commits September 2018

commits@lists.open-mesh.org

1 participants
50 discussions

[batman-adv] ecsv/pu-maint, maint: batman-adv: fix backbone_gw refcount on queue_work() failure (24d83a5)

by postmaster＠open-mesh.org

Repository : ssh://git@open-mesh.org/batman-adv On branches: ecsv/pu-maint,maint >--------------------------------------------------------------- commit 24d83a50421c1c5d39cd9c015516a1a293ae8d0c Author: Marek Lindner <mareklindner(a)neomailbox.ch> Date: Fri Sep 7 05:45:54 2018 +0800 batman-adv: fix backbone_gw refcount on queue_work() failure The backbone_gw refcounter is to be decreased by the queued work and currently is never decreased if the queue_work() call fails. Fix by checking the queue_work() return value and decrease refcount if necessary. Signed-off-by: Marek Lindner <mareklindner(a)neomailbox.ch> Signed-off-by: Sven Eckelmann <sven(a)narfation.org> >--------------------------------------------------------------- 24d83a50421c1c5d39cd9c015516a1a293ae8d0c net/batman-adv/bridge_loop_avoidance.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c index a2de5a4..58c093c 100644 --- a/net/batman-adv/bridge_loop_avoidance.c +++ b/net/batman-adv/bridge_loop_avoidance.c @@ -1772,6 +1772,7 @@ batadv_bla_loopdetect_check(struct batadv_priv *bat_priv, struct sk_buff *skb, { struct batadv_bla_backbone_gw *backbone_gw; struct ethhdr *ethhdr; + bool ret; ethhdr = eth_hdr(skb); @@ -1795,8 +1796,13 @@ batadv_bla_loopdetect_check(struct batadv_priv *bat_priv, struct sk_buff *skb, if (unlikely(!backbone_gw)) return true; - queue_work(batadv_event_workqueue, &backbone_gw->report_work); - /* backbone_gw is unreferenced in the report work function function */ + ret = queue_work(batadv_event_workqueue, &backbone_gw->report_work); + + /* backbone_gw is unreferenced in the report work function function + * if queue_work() call was successful + */ + if (!ret) + batadv_backbone_gw_put(backbone_gw); return true; }

4 years, 6 months

[batman-adv] ecsv/pu-maint, maint: batman-adv: fix hardif_neigh refcount on queue_work() failure (85100b6)

by postmaster＠open-mesh.org

Repository : ssh://git@open-mesh.org/batman-adv On branches: ecsv/pu-maint,maint >--------------------------------------------------------------- commit 85100b602c127cecf1bcfd620d20eb867d685df2 Author: Marek Lindner <mareklindner(a)neomailbox.ch> Date: Fri Sep 7 05:45:55 2018 +0800 batman-adv: fix hardif_neigh refcount on queue_work() failure The hardif_neigh refcounter is to be decreased by the queued work and currently is never decreased if the queue_work() call fails. Fix by checking the queue_work() return value and decrease refcount if necessary. Signed-off-by: Marek Lindner <mareklindner(a)neomailbox.ch> Signed-off-by: Sven Eckelmann <sven(a)narfation.org> >--------------------------------------------------------------- 85100b602c127cecf1bcfd620d20eb867d685df2 net/batman-adv/bat_v_elp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c index e103c75..9f481cf 100644 --- a/net/batman-adv/bat_v_elp.c +++ b/net/batman-adv/bat_v_elp.c @@ -268,6 +268,7 @@ static void batadv_v_elp_periodic_work(struct work_struct *work) struct batadv_priv *bat_priv; struct sk_buff *skb; u32 elp_interval; + bool ret; bat_v = container_of(work, struct batadv_hard_iface_bat_v, elp_wq.work); hard_iface = container_of(bat_v, struct batadv_hard_iface, bat_v); @@ -329,8 +330,11 @@ static void batadv_v_elp_periodic_work(struct work_struct *work) * may sleep and that is not allowed in an rcu protected * context. Therefore schedule a task for that. */ - queue_work(batadv_event_workqueue, - &hardif_neigh->bat_v.metric_work); + ret = queue_work(batadv_event_workqueue, + &hardif_neigh->bat_v.metric_work); + + if (!ret) + batadv_hardif_neigh_put(hardif_neigh); } rcu_read_unlock();

4 years, 6 months

[batman-adv] maint: batman-adv: fix backbone_gw refcount on queue_work() failure (54b9510)

by postmaster＠open-mesh.org

Repository : ssh://git@open-mesh.org/batman-adv On branch : maint >--------------------------------------------------------------- commit 54b9510bed2f9a89588b507d1b414fdc2d2bfdf0 Author: Marek Lindner <mareklindner(a)neomailbox.ch> Date: Fri Sep 7 05:45:54 2018 +0800 batman-adv: fix backbone_gw refcount on queue_work() failure The backbone_gw refcounter is to be decreased by the queued work and currently is never decreased if the queue_work() call fails. Fix by checking the queue_work() return value and decrease refcount if necessary. Signed-off-by: Marek Lindner <mareklindner(a)neomailbox.ch> >--------------------------------------------------------------- 54b9510bed2f9a89588b507d1b414fdc2d2bfdf0 net/batman-adv/bridge_loop_avoidance.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c index a2de5a4..58c093c 100644 --- a/net/batman-adv/bridge_loop_avoidance.c +++ b/net/batman-adv/bridge_loop_avoidance.c @@ -1772,6 +1772,7 @@ batadv_bla_loopdetect_check(struct batadv_priv *bat_priv, struct sk_buff *skb, { struct batadv_bla_backbone_gw *backbone_gw; struct ethhdr *ethhdr; + bool ret; ethhdr = eth_hdr(skb); @@ -1795,8 +1796,13 @@ batadv_bla_loopdetect_check(struct batadv_priv *bat_priv, struct sk_buff *skb, if (unlikely(!backbone_gw)) return true; - queue_work(batadv_event_workqueue, &backbone_gw->report_work); - /* backbone_gw is unreferenced in the report work function function */ + ret = queue_work(batadv_event_workqueue, &backbone_gw->report_work); + + /* backbone_gw is unreferenced in the report work function function + * if queue_work() call was successful + */ + if (!ret) + batadv_backbone_gw_put(backbone_gw); return true; }

4 years, 6 months

[batman-adv] maint: batman-adv: fix hardif_neigh refcount on queue_work() failure (2cb1b45)

by postmaster＠open-mesh.org

Repository : ssh://git@open-mesh.org/batman-adv On branch : maint >--------------------------------------------------------------- commit 2cb1b45922eeb2a03e2184bc09715441ce82e14b Author: Marek Lindner <mareklindner(a)neomailbox.ch> Date: Fri Sep 7 05:45:55 2018 +0800 batman-adv: fix hardif_neigh refcount on queue_work() failure The hardif_neigh refcounter is to be decreased by the queued work and currently is never decreased if the queue_work() call fails. Fix by checking the queue_work() return value and decrease refcount if necessary. Signed-off-by: Marek Lindner <mareklindner(a)neomailbox.ch> >--------------------------------------------------------------- 2cb1b45922eeb2a03e2184bc09715441ce82e14b net/batman-adv/bat_v_elp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c index e103c75..9f481cf 100644 --- a/net/batman-adv/bat_v_elp.c +++ b/net/batman-adv/bat_v_elp.c @@ -268,6 +268,7 @@ static void batadv_v_elp_periodic_work(struct work_struct *work) struct batadv_priv *bat_priv; struct sk_buff *skb; u32 elp_interval; + bool ret; bat_v = container_of(work, struct batadv_hard_iface_bat_v, elp_wq.work); hard_iface = container_of(bat_v, struct batadv_hard_iface, bat_v); @@ -329,8 +330,11 @@ static void batadv_v_elp_periodic_work(struct work_struct *work) * may sleep and that is not allowed in an rcu protected * context. Therefore schedule a task for that. */ - queue_work(batadv_event_workqueue, - &hardif_neigh->bat_v.metric_work); + ret = queue_work(batadv_event_workqueue, + &hardif_neigh->bat_v.metric_work); + + if (!ret) + batadv_hardif_neigh_put(hardif_neigh); } rcu_read_unlock();

4 years, 6 months

[batman-adv] master: Merge branch 'maint' (b2eab52)

by postmaster＠open-mesh.org

Repository : ssh://git@open-mesh.org/batman-adv On branch : master >--------------------------------------------------------------- commit b2eab521243265eb00877524ee41344c002223b0 Merge: 89dcbd5 848be98 Author: Sven Eckelmann <sven(a)narfation.org> Date: Wed Sep 5 18:01:28 2018 +0200 Merge branch 'maint' >--------------------------------------------------------------- b2eab521243265eb00877524ee41344c002223b0 net/batman-adv/bat_v_elp.c | 2 +- net/batman-adv/sysfs.c | 30 ++++++++++++++++++++---------- 2 files changed, 21 insertions(+), 11 deletions(-)

4 years, 6 months

[batman-adv] master's head updated: Merge branch 'maint' (b2eab52)

by postmaster＠open-mesh.org

Repository : ssh://git@open-mesh.org/batman-adv Branch 'master' now includes: 6c876e5 batman-adv: Avoid probe ELP information leak ddf99b7 batman-adv: Fix segfault when writing to throughput_override 848be98 batman-adv: Fix segfault when writing to sysfs elp_interval b2eab52 Merge branch 'maint'

4 years, 6 months

[batman-adv] maint: batman-adv: Fix segfault when writing to throughput_override (ddf99b7)

by postmaster＠open-mesh.org

Repository : ssh://git@open-mesh.org/batman-adv On branch : maint >--------------------------------------------------------------- commit ddf99b78e255530cbadc0f67656a549e19520280 Author: Sven Eckelmann <sven(a)narfation.org> Date: Fri Aug 31 16:46:47 2018 +0200 batman-adv: Fix segfault when writing to throughput_override The per hardif sysfs file "batman_adv/throughput_override" prints the resulting change as info text when the users writes to this file. It uses the helper function batadv_info to add it at the same time to the kernel ring buffer and to the batman-adv debug log (when CONFIG_BATMAN_ADV_DEBUG is enabled). The function batadv_info requires as first parameter the batman-adv softif net_device. This parameter is then used to find the private buffer which contains the debug log for this batman-adv interface. But batadv_store_throughput_override used as first argument the slave net_device. This slave device doesn't have the batadv_priv private data which is access by batadv_info. Writing to this file with CONFIG_BATMAN_ADV_DEBUG enabled can either lead to a segfault or to memory corruption. Fixes: c513176e4b7a ("batman-adv: add throughput override attribute to hard_ifaces") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Acked-by: Marek Lindner <mareklindner(a)neomailbox.ch> >--------------------------------------------------------------- ddf99b78e255530cbadc0f67656a549e19520280 net/batman-adv/sysfs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/batman-adv/sysfs.c b/net/batman-adv/sysfs.c index f2eef43..3a76e89 100644 --- a/net/batman-adv/sysfs.c +++ b/net/batman-adv/sysfs.c @@ -1090,8 +1090,9 @@ static ssize_t batadv_store_throughput_override(struct kobject *kobj, if (old_tp_override == tp_override) goto out; - batadv_info(net_dev, "%s: Changing from: %u.%u MBit to: %u.%u MBit\n", - "throughput_override", + batadv_info(hard_iface->soft_iface, + "%s: %s: Changing from: %u.%u MBit to: %u.%u MBit\n", + "throughput_override", net_dev->name, old_tp_override / 10, old_tp_override % 10, tp_override / 10, tp_override % 10);

4 years, 6 months

[batman-adv] maint: batman-adv: Fix segfault when writing to sysfs elp_interval (848be98)

by postmaster＠open-mesh.org

Repository : ssh://git@open-mesh.org/batman-adv On branch : maint >--------------------------------------------------------------- commit 848be9859b0109a6e428f92f21f2e660153b1c75 Author: Sven Eckelmann <sven(a)narfation.org> Date: Fri Aug 31 16:56:29 2018 +0200 batman-adv: Fix segfault when writing to sysfs elp_interval The per hardif sysfs file "batman_adv/elp_interval" is using the generic functions to store/show uint values. The helper __batadv_store_uint_attr requires the softif net_device as parameter to print the resulting change as info text when the users writes to this file. It uses the helper function batadv_info to add it at the same time to the kernel ring buffer and to the batman-adv debug log (when CONFIG_BATMAN_ADV_DEBUG is enabled). The function batadv_info requires as first parameter the batman-adv softif net_device. This parameter is then used to find the private buffer which contains the debug log for this batman-adv interface. But batadv_store_throughput_override used as first argument the slave net_device. This slave device doesn't have the batadv_priv private data which is access by batadv_info. Writing to this file with CONFIG_BATMAN_ADV_DEBUG enabled can either lead to a segfault or to memory corruption. Fixes: ec46535b8275 ("batman-adv: Add hard_iface specific sysfs wrapper macros for UINT") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Acked-by: Marek Lindner <mareklindner(a)neomailbox.ch> >--------------------------------------------------------------- 848be9859b0109a6e428f92f21f2e660153b1c75 net/batman-adv/sysfs.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/net/batman-adv/sysfs.c b/net/batman-adv/sysfs.c index 3a76e89..09427fc 100644 --- a/net/batman-adv/sysfs.c +++ b/net/batman-adv/sysfs.c @@ -188,7 +188,8 @@ ssize_t batadv_store_##_name(struct kobject *kobj, \ \ return __batadv_store_uint_attr(buff, count, _min, _max, \ _post_func, attr, \ - &bat_priv->_var, net_dev); \ + &bat_priv->_var, net_dev, \ + NULL); \ } #define BATADV_ATTR_SIF_SHOW_UINT(_name, _var) \ @@ -262,7 +263,9 @@ ssize_t batadv_store_##_name(struct kobject *kobj, \ \ length = __batadv_store_uint_attr(buff, count, _min, _max, \ _post_func, attr, \ - &hard_iface->_var, net_dev); \ + &hard_iface->_var, \ + hard_iface->soft_iface, \ + net_dev); \ \ batadv_hardif_put(hard_iface); \ return length; \ @@ -356,10 +359,12 @@ __batadv_store_bool_attr(char *buff, size_t count, static int batadv_store_uint_attr(const char *buff, size_t count, struct net_device *net_dev, + struct net_device *slave_dev, const char *attr_name, unsigned int min, unsigned int max, atomic_t *attr) { + char ifname[IFNAMSIZ + 3] = ""; unsigned long uint_val; int ret; @@ -385,8 +390,11 @@ static int batadv_store_uint_attr(const char *buff, size_t count, if (atomic_read(attr) == uint_val) return count; - batadv_info(net_dev, "%s: Changing from: %i to: %lu\n", - attr_name, atomic_read(attr), uint_val); + if (slave_dev) + snprintf(ifname, sizeof(ifname), "%s: ", slave_dev->name); + + batadv_info(net_dev, "%s: %sChanging from: %i to: %lu\n", + attr_name, ifname, atomic_read(attr), uint_val); atomic_set(attr, uint_val); return count; @@ -397,12 +405,13 @@ static ssize_t __batadv_store_uint_attr(const char *buff, size_t count, void (*post_func)(struct net_device *), const struct attribute *attr, atomic_t *attr_store, - struct net_device *net_dev) + struct net_device *net_dev, + struct net_device *slave_dev) { int ret; - ret = batadv_store_uint_attr(buff, count, net_dev, attr->name, min, max, - attr_store); + ret = batadv_store_uint_attr(buff, count, net_dev, slave_dev, + attr->name, min, max, attr_store); if (post_func && ret) post_func(net_dev); @@ -571,7 +580,7 @@ static ssize_t batadv_store_gw_sel_class(struct kobject *kobj, return __batadv_store_uint_attr(buff, count, 1, BATADV_TQ_MAX_VALUE, batadv_post_gw_reselect, attr, &bat_priv->gw.sel_class, - bat_priv->soft_iface); + bat_priv->soft_iface, NULL); } static ssize_t batadv_show_gw_bwidth(struct kobject *kobj,

4 years, 6 months

[batman-adv] maint: batman-adv: Avoid probe ELP information leak (6c876e5)

by postmaster＠open-mesh.org

Repository : ssh://git@open-mesh.org/batman-adv On branch : maint >--------------------------------------------------------------- commit 6c876e572f592c31132a55b5fb8427e168e5fb3c Author: Sven Eckelmann <sven(a)narfation.org> Date: Fri Aug 31 15:08:44 2018 +0200 batman-adv: Avoid probe ELP information leak The probe ELPs for WiFi interfaces are expanded to contain at least BATADV_ELP_MIN_PROBE_SIZE bytes. This is usually a lot more than the number of bytes which the template ELP packet requires. These extra padding bytes were not initialized and thus could contain data which were previously stored at the same location. It is therefore required to set it to some predefined or random values to avoid leaking private information from the system transmitting these kind of packets. Fixes: bedcadfaa92b ("batman-adv: ELP - send unicast ELP packets for throughput sampling") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Acked-by: Antonio Quartulli <a(a)unstable.cc> >--------------------------------------------------------------- 6c876e572f592c31132a55b5fb8427e168e5fb3c net/batman-adv/bat_v_elp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c index 71c20c1..e103c75 100644 --- a/net/batman-adv/bat_v_elp.c +++ b/net/batman-adv/bat_v_elp.c @@ -241,7 +241,7 @@ batadv_v_elp_wifi_neigh_probe(struct batadv_hardif_neigh_node *neigh) * the packet to be exactly of that size to make the link * throughput estimation effective. */ - skb_put(skb, probe_len - hard_iface->bat_v.elp_skb->len); + skb_put_zero(skb, probe_len - hard_iface->bat_v.elp_skb->len); batadv_dbg(BATADV_DBG_BATMAN, bat_priv, "Sending unicast (probe) ELP packet on interface %s to %pM\n",

4 years, 6 months

[linux-merge]linux integration; annotated tag, v4.19-rc2, created. v4.19-rc2

by postmaster＠open-mesh.org

The annotated tag, v4.19-rc2 has been created at f703a4f77147a05a73d889992bd6b02a152d84d6 (tag) tagging 57361846b52bc686112da6ca5368d11210796804 (commit) replaces v4.19-rc1 tagged by Linus Torvalds on Sun Sep 2 14:37:39 2018 -0700 - Shortlog ------------------------------------------------------------ Linux 4.19-rc2 -----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAluMWCMeHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGZjoH+wbEQcuzTDQGRkFG zP8VTf4tWkRc9cBAaoWfcO7vvnpFshUj4Ebdk2Nhd4NXELXQmuJBTva25tN92wzu B4cUSnTWaSkGnJHLS0V+Z1zTCPXlUgmi0mcg+dQkoHiMPTb/HVaFocHObhQdvGpx 3mJisvm/MvsrT8HX92BhSe6N6rqJ4kVdRxd5TQtVTrrJtKjbWIfkfQoNiJPeapTV 14J+c6sGyVlUUnOQ5NcV/MBxvChn+AoyB0mp22L7t1IPVwv6Spz7ZPAzzyQ/WUB/ qAAvClc3cifE8KdQj4MkxThnAfuC3Q5Ifu2+EtXmBRPFFnj/nO4gJDkADj6WRxKT 7SJE5RI= =P+RK -----END PGP SIGNATURE----- ----------------------------------------------------------------------- -- linux integration

4 years, 6 months

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

commits September 2018