commits

commits@lists.open-mesh.org

1 participants
12395 discussions

[linux-merge]linux integration; annotated tag, v6.4-rc5, created. v6.4-rc5
by postmaster＠open-mesh.org 04 Jun '23

04 Jun '23

The annotated tag, v6.4-rc5 has been created at f83424364efcdbca8f4d98f9b1825a1e0fc19d91 (tag) tagging 9561de3a55bed6bdd44a12820ba81ec416e705a7 (commit) replaces v6.4-rc4 tagged by Linus Torvalds on Sun Jun 4 14:04:27 2023 -0400 - Shortlog ------------------------------------------------------------ Linux 6.4-rc5 -----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmR80iseHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGhxkH/2+2NEZjO5SCj9z6 FGrJunmXMOqoryoC3oL953Zhp3oeB/gB7GDdFQLg8tv0QprD6W0L9uorIgFi3lWU doGWKSjFVEdu6RoUV09bTwm1DislZKJF3NCwTyeb44c3HnTzUvd/zFrY29YNRi9C j5KXQIq91dke3qQi/3uCLFRKvmr2ss/lXapScwXFhQjaM2VmAMc51xIxkuRz3H01 EmcbJx3Rj9zPxx3Nc7ONMvtHE5+xuVsMdq3dLFCS9Xc/f+qbCCQdRIy9AjaRuR4c F5nRjwDjq0iv2diF0gK4WtD8fvxVuLaqS0RAi0jsOKVfLphLwkqkPQbbMd5K8qwJ xTNAiW0= =FwWR -----END PGP SIGNATURE----- ----------------------------------------------------------------------- -- linux integration

1 0

[linux-merge]linux integration; annotated tag, v6.4-rc4, created. v6.4-rc4
by postmaster＠open-mesh.org 28 May '23

28 May '23

The annotated tag, v6.4-rc4 has been created at 9632302b68e03c8579120884b22c4e4dc2340e43 (tag) tagging 7877cb91f1081754a1487c144d85dc0d2e2e7fc4 (commit) replaces v6.4-rc3 tagged by Linus Torvalds on Sun May 28 07:49:00 2023 -0400 - Shortlog ------------------------------------------------------------ Linux 6.4-rc4 -----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmRzP6weHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGRJYH/2I3eKvKH7uQB/g7 s9PTv+Q3oPKSNCfSdudcmTj8W+yd7CHcfxEmw1/xmTOn/6Vyybk6TFBHUgRDH/un Jkk25N3UXqDIWcEVSYW6PMr/m0FJ4gpHtDNu/8TUTv5Gh/GrlIlfnntXQ+L8UWxQ T+pDf9oAI/MIXctACPLRoOt9fOMCwMZbO0VcGxuTM2M5De9Fu/Mla9OFfViC3QAV LtWrBfTgvNlF16PIunggBsKGIGB7J6qpua9nEzwwCjXn8wVBwGVQ2kfpz4kkEFGU O3UC+oCyjTGvjMCkIqhxKOy5cVNcXoL+xE23HTlPTjuDBxRQi/xEnw6doJ790pTk 5F/ZcKc= =SF/G -----END PGP SIGNATURE----- ----------------------------------------------------------------------- -- linux integration

1 0

[linux-merge]linux integration; branch, batadv/net, updated. v6.4-rc3-1-gabac3ac97fe8
by postmaster＠open-mesh.org 26 May '23

26 May '23

The following commit has been merged in the batadv/net branch: commit abac3ac97fe8734b620e7322a116450d7f90aa43 Author: Vladislav Efanov <VEfanov(a)ispras.ru> Date: Fri May 26 19:16:32 2023 +0300 batman-adv: Broken sync while rescheduling delayed work Syzkaller got a lot of crashes like: KASAN: use-after-free Write in *_timers* All of these crashes point to the same memory area: The buggy address belongs to the object at ffff88801f870000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 5320 bytes inside of 8192-byte region [ffff88801f870000, ffff88801f872000) This area belongs to : batadv_priv->batadv_priv_dat->delayed_work->timer_list The reason for these issues is the lack of synchronization. Delayed work (batadv_dat_purge) schedules new timer/work while the device is being deleted. As the result new timer/delayed work is set after cancel_delayed_work_sync() was called. So after the device is freed the timer list contains pointer to already freed memory. Found by Linux Verification Center (linuxtesting.org) with syzkaller. Cc: stable(a)kernel.org Fixes: 2f1dfbe18507 ("batman-adv: Distributed ARP Table - implement local storage") Signed-off-by: Vladislav Efanov <VEfanov(a)ispras.ru> Acked-by: Sven Eckelmann <sven(a)narfation.org> Signed-off-by: Simon Wunderlich <sw(a)simonwunderlich.de> diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c index 6968e55eb971..28a939d56090 100644 --- a/net/batman-adv/distributed-arp-table.c +++ b/net/batman-adv/distributed-arp-table.c @@ -101,7 +101,6 @@ static void batadv_dat_purge(struct work_struct *work); */ static void batadv_dat_start_timer(struct batadv_priv *bat_priv) { - INIT_DELAYED_WORK(&bat_priv->dat.work, batadv_dat_purge); queue_delayed_work(batadv_event_workqueue, &bat_priv->dat.work, msecs_to_jiffies(10000)); } @@ -819,6 +818,7 @@ int batadv_dat_init(struct batadv_priv *bat_priv) if (!bat_priv->dat.hash) return -ENOMEM; + INIT_DELAYED_WORK(&bat_priv->dat.work, batadv_dat_purge); batadv_dat_start_timer(bat_priv); batadv_tvlv_handler_register(bat_priv, batadv_dat_tvlv_ogm_handler_v1, -- linux integration

1 0

[batman-adv] main,main: Merge branch 'stable' (8e52ef4c)
by postmaster＠open-mesh.org 26 May '23

26 May '23

Repository : ssh://git@diktynna/batman-adv On branches: main,main >--------------------------------------------------------------- commit 8e52ef4c1533f1af68628a15d9b0f4d28d63d442 Merge: 57571bca 177ba85f Author: Sven Eckelmann <sven(a)narfation.org> Date: Fri May 26 23:14:16 2023 +0200 Merge branch 'stable' >--------------------------------------------------------------- 8e52ef4c1533f1af68628a15d9b0f4d28d63d442 net/batman-adv/distributed-arp-table.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

1 0

[batman-adv] main,stable,main,stable: batman-adv: Broken sync while rescheduling delayed work (177ba85f)
by postmaster＠open-mesh.org 26 May '23

26 May '23

Repository : ssh://git@diktynna/batman-adv On branches: main,stable,main,stable >--------------------------------------------------------------- commit 177ba85fb2d4ca2ecd30ca16803560e80e916fac Author: Vladislav Efanov <VEfanov(a)ispras.ru> Date: Fri May 26 19:16:32 2023 +0300 batman-adv: Broken sync while rescheduling delayed work Syzkaller got a lot of crashes like: KASAN: use-after-free Write in *_timers* All of these crashes point to the same memory area: The buggy address belongs to the object at ffff88801f870000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 5320 bytes inside of 8192-byte region [ffff88801f870000, ffff88801f872000) This area belongs to : batadv_priv->batadv_priv_dat->delayed_work->timer_list The reason for these issues is the lack of synchronization. Delayed work (batadv_dat_purge) schedules new timer/work while the device is being deleted. As the result new timer/delayed work is set after cancel_delayed_work_sync() was called. So after the device is freed the timer list contains pointer to already freed memory. Found by Linux Verification Center (linuxtesting.org) with syzkaller. Fixes: f6badf9eb582 ("batman-adv: Distributed ARP Table - implement local storage") Signed-off-by: Vladislav Efanov <VEfanov(a)ispras.ru> Signed-off-by: Sven Eckelmann <sven(a)narfation.org> >--------------------------------------------------------------- 177ba85fb2d4ca2ecd30ca16803560e80e916fac net/batman-adv/distributed-arp-table.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c index 6968e55e..28a939d5 100644 --- a/net/batman-adv/distributed-arp-table.c +++ b/net/batman-adv/distributed-arp-table.c @@ -101,7 +101,6 @@ static void batadv_dat_purge(struct work_struct *work); */ static void batadv_dat_start_timer(struct batadv_priv *bat_priv) { - INIT_DELAYED_WORK(&bat_priv->dat.work, batadv_dat_purge); queue_delayed_work(batadv_event_workqueue, &bat_priv->dat.work, msecs_to_jiffies(10000)); } @@ -819,6 +818,7 @@ int batadv_dat_init(struct batadv_priv *bat_priv) if (!bat_priv->dat.hash) return -ENOMEM; + INIT_DELAYED_WORK(&bat_priv->dat.work, batadv_dat_purge); batadv_dat_start_timer(bat_priv); batadv_tvlv_handler_register(bat_priv, batadv_dat_tvlv_ogm_handler_v1,

1 0

[linux-merge]linux integration; branch, batadv/net, updated. v6.4-rc3-1-g415c3c8f688b
by postmaster＠open-mesh.org 26 May '23

26 May '23

The following commit has been merged in the batadv/net branch: commit 415c3c8f688b6aca92576e6d7b2995ae9eab9f02 Author: Vladislav Efanov <VEfanov(a)ispras.ru> Date: Fri May 26 19:16:32 2023 +0300 batman-adv: Broken sync while rescheduling delayed work Syzkaller got a lot of crashes like: KASAN: use-after-free Write in *_timers* All of these crashes point to the same memory area: The buggy address belongs to the object at ffff88801f870000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 5320 bytes inside of 8192-byte region [ffff88801f870000, ffff88801f872000) This area belongs to : batadv_priv->batadv_priv_dat->delayed_work->timer_list The reason for these issues is the lack of synchronization. Delayed work (batadv_dat_purge) schedules new timer/work while the device is being deleted. As the result new timer/delayed work is set after cancel_delayed_work_sync() was called. So after the device is freed the timer list contains pointer to already freed memory. Found by Linux Verification Center (linuxtesting.org) with syzkaller. Fixes: 2f1dfbe18507 ("batman-adv: Distributed ARP Table - implement local storage") Signed-off-by: Vladislav Efanov <VEfanov(a)ispras.ru> Acked-by: Sven Eckelmann <sven(a)narfation.org> Signed-off-by: Simon Wunderlich <sw(a)simonwunderlich.de> diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c index 6968e55eb971..28a939d56090 100644 --- a/net/batman-adv/distributed-arp-table.c +++ b/net/batman-adv/distributed-arp-table.c @@ -101,7 +101,6 @@ static void batadv_dat_purge(struct work_struct *work); */ static void batadv_dat_start_timer(struct batadv_priv *bat_priv) { - INIT_DELAYED_WORK(&bat_priv->dat.work, batadv_dat_purge); queue_delayed_work(batadv_event_workqueue, &bat_priv->dat.work, msecs_to_jiffies(10000)); } @@ -819,6 +818,7 @@ int batadv_dat_init(struct batadv_priv *bat_priv) if (!bat_priv->dat.hash) return -ENOMEM; + INIT_DELAYED_WORK(&bat_priv->dat.work, batadv_dat_purge); batadv_dat_start_timer(bat_priv); batadv_tvlv_handler_register(bat_priv, batadv_dat_tvlv_ogm_handler_v1, -- linux integration

1 0

[batctl] stable's head updated: batctl: Update CHANGELOG for upcoming release (8f330ba)
by postmaster＠open-mesh.org 25 May '23

25 May '23

Repository : ssh://git@diktynna/batctl Branch 'stable' now includes: beac2a7 batctl: Start new development cycle ea10c02 batman-adv: prepare for tvlv enabled multicast packet type 8f330ba batctl: Update CHANGELOG for upcoming release

1 0

[batman-adv] tag 'v' deleted
by postmaster＠open-mesh.org 25 May '23

25 May '23

Repository : ssh://git@diktynna/batman-adv Deleted tag: v

1 0

[batman-adv] tag 'v' created
by postmaster＠open-mesh.org 25 May '23

25 May '23

Repository : ssh://git@diktynna/batman-adv New tag : v Referencing: 06311e94ee3d60cb2a73533587f4abcdffc9a8f3

1 0

[batman-adv] main,main: batman-adv: introduce skb_vlan_eth_hdr() (b097e63c)
by postmaster＠open-mesh.org 25 May '23

25 May '23

Repository : ssh://git@diktynna/batman-adv On branches: main,main >--------------------------------------------------------------- commit b097e63c8549d9a1311adf8e2597f63fbb80291a Author: Vladimir Oltean <vladimir.oltean(a)nxp.com> Date: Fri Apr 21 01:55:54 2023 +0300 batman-adv: introduce skb_vlan_eth_hdr() Similar to skb_eth_hdr() introduced in commit 96cc4b69581d ("macvlan: do not assume mac_header is set in macvlan_broadcast()"), let's introduce a skb_vlan_eth_hdr() helper which can be used in TX-only code paths to get to the VLAN header based on skb->data rather than based on the skb_mac_header(skb). We also consolidate the drivers that dereference skb->data to go through this helper. Signed-off-by: Vladimir Oltean <vladimir.oltean(a)nxp.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Simon Horman <simon.horman(a)corigine.com> Reviewed-by: Florian Fainelli <f.fainelli(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> [sven(a)narfation.org: add compat code] Signed-off-by: Sven Eckelmann <sven(a)narfation.org> >--------------------------------------------------------------- b097e63c8549d9a1311adf8e2597f63fbb80291a compat-include/linux/if_vlan.h | 28 ++++++++++++++++++++++++++++ net/batman-adv/soft-interface.c | 2 +- 2 files changed, 29 insertions(+), 1 deletion(-) diff --git a/compat-include/linux/if_vlan.h b/compat-include/linux/if_vlan.h new file mode 100644 index 00000000..eb15e060 --- /dev/null +++ b/compat-include/linux/if_vlan.h @@ -0,0 +1,28 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* Copyright (C) B.A.T.M.A.N. contributors: + * + * Marek Lindner, Simon Wunderlich + * + * This file contains macros for maintaining compatibility with older versions + * of the Linux kernel. + */ + +#ifndef _NET_BATMAN_ADV_COMPAT_LINUX_IF_VLAN_H_ +#define _NET_BATMAN_ADV_COMPAT_LINUX_IF_VLAN_H_ + +#include <linux/version.h> +#include_next <linux/if_vlan.h> + +#if LINUX_VERSION_IS_LESS(6, 4, 0) + +/* Prefer this version in TX path, instead of + * skb_reset_mac_header() + vlan_eth_hdr() + */ +static inline struct vlan_ethhdr *skb_vlan_eth_hdr(const struct sk_buff *skb) +{ + return (struct vlan_ethhdr *)skb->data; +} + +#endif /* LINUX_VERSION_IS_LESS(6, 4, 0) */ + +#endif /* _NET_BATMAN_ADV_COMPAT_LINUX_IF_VLAN_H_ */ diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c index 125f4628..d3fdf822 100644 --- a/net/batman-adv/soft-interface.c +++ b/net/batman-adv/soft-interface.c @@ -439,7 +439,7 @@ void batadv_interface_rx(struct net_device *soft_iface, if (!pskb_may_pull(skb, VLAN_ETH_HLEN)) goto dropped; - vhdr = (struct vlan_ethhdr *)skb->data; + vhdr = skb_vlan_eth_hdr(skb); /* drop batman-in-batman packets to prevent loops */ if (vhdr->h_vlan_encapsulated_proto != htons(ETH_P_BATMAN))

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

commits