The following commit has been merged in the master branch:
commit fd7dec25a18f495e50d2040398fd263836ff3b28
Author: Sven Eckelmann <sven(a)narfation.org>
Date: Tue Aug 18 13:37:01 2015 +0200
batman-adv: Fix memory leak on tt add with invalid vlan
The object tt_local is allocated with kmalloc and not initialized when the
function batadv_tt_local_add checks for the vlan. But this function can
only cleanup the object when the (not yet initialized) reference counter of
…
[View More] the object is 1. This is unlikely and thus the object would leak when the
vlan could not be found.
Instead the uninitialized object tt_local has to be freed manually and the
pointer has to set to NULL to avoid calling the function which would try to
decrement the reference counter of the not existing object.
CID: 1316518
Fixes: 354136bcc3c4 ("batman-adv: fix kernel crash due to missing NULL checks")
Signed-off-by: Sven Eckelmann <sven(a)narfation.org>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 5e953297..5809b39 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -595,8 +595,11 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
/* increase the refcounter of the related vlan */
vlan = batadv_softif_vlan_get(bat_priv, vid);
if (WARN(!vlan, "adding TT local entry %pM to non-existent VLAN %d",
- addr, BATADV_PRINT_VID(vid)))
+ addr, BATADV_PRINT_VID(vid))) {
+ kfree(tt_local);
+ tt_local = NULL;
goto out;
+ }
batadv_dbg(BATADV_DBG_TT, bat_priv,
"Creating new local tt entry: %pM (vid: %d, ttvn: %d)\n",
--
LinuxNextTracking
[View Less]
The following commit has been merged in the master branch:
commit cdf7370391d3a482ef2f2a8c73d16c6db3dbecf0
Author: Phil Sutter <phil(a)nwl.cc>
Date: Tue Aug 18 10:30:44 2015 +0200
net: batman-adv: convert to using IFF_NO_QUEUE
Signed-off-by: Phil Sutter <phil(a)nwl.cc>
Cc: Marek Lindner <mareklindner(a)neomailbox.ch>
Cc: Simon Wunderlich <sw(a)simonwunderlich.de>
Cc: Antonio Quartulli <antonio(a)meshcoding.com>
Signed-off-by: David S.…
[View More] Miller <davem(a)davemloft.net>
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 51cda3a..49d3d3a 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -941,7 +941,7 @@ static void batadv_softif_init_early(struct net_device *dev)
dev->netdev_ops = &batadv_netdev_ops;
dev->destructor = batadv_softif_free;
dev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
- dev->tx_queue_len = 0;
+ dev->priv_flags |= IFF_NO_QUEUE;
/* can't call min_mtu, because the needed variables
* have not been initialized yet
--
LinuxNextTracking
[View Less]
The following commit has been merged in the master branch:
commit 3f1e08d0ae6746379b9e21264dae52f4f35c7ad2
Author: Simon Wunderlich <simon(a)open-mesh.com>
Date: Wed Jun 24 14:50:20 2015 +0200
batman-adv: remove broadcast packets scheduled for purged outgoing if
When an interface is purged, the broadcast packets scheduled for this
interface should get purged as well.
Signed-off-by: Simon Wunderlich <simon(a)open-mesh.com>
Signed-off-by: Marek Lindner …
[View More]<mareklindner(a)neomailbox.ch>
Signed-off-by: Antonio Quartulli <antonio(a)meshcoding.com>
diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index 0a01992..191076e 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -616,7 +616,8 @@ batadv_purge_outstanding_packets(struct batadv_priv *bat_priv,
* we delete only packets belonging to the given interface
*/
if ((hard_iface) &&
- (forw_packet->if_incoming != hard_iface))
+ (forw_packet->if_incoming != hard_iface) &&
+ (forw_packet->if_outgoing != hard_iface))
continue;
spin_unlock_bh(&bat_priv->forw_bcast_list_lock);
--
LinuxNextTracking
[View Less]
The following commit has been merged in the master branch:
commit 53cf037bf846417fd92dc92ddf97267f69b110f4
Author: Linus Lüssing <linus.luessing(a)c0d3.blue>
Date: Tue Jun 30 23:45:26 2015 +0200
batman-adv: Fix potentially broken skb network header access
The two commits noted below added calls to ip_hdr() and ipv6_hdr(). They
need a correctly set skb network header.
Unfortunately we cannot rely on the device drivers to set it for us.
Therefore setting it …
[View More]in the beginning of the according ndo_start_xmit
handler.
Fixes: 1d8ab8d3c176 ("batman-adv: Modified forwarding behaviour for multicast packets")
Fixes: ab49886e3da7 ("batman-adv: Add IPv4 link-local/IPv6-ll-all-nodes multicast support")
Signed-off-by: Linus Lüssing <linus.luessing(a)c0d3.blue>
Signed-off-by: Marek Lindner <mareklindner(a)neomailbox.ch>
Signed-off-by: Antonio Quartulli <antonio(a)meshcoding.com>
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index c002961..926292d 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -202,6 +202,7 @@ static int batadv_interface_tx(struct sk_buff *skb,
int gw_mode;
enum batadv_forw_mode forw_mode;
struct batadv_orig_node *mcast_single_orig = NULL;
+ int network_offset = ETH_HLEN;
if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE)
goto dropped;
@@ -214,14 +215,18 @@ static int batadv_interface_tx(struct sk_buff *skb,
case ETH_P_8021Q:
vhdr = vlan_eth_hdr(skb);
- if (vhdr->h_vlan_encapsulated_proto != ethertype)
+ if (vhdr->h_vlan_encapsulated_proto != ethertype) {
+ network_offset += VLAN_HLEN;
break;
+ }
/* fall through */
case ETH_P_BATMAN:
goto dropped;
}
+ skb_set_network_header(skb, network_offset);
+
if (batadv_bla_tx(bat_priv, skb, vid))
goto dropped;
--
LinuxNextTracking
[View Less]