.ch>
>---------------------------------------------------------------
789b846af6a9471982b181687a1cba8dc996b269
net/batman-adv/bat_iv_ogm.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index ea553fe..da0ad2b 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -1137,9 +1137,10 @@ static int batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node,
u8 total_count;
u8 orig_eq_count, neigh_rq_count, neigh_rq_inv, tq_own;
unsigned int neigh_rq_inv_cube, neigh_rq_max_cube;
- int tq_asym_penalty, inv_asym_penalty, if_num, ret = 0;
+ int if_num, ret = 0;
+ unsigned int tq_asym_penalty, inv_asym_penalty;
unsigned int combined_tq;
- int tq_iface_penalty;
+ unsigned int tq_iface_penalty;
/* find corresponding one hop neighbor */
rcu_read_lock();
Repository : ssh://git@open-mesh.org/batman-adv
On branch : master
>---------------------------------------------------------------
commit fb633a44e5b6f316028de5c59676e6dc9466895f
Author: Sven Eckelmann <sven(a)narfation.org>
Date: Mon Feb 22 18:55:32 2016 +0100
batman-adv: Fix kerneldoc for batadv_compare_claim
Signed-off-by: Sven Eckelmann <sven(a)narfation.org>
Signed-off-by: Marek Lindner <mareklindner(a)neomailbox.ch>
>---------------------------------------------------------------
fb633a44e5b6f316028de5c59676e6dc9466895f
net/batman-adv/bridge_loop_avoidance.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index 0a6c8b8..ac42504 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -120,7 +120,7 @@ static int batadv_compare_backbone_gw(const struct hlist_node *node,
}
/**
- * batadv_compare_backbone_gw - compare address and vid of two claims
+ * batadv_compare_claim - compare address and vid of two claims
* @node: list node of the first entry to compare
* @data2: pointer to the second claims
*
Repository : ssh://git@open-mesh.org/batman-adv
On branch : master
>---------------------------------------------------------------
commit 1c5fc73b460154bc49ef28a4ab895e8666b72f9d
Author: Sven Eckelmann <sven(a)narfation.org>
Date: Mon Feb 22 22:56:34 2016 +0100
batman-adv: Split batadv_iv_ogm_orig_del_if function
batadv_iv_ogm_orig_del_if handles two different buffers bcast_own and
bcast_own_sum which should be resized. The error handling two for
allocating these buffers causes the complexity of this function. This can
be avoided completely when the function is split into a main function
handling the locking, freeing and call of the subfunctions.
The subfunction can then independently handle the resize of the buffers.
This also allows to easily reuse the old buffer (which always is larger) in
case a smaller buffer could not be allocated without increasing the code
complexity.
Signed-off-by: Sven Eckelmann <sven(a)narfation.org>
Signed-off-by: Marek Lindner <mareklindner(a)neomailbox.ch>
>---------------------------------------------------------------
1c5fc73b460154bc49ef28a4ab895e8666b72f9d
net/batman-adv/bat_iv_ogm.c | 115 +++++++++++++++++++++++++++++---------------
1 file changed, 76 insertions(+), 39 deletions(-)
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index af8bd86..a7d5cc4 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -32,6 +32,7 @@
#include <linux/jiffies.h>
#include <linux/list.h>
#include <linux/kref.h>
+#include <linux/lockdep.h>
#include <linux/netdevice.h>
#include <linux/pkt_sched.h>
#include <linux/printk.h>
@@ -173,71 +174,107 @@ unlock:
}
/**
- * batadv_iv_ogm_orig_del_if - change the private structures of the orig_node to
- * exclude the removed interface
+ * batadv_iv_ogm_drop_bcast_own_entry - drop section of bcast_own
* @orig_node: the orig_node that has to be changed
* @max_if_num: the current amount of interfaces
* @del_if_num: the index of the interface being removed
- *
- * Return: 0 on success, a negative error code otherwise.
*/
-static int batadv_iv_ogm_orig_del_if(struct batadv_orig_node *orig_node,
- int max_if_num, int del_if_num)
+static void
+batadv_iv_ogm_drop_bcast_own_entry(struct batadv_orig_node *orig_node,
+ int max_if_num, int del_if_num)
{
- int ret = -ENOMEM;
- size_t chunk_size, if_offset;
- void *data_ptr = NULL;
-
- spin_lock_bh(&orig_node->bat_iv.ogm_cnt_lock);
+ size_t chunk_size;
+ size_t if_offset;
+ void *data_ptr;
- /* last interface was removed */
- if (max_if_num == 0)
- goto free_bcast_own;
+ lockdep_assert_held(&orig_node->bat_iv.ogm_cnt_lock);
chunk_size = sizeof(unsigned long) * BATADV_NUM_WORDS;
data_ptr = kmalloc_array(max_if_num, chunk_size, GFP_ATOMIC);
if (!data_ptr)
- goto unlock;
+ /* use old buffer when new one could not be allocated */
+ data_ptr = orig_node->bat_iv.bcast_own;
/* copy first part */
- memcpy(data_ptr, orig_node->bat_iv.bcast_own, del_if_num * chunk_size);
+ memmove(data_ptr, orig_node->bat_iv.bcast_own, del_if_num * chunk_size);
/* copy second part */
if_offset = (del_if_num + 1) * chunk_size;
- memcpy((char *)data_ptr + del_if_num * chunk_size,
- (uint8_t *)orig_node->bat_iv.bcast_own + if_offset,
- (max_if_num - del_if_num) * chunk_size);
+ memmove((char *)data_ptr + del_if_num * chunk_size,
+ (uint8_t *)orig_node->bat_iv.bcast_own + if_offset,
+ (max_if_num - del_if_num) * chunk_size);
-free_bcast_own:
- kfree(orig_node->bat_iv.bcast_own);
- orig_node->bat_iv.bcast_own = data_ptr;
+ /* bcast_own was shrunk down in new buffer; free old one */
+ if (orig_node->bat_iv.bcast_own != data_ptr) {
+ kfree(orig_node->bat_iv.bcast_own);
+ orig_node->bat_iv.bcast_own = data_ptr;
+ }
+}
+
+/**
+ * batadv_iv_ogm_drop_bcast_own_sum_entry - drop section of bcast_own_sum
+ * @orig_node: the orig_node that has to be changed
+ * @max_if_num: the current amount of interfaces
+ * @del_if_num: the index of the interface being removed
+ */
+static void
+batadv_iv_ogm_drop_bcast_own_sum_entry(struct batadv_orig_node *orig_node,
+ int max_if_num, int del_if_num)
+{
+ size_t if_offset;
+ void *data_ptr;
- if (max_if_num == 0)
- goto free_own_sum;
+ lockdep_assert_held(&orig_node->bat_iv.ogm_cnt_lock);
data_ptr = kmalloc_array(max_if_num, sizeof(u8), GFP_ATOMIC);
- if (!data_ptr) {
- kfree(orig_node->bat_iv.bcast_own);
- goto unlock;
- }
+ if (!data_ptr)
+ /* use old buffer when new one could not be allocated */
+ data_ptr = orig_node->bat_iv.bcast_own_sum;
- memcpy(data_ptr, orig_node->bat_iv.bcast_own_sum,
- del_if_num * sizeof(u8));
+ memmove(data_ptr, orig_node->bat_iv.bcast_own_sum,
+ del_if_num * sizeof(u8));
if_offset = (del_if_num + 1) * sizeof(u8);
- memcpy((char *)data_ptr + del_if_num * sizeof(u8),
- orig_node->bat_iv.bcast_own_sum + if_offset,
- (max_if_num - del_if_num) * sizeof(u8));
+ memmove((char *)data_ptr + del_if_num * sizeof(u8),
+ orig_node->bat_iv.bcast_own_sum + if_offset,
+ (max_if_num - del_if_num) * sizeof(u8));
+
+ /* bcast_own_sum was shrunk down in new buffer; free old one */
+ if (orig_node->bat_iv.bcast_own_sum != data_ptr) {
+ kfree(orig_node->bat_iv.bcast_own_sum);
+ orig_node->bat_iv.bcast_own_sum = data_ptr;
+ }
+}
-free_own_sum:
- kfree(orig_node->bat_iv.bcast_own_sum);
- orig_node->bat_iv.bcast_own_sum = data_ptr;
+/**
+ * batadv_iv_ogm_orig_del_if - change the private structures of the orig_node to
+ * exclude the removed interface
+ * @orig_node: the orig_node that has to be changed
+ * @max_if_num: the current amount of interfaces
+ * @del_if_num: the index of the interface being removed
+ *
+ * Return: 0 on success, a negative error code otherwise.
+ */
+static int batadv_iv_ogm_orig_del_if(struct batadv_orig_node *orig_node,
+ int max_if_num, int del_if_num)
+{
+ spin_lock_bh(&orig_node->bat_iv.ogm_cnt_lock);
+
+ if (max_if_num == 0) {
+ kfree(orig_node->bat_iv.bcast_own);
+ kfree(orig_node->bat_iv.bcast_own_sum);
+ orig_node->bat_iv.bcast_own = NULL;
+ orig_node->bat_iv.bcast_own_sum = NULL;
+ } else {
+ batadv_iv_ogm_drop_bcast_own_entry(orig_node, max_if_num,
+ del_if_num);
+ batadv_iv_ogm_drop_bcast_own_sum_entry(orig_node, max_if_num,
+ del_if_num);
+ }
- ret = 0;
-unlock:
spin_unlock_bh(&orig_node->bat_iv.ogm_cnt_lock);
- return ret;
+ return 0;
}
/**
Repository : ssh://git@open-mesh.org/batman-adv
Branch 'next' now includes:
32bcb3f batman-adv: Fix unexpected free of bcast_own on add_if error
7028cda Merge branch 'maint' into next
Repository : ssh://git@open-mesh.org/batman-adv
On branch : maint
>---------------------------------------------------------------
commit 32bcb3f6e3cf92d9c1d19f0d254c094c119da811
Author: Sven Eckelmann <sven(a)narfation.org>
Date: Mon Feb 22 22:56:33 2016 +0100
batman-adv: Fix unexpected free of bcast_own on add_if error
The function batadv_iv_ogm_orig_add_if allocates new buffers for bcast_own
and bcast_own_sum. It is expected that these buffers are unchanged in case
either bcast_own or bcast_own_sum couldn't be resized.
But the error handling of this function frees the already resized buffer
for bcast_own when the allocation of the new bcast_own_sum buffer failed.
This will lead to an invalid memory access when some code will try to
access bcast_own.
Instead the resized new bcast_own buffer has to be kept. This will not lead
to problems because the size of the buffer was only increased and therefore
no user of the buffer will try to access bytes outside of the new buffer.
Fixes: fdafa7d29ace ("batman-adv: provide orig_node routing API")
Signed-off-by: Sven Eckelmann <sven(a)narfation.org>
Signed-off-by: Marek Lindner <mareklindner(a)neomailbox.ch>
>---------------------------------------------------------------
32bcb3f6e3cf92d9c1d19f0d254c094c119da811
net/batman-adv/bat_iv_ogm.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index a6d389b..ea553fe 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -155,10 +155,8 @@ static int batadv_iv_ogm_orig_add_if(struct batadv_orig_node *orig_node,
orig_node->bat_iv.bcast_own = data_ptr;
data_ptr = kmalloc_array(max_if_num, sizeof(u8), GFP_ATOMIC);
- if (!data_ptr) {
- kfree(orig_node->bat_iv.bcast_own);
+ if (!data_ptr)
goto unlock;
- }
memcpy(data_ptr, orig_node->bat_iv.bcast_own_sum,
(max_if_num - 1) * sizeof(u8));
The annotated tag, batman-adv-for-davem has been updated
to 729c9ad6857576ac60775c7941d90b133b4b6753 (tag)
from 439dc0ded49c1c791e00c7fc0fdfb43690f97e38 (which is now obsolete)
tagging a6ec09d4aa5730ec1812d0986f28b23aa6893d7e (commit)
replaces v4.5-rc5
tagged by Antonio Quartulli
on Sun Feb 28 04:03:20 2016 +0800
- Shortlog ------------------------------------------------------------
With this patchset we finally introduce our new routing protocol:
B.A.T.M.A.N. V. Its implementation started quite some years ago,
but due to the big changes being introduced it took a while to be
discussed, designed, worked, re-worked, tested and debugged (well,
we're never done with the latest). Such work has basically seen
involved all the core contributors: namely Linus Lüssing, Marek
Lindner, Simon Wunderlich, Sven Eckelmann and me.
The new protocol is divided into two main subcomponents, called
respectively ELP and OGMv2. The former is in charge of
dealing with the neighbour discovery and link quality estimation,
while the latter implements the algorithm that spreads the
metrics around the network and computes optimal paths.
The biggest change introduced with B.A.T.M.A.N. V is the new
metric: the protocol won't rely on packet loss anymore, but it
will use the estimated throughput extracted directly from the
wifi driver (when available) by querying cfg80211.
Batman-adv will also send some unicast probing packets when
an interface is not used for payload traffic to make sure that
such values are current.
The new protocol can be compiled-in or not like other
features we have and when selected will pull in CFG80211 as
dependency for the reason described above.
Thanks to the big work brought up in the past by Marek Lindner,
batman-adv can easily deal several protocol implementations,
therefore compiling in this new version does not exclude the
older.
This means that the user is offered the option to choose
the protocol when creating the mesh interface (default is the
old one to keep backward compatibility).
Along with the protocol there are some sysfs knobs that are
introduced to fine tune some of its behaviours, but users
are recommended to keep the default values unless they know
what they are doing.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAABCAAGBQJW0gEKAAoJENpFlCjNi1MRwAEP/RB62KOdK7Ka1EOnGsf+HAA1
niKgxqoTnrWPAEbCOU6vxqzYE3xHiDxo6vqcENrq6Vs9ONvtWcBLi6ibd2PVjXPi
JoIUuWEhttC8AFqr8EJFuMgYDpngmwNgeuLhVyYjwAyWxqnFIvFIs9PgygOeG9Fj
pL56oQVuxLKhelRSPiC+dY/zqiMyZLcK8VbNgqoGh87PG+zv6oaUdh4s83JNDz6m
OOslwWzCdRxGlpxKcQBG+Vq3IL4Vxrw6wcDxl5CuAvFGH4bf5RR5wMr5rHQikhCp
YBUZXjXg7JOiHHKUZhC8Q3NSEBmZpkFUwQ/Pc8IJDCLhdC7lv0tA4kxZt1GBUgeY
cZ13eV1M0v0F/+tC+aBU/9/OyAH4K5IyNDM1Emnz7ce3LBZWZZPSdUVO9MbyEPV2
WHzIlevRjQKmujXdSGxvLTkt0DrcETYIXxNxhbeU9nV4zYTOS/RtUS+lGQ+QXosw
VOhTtYll+fQo2cpcNDvRC18I3vKmBveGbTQG4N4o8IKZTfQZRpkstPqyGVnsfm5H
j55AyWE8mpE2XojvjrDBLresZPc4sodaDQ9z0hzrT9YENM0KhGPg4rgEe8keHHDk
xK1MSwwIUSAnezGmg4+ppyDZguKwWSOh+5VYLVy6ERgi/qlh+cUftSCPhTlIpPjg
J33tC0JinJaifRF2b/2a
=Y4q3
-----END PGP SIGNATURE-----
Andrew Lunn (1):
batman-adv: Avoid endless loop in bat-on-bat netdevice check
Antonio Quartulli (12):
batman-adv: fix kerneldoc for DAT functions
batman-adv: fix kerneldoc for TT functions
batman-adv: add kernel doc for AP isolation attributes in bat_priv
batman-adv: remove unused BATADV_BONDING_TQ_THRESHOLD constant
batman-adv: OGMv2 - add basic infrastructure
batman-adv: OGMv2 - implement originators logic
batman-adv: add throughput override attribute to hard_ifaces
batman-adv: keep track of when unicast packets are sent
batman-adv: ELP - compute the metric based on the estimated throughput
batman-adv: ELP - send unicast ELP packets for throughput sampling
batman-adv: B.A.T.M.A.N. V - implement neighbor comparison API calls
batman-adv: B.A.T.M.A.N. V - implement bat_orig_print API
David S. Miller (4):
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Linus Luessing (5):
batman-adv: Add hard_iface specific sysfs wrapper macros for UINT
batman-adv: ELP - adding basic infrastructure
batman-adv: ELP - creating neighbor structures
batman-adv: ELP - adding sysfs parameter for elp interval
batman-adv: B.A.T.M.A.N. V - implement bat_neigh_print API
Marek Lindner (1):
batman-adv: kernel doc readability updates
Simon Wunderlich (4):
batman-adv: Update/repair bridge loop avoidance kerneldoc
batman-adv: add kerneldoc for batadv_iv_ogm_aggr_packet
batman-adv: add seqno maximum age and protection start flag parameters
batman-adv: Start new development cycle
Sven Eckelmann (51):
batman-adv: Fix kerneldoc parsing of structs/enums
batman-adv: Remove kerneldoc for missing parameters
batman-adv: Fix names in kerneldoc of functions
batman-adv: Drop invalid kerneldoc for variable batadv_vlan_attrs
batman-adv: Fix kerneldoc parsing of return description
batman-adv: Fix kerneldoc of main functions
batman-adv: Fix kerneldoc of network-coding functions
batman-adv: Fix kernel-doc for batadv_claim_free_ref
batman-adv: update copyright years for 2016
batman-adv: Switch to HTTPS version of links
batman-adv: Drop reference to netdevice on last reference
batman-adv: Add lockdep assert for container_list_lock
batman-adv: Convert batadv_hardif_neigh_node to kref
batman-adv: Convert batadv_gw_node to kref
batman-adv: Convert batadv_softif_vlan to kref
batman-adv: Convert batadv_bla_backbone_gw to kref
batman-adv: Convert batadv_bla_claim to kref
batman-adv: Convert batadv_nc_node to kref
batman-adv: Convert batadv_nc_path to kref
batman-adv: Convert batadv_dat_entry to kref
batman-adv: Convert batadv_tvlv_container to kref
batman-adv: Convert batadv_tvlv_handler to kref
batman-adv: Convert batadv_tt_orig_list_entry to kref
batman-adv: Convert batadv_neigh_ifinfo to kref
batman-adv: Convert batadv_orig_ifinfo to kref
batman-adv: Convert batadv_neigh_node to kref
batman-adv: Convert batadv_hard_iface to kref
batman-adv: Convert batadv_orig_node_vlan to kref
batman-adv: Convert batadv_orig_node to kref
batman-adv: Convert batadv_tt_common_entry to kref
batman-adv: Only put gw_node list reference when removed
batman-adv: Only put orig_node_vlan list reference when removed
batman-adv: Rename batadv_orig_node *_free_ref function to *_put
batman-adv: Rename batadv_hardif *_free_ref function to *_put
batman-adv: Rename batadv_neigh_node *_free_ref function to *_put
batman-adv: Rename batadv_neigh_ifinfo *_free_ref function to *_put
batman-adv: Rename batadv_orig_ifinfo *_free_ref function to *_put
batman-adv: Rename batadv_hardif_neigh *_free_ref function to *_put
batman-adv: Rename batadv_backbone_gw *_free_ref function to *_put
batman-adv: Rename batadv_claim *_free_ref function to *_put
batman-adv: Rename batadv_dat_entry *_free_ref function to *_put
batman-adv: Rename batadv_gw_node *_free_ref function to *_put
batman-adv: Rename batadv_tvlv_handler *_free_ref function to *_put
batman-adv: Rename batadv_tvlv_container *_free_ref function to *_put
batman-adv: Rename batadv_softif_vlan *_free_ref function to *_put
batman-adv: Rename batadv_nc_node *_free_ref function to *_put
batman-adv: Rename batadv_nc_path *_free_ref function to *_put
batman-adv: Rename batadv_orig_node_vlan *_free_ref function to *_put
batman-adv: Rename batadv_tt_local_entry *_free_ref function to *_put
batman-adv: Rename batadv_tt_global_entry *_free_ref function to *_put
batman-adv: Rename batadv_tt_orig_list_entry *_free_ref function to *_put
-----------------------------------------------------------------------
--
linux integration