1. 18 May, 2016 8 commits
    • Marek Lindner's avatar
      batman-adv: initialize ELP orig address on secondary interfaces · ebe24cea
      Marek Lindner authored
      This fix prevents nodes to wrongly create a 00:00:00:00:00:00 originator
      which can potentially interfere with the rest of the neighbor statistics.
      
      Fixes: d6f94d91 ("batman-adv: ELP - adding basic infrastructure")
      Signed-off-by: default avatarMarek Lindner <mareklindner@neomailbox.ch>
      Signed-off-by: default avatarAntonio Quartulli <a@unstable.cc>
      ebe24cea
    • Linus Lüssing's avatar
      batman-adv: Avoid duplicate neigh_node additions · e123705e
      Linus Lüssing authored
      Two parallel calls to batadv_neigh_node_new() might race for creating
      and adding the same neig_node. Fix this by including the check for any
      already existing, identical neigh_node within the spin-lock.
      
      This fixes splats like the following:
      
      [  739.535069] ------------[ cut here ]------------
      [  739.535079] WARNING: CPU: 0 PID: 0 at /usr/src/batman-adv/git/batman-adv/net/batman-adv/bat_iv_ogm.c:1004 batadv_iv_ogm_process_per_outif+0xe3f/0xe60 [batman_adv]()
      [  739.535092] too many matching neigh_nodes
      [  739.535094] Modules linked in: dm_mod tun ip6table_filter ip6table_mangle ip6table_nat nf_nat_ipv6 ip6_tables xt_nat iptable_nat nf_nat_ipv4 nf_nat xt_TCPMSS xt_mark iptable_mangle xt_tcpudp xt_conntrack iptable_filter ip_tables x_tables ip_gre ip_tunnel gre bridge stp llc thermal_sys kvm_intel kvm crct10dif_pclmul crc32_pclmul sha256_ssse3 sha256_generic hmac drbg ansi_cprng aesni_intel aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd evdev pcspkr ip6_gre ip6_tunnel tunnel6 batman_adv(O) libcrc32c nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 nf_conntrack autofs4 ext4 crc16 mbcache jbd2 xen_netfront xen_blkfront crc32c_intel
      [  739.535177] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W  O    4.2.0-0.bpo.1-amd64 #1 Debian 4.2.6-3~bpo8+2
      [  739.535186]  0000000000000000 ffffffffa013b050 ffffffff81554521 ffff88007d003c18
      [  739.535201]  ffffffff8106fa01 0000000000000000 ffff8800047a087a ffff880079c3a000
      [  739.735602]  ffff88007b82bf40 ffff88007bc2d1c0 ffffffff8106fa7a ffffffffa013aa8e
      [  739.735624] Call Trace:
      [  739.735639]  <IRQ>  [<ffffffff81554521>] ? dump_stack+0x40/0x50
      [  739.735677]  [<ffffffff8106fa01>] ? warn_slowpath_common+0x81/0xb0
      [  739.735692]  [<ffffffff8106fa7a>] ? warn_slowpath_fmt+0x4a/0x50
      [  739.735715]  [<ffffffffa012448f>] ? batadv_iv_ogm_process_per_outif+0xe3f/0xe60 [batman_adv]
      [  739.735740]  [<ffffffffa0124813>] ? batadv_iv_ogm_receive+0x363/0x380 [batman_adv]
      [  739.735762]  [<ffffffffa0124813>] ? batadv_iv_ogm_receive+0x363/0x380 [batman_adv]
      [  739.735783]  [<ffffffff810b0841>] ? __raw_callee_save___pv_queued_spin_unlock+0x11/0x20
      [  739.735804]  [<ffffffffa012cb39>] ? batadv_batman_skb_recv+0xc9/0x110 [batman_adv]
      [  739.735825]  [<ffffffff81464891>] ? __netif_receive_skb_core+0x841/0x9a0
      [  739.735838]  [<ffffffff810b0841>] ? __raw_callee_save___pv_queued_spin_unlock+0x11/0x20
      [  739.735853]  [<ffffffff81465681>] ? process_backlog+0xa1/0x140
      [  739.735864]  [<ffffffff81464f1a>] ? net_rx_action+0x20a/0x320
      [  739.735878]  [<ffffffff81073aa7>] ? __do_softirq+0x107/0x270
      [  739.735891]  [<ffffffff81073d82>] ? irq_exit+0x92/0xa0
      [  739.735905]  [<ffffffff8137e0d1>] ? xen_evtchn_do_upcall+0x31/0x40
      [  739.735924]  [<ffffffff8155b8fe>] ? xen_do_hypervisor_callback+0x1e/0x40
      [  739.735939]  <EOI>  [<ffffffff810013aa>] ? xen_hypercall_sched_op+0xa/0x20
      [  739.735965]  [<ffffffff810013aa>] ? xen_hypercall_sched_op+0xa/0x20
      [  739.735979]  [<ffffffff8100a39c>] ? xen_safe_halt+0xc/0x20
      [  739.735991]  [<ffffffff8101da6c>] ? default_idle+0x1c/0xa0
      [  739.736004]  [<ffffffff810abf6b>] ? cpu_startup_entry+0x2eb/0x350
      [  739.736019]  [<ffffffff81b2af5e>] ? start_kernel+0x480/0x48b
      [  739.736032]  [<ffffffff81b2d116>] ? xen_start_kernel+0x507/0x511
      [  739.736048] ---[ end trace c106bb901244bc8c ]---
      
      Fixes: f987ed6e ("batman-adv: protect neighbor list with rcu locks")
      Reported-by: default avatarMartin Weinelt <martin@darmstadt.freifunk.net>
      Signed-off-by: default avatarLinus Lüssing <linus.luessing@c0d3.blue>
      Signed-off-by: default avatarMarek Lindner <mareklindner@neomailbox.ch>
      Signed-off-by: default avatarAntonio Quartulli <a@unstable.cc>
      e123705e
    • Sven Eckelmann's avatar
      batman-adv: Fix integer overflow in batadv_iv_ogm_calc_tq · d285f52c
      Sven Eckelmann authored
      The undefined behavior sanatizer detected an signed integer overflow in a
      setup with near perfect link quality
      
          UBSAN: Undefined behaviour in net/batman-adv/bat_iv_ogm.c:1246:25
          signed integer overflow:
          8713350 * 255 cannot be represented in type 'int'
      
      The problems happens because the calculation of mixed unsigned and signed
      integers resulted in an integer multiplication.
      
            batadv_ogm_packet::tq (u8 255)
          * tq_own (u8 255)
          * tq_asym_penalty (int 134; max 255)
          * tq_iface_penalty (int 255; max 255)
      
      The tq_iface_penalty, tq_asym_penalty and inv_asym_penalty can just be
      changed to unsigned int because they are not expected to become negative.
      
      Fixes: c0398768 ("batman-adv: add WiFi penalty")
      Signed-off-by: default avatarSven Eckelmann <sven.eckelmann@open-mesh.com>
      Signed-off-by: default avatarMarek Lindner <mareklindner@neomailbox.ch>
      Signed-off-by: default avatarAntonio Quartulli <a@unstable.cc>
      d285f52c
    • Antonio Quartulli's avatar
      batman-adv: make sure ELP/OGM orig MAC is updated on address change · 1653f61d
      Antonio Quartulli authored
      When the MAC address of the primary interface is changed,
      update the originator address in the ELP and OGM skb buffers as
      well in order to reflect the change.
      
      Fixes: d6f94d91 ("batman-adv: ELP - adding basic infrastructure")
      Reported-by: default avatarMarek Lindner <marek@neomailbox.ch>
      Signed-off-by: default avatarAntonio Quartulli <a@unstable.cc>
      1653f61d
    • Sven Eckelmann's avatar
      batman-adv: Fix unexpected free of bcast_own on add_if error · f7dcdf5f
      Sven Eckelmann authored
      The function batadv_iv_ogm_orig_add_if allocates new buffers for bcast_own
      and bcast_own_sum. It is expected that these buffers are unchanged in case
      either bcast_own or bcast_own_sum couldn't be resized.
      
      But the error handling of this function frees the already resized buffer
      for bcast_own when the allocation of the new bcast_own_sum buffer failed.
      This will lead to an invalid memory access when some code will try to
      access bcast_own.
      
      Instead the resized new bcast_own buffer has to be kept. This will not lead
      to problems because the size of the buffer was only increased and therefore
      no user of the buffer will try to access bytes outside of the new buffer.
      
      Fixes: d0015fdd ("batman-adv: provide orig_node routing API")
      Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
      Signed-off-by: default avatarMarek Lindner <mareklindner@neomailbox.ch>
      Signed-off-by: default avatarAntonio Quartulli <a@unstable.cc>
      f7dcdf5f
    • Sven Eckelmann's avatar
      batman-adv: Fix refcnt leak in batadv_v_neigh_* · 71f9d27d
      Sven Eckelmann authored
      The functions batadv_neigh_ifinfo_get increase the reference counter of the
      batadv_neigh_ifinfo. These have to be reduced again when the reference is
      not used anymore to correctly free the objects.
      
      Fixes: 97869060 ("batman-adv: B.A.T.M.A.N. V - implement neighbor comparison API calls")
      Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
      Signed-off-by: default avatarMarek Lindner <mareklindner@neomailbox.ch>
      Signed-off-by: default avatarAntonio Quartulli <a@unstable.cc>
      71f9d27d
    • Sven Eckelmann's avatar
      batman-adv: Avoid nullptr derefence in batadv_v_neigh_is_sob · a45e932a
      Sven Eckelmann authored
      batadv_neigh_ifinfo_get can return NULL when it cannot find (even when only
      temporarily) anymore the neigh_ifinfo in the list neigh->ifinfo_list. This
      has to be checked to avoid kernel Oopses when the ifinfo is dereferenced.
      
      This a situation which isn't expected but is already handled by functions
      like batadv_v_neigh_cmp. The same kind of warning is therefore used before
      the function returns without dereferencing the pointers.
      
      Fixes: 97869060 ("batman-adv: B.A.T.M.A.N. V - implement neighbor comparison API calls")
      Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
      Signed-off-by: default avatarMarek Lindner <mareklindner@neomailbox.ch>
      Signed-off-by: default avatarAntonio Quartulli <a@unstable.cc>
      a45e932a
    • Florian Westphal's avatar
      batman-adv: fix skb deref after free · 63d443ef
      Florian Westphal authored
      batadv_send_skb_to_orig() calls dev_queue_xmit() so we can't use skb->len.
      
      Fixes: 95332477 ("batman-adv: network coding - buffer unicast packets before forward")
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Reviewed-by: default avatarSven Eckelmann <sven@narfation.org>
      Signed-off-by: default avatarMarek Lindner <mareklindner@neomailbox.ch>
      Signed-off-by: default avatarAntonio Quartulli <a@unstable.cc>
      63d443ef
  2. 17 May, 2016 29 commits
  3. 16 May, 2016 3 commits