linux-merge

linux-merge@lists.open-mesh.org

3 participants
7480 discussions

[linux-next] LinuxNextTracking branch, master, updated. next-20160630
by batman＠open-mesh.org 30 Jun '16

30 Jun '16

The following commit has been merged in the master branch: commit 0b3dd7dfb81ad8af53791ea2bb64b83bac1b7d32 Author: Simon Wunderlich <sw(a)simonwunderlich.de> Date: Sun Jun 26 11:16:09 2016 +0200 batman-adv: replace WARN with rate limited output on non-existing VLAN If a VLAN tagged frame is received and the corresponding VLAN is not configured on the soft interface, it will splat a WARN on every packet received. This is a quite annoying behaviour for some scenarios, e.g. if bat0 is bridged with eth0, and there are arbitrary VLAN tagged frames from Ethernet coming in without having any VLAN configuration on bat0. The code should probably create vlan objects on the fly and transparently transport these VLAN-tagged Ethernet frames, but until this is done, at least the WARN splat should be replaced by a rate limited output. Fixes: 354136bcc3c4 ("batman-adv: fix kernel crash due to missing NULL checks") Signed-off-by: Simon Wunderlich <sw(a)simonwunderlich.de> Signed-off-by: Marek Lindner <mareklindner(a)neomailbox.ch> Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index feaf492b..72abab7 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -650,8 +650,10 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const u8 *addr, /* increase the refcounter of the related vlan */ vlan = batadv_softif_vlan_get(bat_priv, vid); - if (WARN(!vlan, "adding TT local entry %pM to non-existent VLAN %d", - addr, BATADV_PRINT_VID(vid))) { + if (!vlan) { + net_ratelimited_function(batadv_info, soft_iface, + "adding TT local entry %pM to non-existent VLAN %d\n", + addr, BATADV_PRINT_VID(vid)); kfree(tt_local); tt_local = NULL; goto out; -- LinuxNextTracking

1 0

[linux-next] LinuxNextTracking branch, master, updated. next-20160630
by batman＠open-mesh.org 30 Jun '16

30 Jun '16

The following commit has been merged in the master branch: commit 3b55e4422087f9f7b241031d758a0c65584e4297 Author: Sven Eckelmann <sven(a)narfation.org> Date: Sun Jun 26 11:16:12 2016 +0200 batman-adv: Fix ICMP RR ethernet access after skb_linearize The skb_linearize may reallocate the skb. This makes the calculated pointer for ethhdr invalid. But it the pointer is used later to fill in the RR field of the batadv_icmp_packet_rr packet. Instead re-evaluate eth_hdr after the skb_linearize+skb_cow to fix the pointer and avoid the invalid read. Fixes: da6b8c20a5b8 ("batman-adv: generalize batman-adv icmp packet handling") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Signed-off-by: Marek Lindner <mareklindner(a)neomailbox.ch> Signed-off-by: David S. Miller <davem(a)davemloft.net> diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c index e3857ed..6c2901a 100644 --- a/net/batman-adv/routing.c +++ b/net/batman-adv/routing.c @@ -374,6 +374,7 @@ int batadv_recv_icmp_packet(struct sk_buff *skb, if (skb_cow(skb, ETH_HLEN) < 0) goto out; + ethhdr = eth_hdr(skb); icmph = (struct batadv_icmp_header *)skb->data; icmp_packet_rr = (struct batadv_icmp_packet_rr *)icmph; if (icmp_packet_rr->rr_cur >= BATADV_RR_LEN) -- LinuxNextTracking

1 0

[linux-next] LinuxNextTracking branch, master, updated. next-20160630
by batman＠open-mesh.org 30 Jun '16

30 Jun '16

The following commit has been merged in the master branch: commit baceced93274ff2f846eae991664f9094425ffa8 Author: Ben Hutchings <ben(a)decadent.org.uk> Date: Sun Jun 26 11:16:11 2016 +0200 batman-adv: Fix double-put of vlan object Each batadv_tt_local_entry hold a single reference to a batadv_softif_vlan. In case a new entry cannot be added to the hash table, the error path puts the reference, but the reference will also now be dropped by batadv_tt_local_entry_release(). Fixes: a33d970d0b54 ("batman-adv: Fix reference counting of vlan object for tt_local_entry") Signed-off-by: Ben Hutchings <ben(a)decadent.org.uk> Signed-off-by: Marek Lindner <mareklindner(a)neomailbox.ch> Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index cfb5ccd..57ec87f 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -693,7 +693,6 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const u8 *addr, if (unlikely(hash_added != 0)) { /* remove the reference for the hash */ batadv_tt_local_entry_put(tt_local); - batadv_softif_vlan_put(vlan); goto out; } -- LinuxNextTracking

1 0

[linux-next] LinuxNextTracking branch, master, updated. next-20160630
by batman＠open-mesh.org 30 Jun '16

30 Jun '16

The following commit has been merged in the master branch: commit 9c4604a298e0a9807eaf2cd912d1ebf24d98fbeb Author: Sven Eckelmann <sven(a)narfation.org> Date: Sun Jun 26 11:16:10 2016 +0200 batman-adv: Fix use-after-free/double-free of tt_req_node The tt_req_node is added and removed from a list inside a spinlock. But the locking is sometimes removed even when the object is still referenced and will be used later via this reference. For example batadv_send_tt_request can create a new tt_req_node (including add to a list) and later re-acquires the lock to remove it from the list and to free it. But at this time another context could have already removed this tt_req_node from the list and freed it. CPU#0 batadv_batman_skb_recv from net_device 0 -> batadv_iv_ogm_receive -> batadv_iv_ogm_process -> batadv_iv_ogm_process_per_outif -> batadv_tvlv_ogm_receive -> batadv_tvlv_ogm_receive -> batadv_tvlv_containers_process -> batadv_tvlv_call_handler -> batadv_tt_tvlv_ogm_handler_v1 -> batadv_tt_update_orig -> batadv_send_tt_request -> batadv_tt_req_node_new spin_lock(...) allocates new tt_req_node and adds it to list spin_unlock(...) return tt_req_node CPU#1 batadv_batman_skb_recv from net_device 1 -> batadv_recv_unicast_tvlv -> batadv_tvlv_containers_process -> batadv_tvlv_call_handler -> batadv_tt_tvlv_unicast_handler_v1 -> batadv_handle_tt_response spin_lock(...) tt_req_node gets removed from list and is freed spin_unlock(...) CPU#0 <- returned to batadv_send_tt_request spin_lock(...) tt_req_node gets removed from list and is freed MEMORY CORRUPTION/SEGFAULT/... spin_unlock(...) This can only be solved via reference counting to allow multiple contexts to handle the list manipulation while making sure that only the last context holding a reference will free the object. Fixes: a73105b8d4c7 ("batman-adv: improved client announcement mechanism") Signed-off-by: Sven Eckelmann <sven(a)narfation.org> Tested-by: Martin Weinelt <martin(a)darmstadt.freifunk.net> Tested-by: Amadeus Alfa <amadeus(a)chemnitz.freifunk.net> Signed-off-by: Marek Lindner <mareklindner(a)neomailbox.ch> Signed-off-by: David S. Miller <davem(a)davemloft.net> diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c index 72abab7..cfb5ccd 100644 --- a/net/batman-adv/translation-table.c +++ b/net/batman-adv/translation-table.c @@ -2271,6 +2271,29 @@ static u32 batadv_tt_local_crc(struct batadv_priv *bat_priv, return crc; } +/** + * batadv_tt_req_node_release - free tt_req node entry + * @ref: kref pointer of the tt req_node entry + */ +static void batadv_tt_req_node_release(struct kref *ref) +{ + struct batadv_tt_req_node *tt_req_node; + + tt_req_node = container_of(ref, struct batadv_tt_req_node, refcount); + + kfree(tt_req_node); +} + +/** + * batadv_tt_req_node_put - decrement the tt_req_node refcounter and + * possibly release it + * @tt_req_node: tt_req_node to be free'd + */ +static void batadv_tt_req_node_put(struct batadv_tt_req_node *tt_req_node) +{ + kref_put(&tt_req_node->refcount, batadv_tt_req_node_release); +} + static void batadv_tt_req_list_free(struct batadv_priv *bat_priv) { struct batadv_tt_req_node *node; @@ -2280,7 +2303,7 @@ static void batadv_tt_req_list_free(struct batadv_priv *bat_priv) hlist_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) { hlist_del_init(&node->list); - kfree(node); + batadv_tt_req_node_put(node); } spin_unlock_bh(&bat_priv->tt.req_list_lock); @@ -2317,7 +2340,7 @@ static void batadv_tt_req_purge(struct batadv_priv *bat_priv) if (batadv_has_timed_out(node->issued_at, BATADV_TT_REQUEST_TIMEOUT)) { hlist_del_init(&node->list); - kfree(node); + batadv_tt_req_node_put(node); } } spin_unlock_bh(&bat_priv->tt.req_list_lock); @@ -2349,9 +2372,11 @@ batadv_tt_req_node_new(struct batadv_priv *bat_priv, if (!tt_req_node) goto unlock; + kref_init(&tt_req_node->refcount); ether_addr_copy(tt_req_node->addr, orig_node->orig); tt_req_node->issued_at = jiffies; + kref_get(&tt_req_node->refcount); hlist_add_head(&tt_req_node->list, &bat_priv->tt.req_list); unlock: spin_unlock_bh(&bat_priv->tt.req_list_lock); @@ -2615,13 +2640,19 @@ static bool batadv_send_tt_request(struct batadv_priv *bat_priv, out: if (primary_if) batadv_hardif_put(primary_if); + if (ret && tt_req_node) { spin_lock_bh(&bat_priv->tt.req_list_lock); - /* hlist_del_init() verifies tt_req_node still is in the list */ - hlist_del_init(&tt_req_node->list); + if (!hlist_unhashed(&tt_req_node->list)) { + hlist_del_init(&tt_req_node->list); + batadv_tt_req_node_put(tt_req_node); + } spin_unlock_bh(&bat_priv->tt.req_list_lock); - kfree(tt_req_node); } + + if (tt_req_node) + batadv_tt_req_node_put(tt_req_node); + kfree(tvlv_tt_data); return ret; } @@ -3057,7 +3088,7 @@ static void batadv_handle_tt_response(struct batadv_priv *bat_priv, if (!batadv_compare_eth(node->addr, resp_src)) continue; hlist_del_init(&node->list); - kfree(node); + batadv_tt_req_node_put(node); } spin_unlock_bh(&bat_priv->tt.req_list_lock); diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h index 6a577f4..ba846b0 100644 --- a/net/batman-adv/types.h +++ b/net/batman-adv/types.h @@ -1137,11 +1137,13 @@ struct batadv_tt_change_node { * struct batadv_tt_req_node - data to keep track of the tt requests in flight * @addr: mac address address of the originator this request was sent to * @issued_at: timestamp used for purging stale tt requests + * @refcount: number of contexts the object is used by * @list: list node for batadv_priv_tt::req_list */ struct batadv_tt_req_node { u8 addr[ETH_ALEN]; unsigned long issued_at; + struct kref refcount; struct hlist_node list; }; -- LinuxNextTracking

1 0

Build check errors found: 2016-06-30
by postmaster＠open-mesh.org 30 Jun '16

30 Jun '16

Name of failed tests ==================== * difference between net-next and batadv next Output of different failed tests ================================ difference between net-next and batadv next ------------------------------------------- netnext/Documentation/ABI/testing/sysfs-class-net-batman-adv | 20 netnext/MAINTAINERS | 1 netnext/include/uapi/linux/batman_adv.h | 114 netnext/net/batman-adv/Kconfig | 2 netnext/net/batman-adv/Makefile | 5 netnext/net/batman-adv/bat_algo.c | 140 netnext/net/batman-adv/bat_algo.h | 32 netnext/net/batman-adv/bat_iv_ogm.c | 106 netnext/net/batman-adv/bat_iv_ogm.h | 25 netnext/net/batman-adv/bat_v.c | 58 netnext/net/batman-adv/bat_v.h | 52 netnext/net/batman-adv/bat_v_elp.c | 7 netnext/net/batman-adv/bat_v_elp.h | 4 netnext/net/batman-adv/bat_v_ogm.c | 9 netnext/net/batman-adv/bat_v_ogm.h | 4 netnext/net/batman-adv/bitarray.c | 2 netnext/net/batman-adv/bridge_loop_avoidance.c | 1 netnext/net/batman-adv/debugfs.c | 240 + netnext/net/batman-adv/distributed-arp-table.c | 2 netnext/net/batman-adv/fragmentation.c | 53 netnext/net/batman-adv/fragmentation.h | 6 netnext/net/batman-adv/gateway_client.c | 16 netnext/net/batman-adv/gateway_common.c | 10 netnext/net/batman-adv/hard-interface.c | 25 netnext/net/batman-adv/icmp_socket.c | 1 netnext/net/batman-adv/log.c | 231 - netnext/net/batman-adv/log.h | 111 netnext/net/batman-adv/main.c | 709 ++++ netnext/net/batman-adv/main.h | 121 netnext/net/batman-adv/multicast.c | 501 --- netnext/net/batman-adv/multicast.h | 3 netnext/net/batman-adv/netlink.c | 424 -- netnext/net/batman-adv/netlink.h | 32 netnext/net/batman-adv/network-coding.c | 2 netnext/net/batman-adv/originator.c | 91 netnext/net/batman-adv/originator.h | 6 netnext/net/batman-adv/packet.h | 61 netnext/net/batman-adv/routing.c | 44 netnext/net/batman-adv/send.c | 91 netnext/net/batman-adv/send.h | 4 netnext/net/batman-adv/soft-interface.c | 22 netnext/net/batman-adv/sysfs.c | 29 netnext/net/batman-adv/tp_meter.c | 1504 ---------- netnext/net/batman-adv/tp_meter.h | 34 netnext/net/batman-adv/translation-table.c | 54 netnext/net/batman-adv/tvlv.c | 632 ---- netnext/net/batman-adv/tvlv.h | 61 netnext/net/batman-adv/types.h | 260 - 48 files changed, 1402 insertions(+), 4560 deletions(-)

1 0

Build check errors found: 2016-06-29
by postmaster＠open-mesh.org 29 Jun '16

29 Jun '16

1 0

Build check errors found: 2016-06-28
by postmaster＠open-mesh.org 28 Jun '16

28 Jun '16

1 0

Build check errors found: 2016-06-27
by postmaster＠open-mesh.org 27 Jun '16

27 Jun '16

1 0

Build check errors found: 2016-06-26
by postmaster＠open-mesh.org 26 Jun '16

26 Jun '16

1 0

Build check errors found: 2016-06-25
by postmaster＠open-mesh.org 25 Jun '16

25 Jun '16

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

linux-merge