commits October 2019

commits@lists.open-mesh.org

1 participants
54 discussions

[batman-adv] master: Merge branch 'maint' (888f60e5)

by postmaster＠open-mesh.org

Repository : ssh://git@open-mesh.org/batman-adv On branch : master >--------------------------------------------------------------- commit 888f60e567994e4d11058d14c59a5275942f4a78 Merge: ab636a2b 9b8ceef2 Author: Sven Eckelmann <sven(a)narfation.org> Date: Fri Oct 11 14:49:29 2019 +0200 Merge branch 'maint' >--------------------------------------------------------------- 888f60e567994e4d11058d14c59a5275942f4a78 net/batman-adv/bat_iv_ogm.c | 33 +++++++++++++++++++++++++++------ net/batman-adv/bat_v_ogm.c | 32 +++++++++++++++++++++++++------- net/batman-adv/types.h | 8 ++++---- 3 files changed, 56 insertions(+), 17 deletions(-) diff --cc net/batman-adv/bat_v_ogm.c index dc4f7430,034bdc5e..24d00a97 --- a/net/batman-adv/bat_v_ogm.c +++ b/net/batman-adv/bat_v_ogm.c @@@ -22,9 -21,9 +22,10 @@@ #include <linux/random.h> #include <linux/rculist.h> #include <linux/rcupdate.h> + #include <linux/rtnetlink.h> #include <linux/skbuff.h> #include <linux/slab.h> +#include <linux/spinlock.h> #include <linux/stddef.h> #include <linux/string.h> #include <linux/types.h> @@@ -131,139 -116,13 +132,137 @@@ static void batadv_v_ogm_send_to_if(str batadv_send_broadcast_skb(skb, hard_iface); } +/** + * batadv_v_ogm_len() - OGMv2 packet length + * @skb: the OGM to check + * + * Return: Length of the given OGMv2 packet, including tvlv length, excluding + * ethernet header length. + */ +static unsigned int batadv_v_ogm_len(struct sk_buff *skb) +{ + struct batadv_ogm2_packet *ogm_packet; + + ogm_packet = (struct batadv_ogm2_packet *)skb->data; + return BATADV_OGM2_HLEN + ntohs(ogm_packet->tvlv_len); +} + +/** + * batadv_v_ogm_queue_left() - check if given OGM still fits aggregation queue + * @skb: the OGM to check + * @hard_iface: the interface to use to send the OGM + * + * Caller needs to hold the hard_iface->bat_v.aggr_list_lock. + * + * Return: True, if the given OGMv2 packet still fits, false otherwise. + */ +static bool batadv_v_ogm_queue_left(struct sk_buff *skb, + struct batadv_hard_iface *hard_iface) +{ + unsigned int max = min_t(unsigned int, hard_iface->net_dev->mtu, + BATADV_MAX_AGGREGATION_BYTES); + unsigned int ogm_len = batadv_v_ogm_len(skb); + + lockdep_assert_held(&hard_iface->bat_v.aggr_list_lock); + + return hard_iface->bat_v.aggr_len + ogm_len <= max; +} + +/** + * batadv_v_ogm_aggr_list_free - free all elements in an aggregation queue + * @hard_iface: the interface holding the aggregation queue + * + * Empties the OGMv2 aggregation queue and frees all the skbs it contained. + * + * Caller needs to hold the hard_iface->bat_v.aggr_list_lock. + */ +static void batadv_v_ogm_aggr_list_free(struct batadv_hard_iface *hard_iface) +{ + struct sk_buff *skb; + + lockdep_assert_held(&hard_iface->bat_v.aggr_list_lock); + + while ((skb = skb_dequeue(&hard_iface->bat_v.aggr_list))) + kfree_skb(skb); + + hard_iface->bat_v.aggr_len = 0; +} + +/** + * batadv_v_ogm_aggr_send() - flush & send aggregation queue + * @hard_iface: the interface with the aggregation queue to flush + * + * Aggregates all OGMv2 packets currently in the aggregation queue into a + * single OGMv2 packet and transmits this aggregate. + * + * The aggregation queue is empty after this call. + * + * Caller needs to hold the hard_iface->bat_v.aggr_list_lock. + */ +static void batadv_v_ogm_aggr_send(struct batadv_hard_iface *hard_iface) +{ + unsigned int aggr_len = hard_iface->bat_v.aggr_len; + struct sk_buff *skb_aggr; + unsigned int ogm_len; + struct sk_buff *skb; + + lockdep_assert_held(&hard_iface->bat_v.aggr_list_lock); + + if (!aggr_len) + return; + + skb_aggr = dev_alloc_skb(aggr_len + ETH_HLEN + NET_IP_ALIGN); + if (!skb_aggr) { + batadv_v_ogm_aggr_list_free(hard_iface); + return; + } + + skb_reserve(skb_aggr, ETH_HLEN + NET_IP_ALIGN); + skb_reset_network_header(skb_aggr); + + while ((skb = skb_dequeue(&hard_iface->bat_v.aggr_list))) { + hard_iface->bat_v.aggr_len -= batadv_v_ogm_len(skb); + + ogm_len = batadv_v_ogm_len(skb); + skb_put_data(skb_aggr, skb->data, ogm_len); + + consume_skb(skb); + } + + batadv_v_ogm_send_to_if(skb_aggr, hard_iface); +} + +/** + * batadv_v_ogm_queue_on_if() - queue a batman ogm on a given interface + * @skb: the OGM to queue + * @hard_iface: the interface to queue the OGM on + */ +static void batadv_v_ogm_queue_on_if(struct sk_buff *skb, + struct batadv_hard_iface *hard_iface) +{ + struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface); + + if (!atomic_read(&bat_priv->aggregated_ogms)) { + batadv_v_ogm_send_to_if(skb, hard_iface); + return; + } + + spin_lock_bh(&hard_iface->bat_v.aggr_list_lock); + if (!batadv_v_ogm_queue_left(skb, hard_iface)) + batadv_v_ogm_aggr_send(hard_iface); + + hard_iface->bat_v.aggr_len += batadv_v_ogm_len(skb); + skb_queue_tail(&hard_iface->bat_v.aggr_list, skb); + spin_unlock_bh(&hard_iface->bat_v.aggr_list_lock); +} + /** - * batadv_v_ogm_send() - periodic worker broadcasting the own OGM - * @work: work queue item + * batadv_v_ogm_send_softif() - periodic worker broadcasting the own OGM + * @bat_priv: the bat priv with all the soft interface information */ - static void batadv_v_ogm_send(struct work_struct *work) + static void batadv_v_ogm_send_softif(struct batadv_priv *bat_priv) { struct batadv_hard_iface *hard_iface; - struct batadv_priv_bat_v *bat_v; - struct batadv_priv *bat_priv; struct batadv_ogm2_packet *ogm_packet; struct sk_buff *skb, *skb_tmp; unsigned char *ogm_buff; @@@ -363,27 -221,22 +361,43 @@@ out return; } + /** + * batadv_v_ogm_send() - periodic worker broadcasting the own OGM + * @work: work queue item + */ + static void batadv_v_ogm_send(struct work_struct *work) + { + struct batadv_priv_bat_v *bat_v; + struct batadv_priv *bat_priv; + + rtnl_lock(); + bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work); + bat_priv = container_of(bat_v, struct batadv_priv, bat_v); + batadv_v_ogm_send_softif(bat_priv); + rtnl_unlock(); + } + +/** + * batadv_v_ogm_aggr_work() - OGM queue periodic task per interface + * @work: work queue item + * + * Emits aggregated OGM message in regular intervals. + */ +void batadv_v_ogm_aggr_work(struct work_struct *work) +{ + struct batadv_hard_iface_bat_v *batv; + struct batadv_hard_iface *hard_iface; + + batv = container_of(work, struct batadv_hard_iface_bat_v, aggr_wq.work); + hard_iface = container_of(batv, struct batadv_hard_iface, bat_v); + + spin_lock_bh(&hard_iface->bat_v.aggr_list_lock); + batadv_v_ogm_aggr_send(hard_iface); + spin_unlock_bh(&hard_iface->bat_v.aggr_list_lock); + + batadv_v_ogm_start_queue_timer(hard_iface); +} + /** * batadv_v_ogm_iface_enable() - prepare an interface for B.A.T.M.A.N. V * @hard_iface: the interface to prepare

3 years, 5 months

[batman-adv] master: batman-adv: Avoid free/alloc race when handling OGM buffer (9b8ceef2)

by postmaster＠open-mesh.org

Repository : ssh://git@open-mesh.org/batman-adv On branch : master >--------------------------------------------------------------- commit 9b8ceef26c697d0c8319748428944c3339a498dc Author: Sven Eckelmann <sven(a)narfation.org> Date: Thu Oct 3 17:02:01 2019 +0200 batman-adv: Avoid free/alloc race when handling OGM buffer Each slave interface of an B.A.T.M.A.N. IV virtual interface has an OGM packet buffer which is initialized using data from the RTNL lock protected netdevice notifier and other rtnetlink related hooks. It is sent regularly via various slave interfaces of the batadv virtual interface and in this process also modified (realloced) to integrate additional state information via TVLV containers. It must be avoided that the worker item is executed without a common lock with the netdevice notifier/rtnetlink helpers. Otherwise it can either happen that half modified/freed data is sent out or functions modifying the OGM buffer try to access already freed memory regions. Reported-by: syzbot+0cc629f19ccb8534935b(a)syzkaller.appspotmail.com Fixes: ea6f8d42a595 ("batman-adv: move /proc interface handling to /sys") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> >--------------------------------------------------------------- 9b8ceef26c697d0c8319748428944c3339a498dc net/batman-adv/bat_iv_ogm.c | 33 +++++++++++++++++++++++++++------ net/batman-adv/types.h | 4 ++-- 2 files changed, 29 insertions(+), 8 deletions(-) diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c index d78938e3..e20c3813 100644 --- a/net/batman-adv/bat_iv_ogm.c +++ b/net/batman-adv/bat_iv_ogm.c @@ -29,6 +29,7 @@ #include <linux/random.h> #include <linux/rculist.h> #include <linux/rcupdate.h> +#include <linux/rtnetlink.h> #include <linux/seq_file.h> #include <linux/skbuff.h> #include <linux/slab.h> @@ -193,6 +194,8 @@ static int batadv_iv_ogm_iface_enable(struct batadv_hard_iface *hard_iface) unsigned char *ogm_buff; u32 random_seqno; + ASSERT_RTNL(); + /* randomize initial seqno to avoid collision */ get_random_bytes(&random_seqno, sizeof(random_seqno)); atomic_set(&hard_iface->bat_iv.ogm_seqno, random_seqno); @@ -217,6 +220,8 @@ static int batadv_iv_ogm_iface_enable(struct batadv_hard_iface *hard_iface) static void batadv_iv_ogm_iface_disable(struct batadv_hard_iface *hard_iface) { + ASSERT_RTNL(); + kfree(hard_iface->bat_iv.ogm_buff); hard_iface->bat_iv.ogm_buff = NULL; } @@ -226,6 +231,8 @@ static void batadv_iv_ogm_iface_update_mac(struct batadv_hard_iface *hard_iface) struct batadv_ogm_packet *batadv_ogm_packet; unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff; + ASSERT_RTNL(); + batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff; ether_addr_copy(batadv_ogm_packet->orig, hard_iface->net_dev->dev_addr); @@ -239,6 +246,8 @@ batadv_iv_ogm_primary_iface_set(struct batadv_hard_iface *hard_iface) struct batadv_ogm_packet *batadv_ogm_packet; unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff; + ASSERT_RTNL(); + batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff; batadv_ogm_packet->ttl = BATADV_TTL; } @@ -753,6 +762,8 @@ static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface) u16 tvlv_len = 0; unsigned long send_time; + ASSERT_RTNL(); + if (hard_iface->if_status == BATADV_IF_NOT_IN_USE || hard_iface->if_status == BATADV_IF_TO_BE_REMOVED) return; @@ -1643,16 +1654,12 @@ static void batadv_iv_ogm_process(const struct sk_buff *skb, int ogm_offset, batadv_orig_node_put(orig_node); } -static void batadv_iv_send_outstanding_bat_ogm_packet(struct work_struct *work) +static void +batadv_iv_send_outstanding_forw_packet(struct batadv_forw_packet *forw_packet) { - struct delayed_work *delayed_work; - struct batadv_forw_packet *forw_packet; struct batadv_priv *bat_priv; bool dropped = false; - delayed_work = to_delayed_work(work); - forw_packet = container_of(delayed_work, struct batadv_forw_packet, - delayed_work); bat_priv = netdev_priv(forw_packet->if_incoming->soft_iface); if (atomic_read(&bat_priv->mesh_state) == BATADV_MESH_DEACTIVATING) { @@ -1681,6 +1688,20 @@ out: batadv_forw_packet_free(forw_packet, dropped); } +static void batadv_iv_send_outstanding_bat_ogm_packet(struct work_struct *work) +{ + struct delayed_work *delayed_work; + struct batadv_forw_packet *forw_packet; + + delayed_work = to_delayed_work(work); + forw_packet = container_of(delayed_work, struct batadv_forw_packet, + delayed_work); + + rtnl_lock(); + batadv_iv_send_outstanding_forw_packet(forw_packet); + rtnl_unlock(); +} + static int batadv_iv_ogm_receive(struct sk_buff *skb, struct batadv_hard_iface *if_incoming) { diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h index 3eb3150e..282a4650 100644 --- a/net/batman-adv/types.h +++ b/net/batman-adv/types.h @@ -73,10 +73,10 @@ enum batadv_dhcp_recipient { * struct batadv_hard_iface_bat_iv - per hard-interface B.A.T.M.A.N. IV data */ struct batadv_hard_iface_bat_iv { - /** @ogm_buff: buffer holding the OGM packet */ + /** @ogm_buff: buffer holding the OGM packet. rtnl protected */ unsigned char *ogm_buff; - /** @ogm_buff_len: length of the OGM packet buffer */ + /** @ogm_buff_len: length of the OGM packet buffer. rtnl protected */ int ogm_buff_len; /** @ogm_seqno: OGM sequence number - used to identify each OGM */

3 years, 5 months

[linux-merge]linux integration; annotated tag, v5.4-rc2, created. v5.4-rc2

by postmaster＠open-mesh.org

The annotated tag, v5.4-rc2 has been created at a09a4100c0de95f0c617c7ed2f4b8b45271cd4d5 (tag) tagging da0c9ea146cbe92b832f1b0f694840ea8eb33cce (commit) replaces v5.4-rc1 tagged by Linus Torvalds on Sun Oct 6 14:27:38 2019 -0700 - Shortlog ------------------------------------------------------------ Linux 5.4-rc2 -----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAl2aXEoeHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGZKUH/1S+unzPxmXwraBl ORnOSMCaoepaCS2kc4nFim3hpnwzuFLn8NHPSARPPBO7Jy9Shtku0om66rF6R4DD zoe/QSLvtUqiVU6xuPR8ymjeizN+qj+9RT8tDftCs2QCBqZ/jr/kKiiA32aipnrz IBC+I6eKFN0WqBep5NwAkIAok+JiUBMIEuEXjkF2q0Vw9fnmmNRMm6rPDk1dHgQi K6mr8N3Vbsdadn/XBt4DRje2c593cfOnryPUwyIIBGw5W6EECX6k9CeD+CNNxLYb mPNC34wQsqvbAOsP6Y+2lBLZw+0AG5uLytDrwNNO1JKSEYMSG6wH4t7C6w0IlTQt OkYK3S0= =0ny6 -----END PGP SIGNATURE----- Florian Westphal (1): netfilter: drop bridge nf reset from nf_reset ----------------------------------------------------------------------- -- linux integration

3 years, 5 months

[batman-adv] master: batman-adv: netfilter: drop bridge nf reset from nf_reset (ab636a2b)

by postmaster＠open-mesh.org

Repository : ssh://git@open-mesh.org/batman-adv On branch : master >--------------------------------------------------------------- commit ab636a2bec851b103c638ec4cde059be0432528a Author: Florian Westphal <fw(a)strlen.de> Date: Sun Sep 29 20:54:03 2019 +0200 batman-adv: netfilter: drop bridge nf reset from nf_reset commit 174e23810cd31 ("sk_buff: drop all skb extensions on free and skb scrubbing") made napi recycle always drop skb extensions. The additional skb_ext_del() that is performed via nf_reset on napi skb recycle is not needed anymore. Most nf_reset() calls in the stack are there so queued skb won't block 'rmmod nf_conntrack' indefinitely. This removes the skb_ext_del from nf_reset, and renames it to a more fitting nf_reset_ct(). In a few selected places, add a call to skb_ext_reset to make sure that no active extensions remain. I am submitting this for "net", because we're still early in the release cycle. The patch applies to net-next too, but I think the rename causes needless divergence between those trees. Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> [sven(a)narfation.org: add compat code] Signed-off-by: Sven Eckelmann <sven(a)narfation.org> >--------------------------------------------------------------- ab636a2bec851b103c638ec4cde059be0432528a compat-include/linux/skbuff.h | 6 ++++++ net/batman-adv/soft-interface.c | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/compat-include/linux/skbuff.h b/compat-include/linux/skbuff.h index f149f31a..a92c4425 100644 --- a/compat-include/linux/skbuff.h +++ b/compat-include/linux/skbuff.h @@ -77,4 +77,10 @@ static inline void *skb_put_data(struct sk_buff *skb, const void *data, #endif /* < KERNEL_VERSION(4, 13, 0) */ +#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 4, 0) + +#define nf_reset_ct nf_reset + +#endif /* < KERNEL_VERSION(5, 4, 0) */ + #endif /* _NET_BATMAN_ADV_COMPAT_LINUX_SKBUFF_H_ */ diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c index a1146cb1..9cbed6f5 100644 --- a/net/batman-adv/soft-interface.c +++ b/net/batman-adv/soft-interface.c @@ -436,7 +436,7 @@ void batadv_interface_rx(struct net_device *soft_iface, /* clean the netfilter state now that the batman-adv header has been * removed */ - nf_reset(skb); + nf_reset_ct(skb); if (unlikely(!pskb_may_pull(skb, ETH_HLEN))) goto dropped;

3 years, 5 months

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

commits October 2019