13 Dec, 2018

2 commits

  • [ Upstream commit d7d8bbb40a5b1f682ee6589e212934f4c6b8ad60 ]

    The complete size ("total_size") of the fragmented packet is stored in the
    fragment header and in the size of the fragment chain. When the fragments
    are ready for merge, the skbuff's tail of the first fragment is expanded to
    have enough room after the data pointer for at least total_size. This means
    that it gets expanded by total_size - first_skb->len.

    But this is ignoring the fact that after expanding the buffer, the fragment
    header is pulled by from this buffer. Assuming that the tailroom of the
    buffer was already 0, the buffer after the data pointer of the skbuff is
    now only total_size - len(fragment_header) large. When the merge function
    is then processing the remaining fragments, the code to copy the data over
    to the merged skbuff will cause an skb_over_panic when it tries to actually
    put enough data to fill the total_size bytes of the packet.

    The size of the skb_pull must therefore also be taken into account when the
    buffer's tailroom is expanded.

    Fixes: 610bfc6bc99b ("batman-adv: Receive fragmented packets and merge")
    Reported-by: Martin Weinelt
    Co-authored-by: Linus Lüssing
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin

    Sven Eckelmann
     
  • [ Upstream commit f4156f9656feac21f4de712fac94fae964c5d402 ]

    The announcement messages of batman-adv COMPAT_VERSION 15 have the
    possibility to announce additional information via a dynamic TVLV part.
    This part is optional for the ELP packets and currently not parsed by the
    Linux implementation. Still out-of-tree versions are using it to transport
    things like neighbor hashes to optimize the rebroadcast behavior.

    Since the ELP broadcast packets are smaller than the minimal ethernet
    packet, it often has to be padded. This is often done (as specified in
    RFC894) with octets of zero and thus work perfectly fine with the TVLV
    part (making it a zero length and thus empty). But not all ethernet
    compatible hardware seems to follow this advice. To avoid ambiguous
    situations when parsing the TVLV header, just force the 4 bytes (TVLV
    length + padding) after the required ELP header to zero.

    Fixes: d6f94d91f766 ("batman-adv: ELP - adding basic infrastructure")
    Reported-by: Linus Lüssing
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin

    Sven Eckelmann
     

20 Oct, 2018

10 commits

  • [ Upstream commit 4c4af6900844ab04c9434c972021d7b48610e06a ]

    The hardif_neigh refcounter is to be decreased by the queued work and
    currently is never decreased if the queue_work() call fails.
    Fix by checking the queue_work() return value and decrease refcount
    if necessary.

    Signed-off-by: Marek Lindner
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Marek Lindner
     
  • [ Upstream commit 5af96b9c59c72fb2af2d19c5cc2f3cdcee391dff ]

    The backbone_gw refcounter is to be decreased by the queued work and
    currently is never decreased if the queue_work() call fails.
    Fix by checking the queue_work() return value and decrease refcount
    if necessary.

    Signed-off-by: Marek Lindner
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Marek Lindner
     
  • [ Upstream commit ae3cdc97dc10c7a3b31f297dab429bfb774c9ccb ]

    The function batadv_tvlv_handler_register is responsible for adding new
    tvlv_handler to the handler_list. It first checks whether the entry
    already is in the list or not. If it is, then the creation of a new entry
    is aborted.

    But the lock for the list is only held when the list is really modified.
    This could lead to duplicated entries because another context could create
    an entry with the same key between the check and the list manipulation.

    The check and the manipulation of the list must therefore be in the same
    locked code section.

    Fixes: ef26157747d4 ("batman-adv: tvlv - basic infrastructure")
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Sven Eckelmann
     
  • [ Upstream commit e7136e48ffdfb9f37b0820f619380485eb407361 ]

    The function batadv_tt_global_orig_entry_add is responsible for adding new
    tt_orig_list_entry to the orig_list. It first checks whether the entry
    already is in the list or not. If it is, then the creation of a new entry
    is aborted.

    But the lock for the list is only held when the list is really modified.
    This could lead to duplicated entries because another context could create
    an entry with the same key between the check and the list manipulation.

    The check and the manipulation of the list must therefore be in the same
    locked code section.

    Fixes: d657e621a0f5 ("batman-adv: add reference counting for type batadv_tt_orig_list_entry")
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Sven Eckelmann
     
  • [ Upstream commit 94cb82f594ed86be303398d6dfc7640a6f1d45d4 ]

    The function batadv_softif_vlan_get is responsible for adding new
    softif_vlan to the softif_vlan_list. It first checks whether the entry
    already is in the list or not. If it is, then the creation of a new entry
    is aborted.

    But the lock for the list is only held when the list is really modified.
    This could lead to duplicated entries because another context could create
    an entry with the same key between the check and the list manipulation.

    The check and the manipulation of the list must therefore be in the same
    locked code section.

    Fixes: 5d2c05b21337 ("batman-adv: add per VLAN interface attribute framework")
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Sven Eckelmann
     
  • [ Upstream commit fa122fec8640eb7186ce5a41b83a4c1744ceef8f ]

    The function batadv_nc_get_nc_node is responsible for adding new nc_nodes
    to the in_coding_list and out_coding_list. It first checks whether the
    entry already is in the list or not. If it is, then the creation of a new
    entry is aborted.

    But the lock for the list is only held when the list is really modified.
    This could lead to duplicated entries because another context could create
    an entry with the same key between the check and the list manipulation.

    The check and the manipulation of the list must therefore be in the same
    locked code section.

    Fixes: d56b1705e28c ("batman-adv: network coding - detect coding nodes and remove these after timeout")
    Signed-off-by: Sven Eckelmann
    Acked-by: Marek Lindner
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Sven Eckelmann
     
  • [ Upstream commit dff9bc42ab0b2d38c5e90ddd79b238fed5b4c7ad ]

    The function batadv_gw_node_add is responsible for adding new gw_node to
    the gateway_list. It is expecting that the caller already checked that
    there is not already an entry with the same key or not.

    But the lock for the list is only held when the list is really modified.
    This could lead to duplicated entries because another context could create
    an entry with the same key between the check and the list manipulation.

    The check and the manipulation of the list must therefore be in the same
    locked code section.

    Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
    Signed-off-by: Sven Eckelmann
    Acked-by: Marek Lindner
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Sven Eckelmann
     
  • [ Upstream commit a25bab9d723a08bd0bdafb1529faf9094c690b70 ]

    The per hardif sysfs file "batman_adv/elp_interval" is using the generic
    functions to store/show uint values. The helper __batadv_store_uint_attr
    requires the softif net_device as parameter to print the resulting change
    as info text when the users writes to this file. It uses the helper
    function batadv_info to add it at the same time to the kernel ring buffer
    and to the batman-adv debug log (when CONFIG_BATMAN_ADV_DEBUG is enabled).

    The function batadv_info requires as first parameter the batman-adv softif
    net_device. This parameter is then used to find the private buffer which
    contains the debug log for this batman-adv interface. But
    batadv_store_throughput_override used as first argument the slave
    net_device. This slave device doesn't have the batadv_priv private data
    which is access by batadv_info.

    Writing to this file with CONFIG_BATMAN_ADV_DEBUG enabled can either lead
    to a segfault or to memory corruption.

    Fixes: 0744ff8fa8fa ("batman-adv: Add hard_iface specific sysfs wrapper macros for UINT")
    Signed-off-by: Sven Eckelmann
    Acked-by: Marek Lindner
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Sven Eckelmann
     
  • [ Upstream commit b9fd14c20871e6189f635e49b32d7789e430b3c8 ]

    The per hardif sysfs file "batman_adv/throughput_override" prints the
    resulting change as info text when the users writes to this file. It uses
    the helper function batadv_info to add it at the same time to the kernel
    ring buffer and to the batman-adv debug log (when CONFIG_BATMAN_ADV_DEBUG
    is enabled).

    The function batadv_info requires as first parameter the batman-adv softif
    net_device. This parameter is then used to find the private buffer which
    contains the debug log for this batman-adv interface. But
    batadv_store_throughput_override used as first argument the slave
    net_device. This slave device doesn't have the batadv_priv private data
    which is access by batadv_info.

    Writing to this file with CONFIG_BATMAN_ADV_DEBUG enabled can either lead
    to a segfault or to memory corruption.

    Fixes: 0b5ecc6811bd ("batman-adv: add throughput override attribute to hard_ifaces")
    Signed-off-by: Sven Eckelmann
    Acked-by: Marek Lindner
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Sven Eckelmann
     
  • [ Upstream commit 88d0895d0ea9d4431507d576c963f2ff9918144d ]

    The probe ELPs for WiFi interfaces are expanded to contain at least
    BATADV_ELP_MIN_PROBE_SIZE bytes. This is usually a lot more than the
    number of bytes which the template ELP packet requires.

    These extra padding bytes were not initialized and thus could contain data
    which were previously stored at the same location. It is therefore required
    to set it to some predefined or random values to avoid leaking private
    information from the system transmitting these kind of packets.

    Fixes: e4623c913508 ("batman-adv: Avoid probe ELP information leak")
    Signed-off-by: Sven Eckelmann
    Acked-by: Antonio Quartulli
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Sven Eckelmann
     

24 Aug, 2018

4 commits

  • [ Upstream commit a44ebeff6bbd6ef50db41b4195fca87b21aefd20 ]

    When a (broken) node wrongly sends multicast TT entries with a ROAM
    flag then this causes any receiving node to drop all entries for the
    same multicast MAC address announced by other nodes, leading to
    packet loss.

    Fix this DoS vector by only storing TT sync flags. For multicast TT
    non-sync'ing flag bits like ROAM are unused so far anyway.

    Fixes: 1d8ab8d3c176 ("batman-adv: Modified forwarding behaviour for multicast packets")
    Reported-by: Leonardo Mörlein
    Signed-off-by: Linus Lüssing
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Linus Lüssing
     
  • [ Upstream commit 4a519b83da16927fb98fd32b0f598e639d1f1859 ]

    Since commit 54e22f265e87 ("batman-adv: fix TT sync flag inconsistencies")
    TT sync flags and TT non-sync'd flags are supposed to be stored
    separately.

    The previous patch missed to apply this separation on a TT entry with
    only a single TT orig entry.

    This is a minor fix because with only a single TT orig entry the DDoS
    issue the former patch solves does not apply.

    Fixes: 54e22f265e87 ("batman-adv: fix TT sync flag inconsistencies")
    Signed-off-by: Linus Lüssing
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Linus Lüssing
     
  • [ Upstream commit 9713cb0cf19f1cec6c007e3b37be0697042b6720 ]

    A reference for the best gateway is taken when the list of gateways in the
    mesh is sent via netlink. This is necessary to check whether the currently
    dumped entry is the currently selected gateway or not. This information is
    then transferred as flag BATADV_ATTR_FLAG_BEST.

    After the comparison of the current entry is done,
    batadv_v_gw_dump_entry() has to decrease the reference counter again.
    Otherwise the reference will be held and thus prevents a proper shutdown of
    the batman-adv interfaces (and some of the interfaces enslaved in it).

    Fixes: b71bb6f924fe ("batman-adv: add B.A.T.M.A.N. V bat_gw_dump implementations")
    Signed-off-by: Sven Eckelmann
    Acked-by: Marek Lindner
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Sven Eckelmann
     
  • [ Upstream commit b5685d2687d6612adf5eac519eb7008f74dfd1ec ]

    A reference for the best gateway is taken when the list of gateways in the
    mesh is sent via netlink. This is necessary to check whether the currently
    dumped entry is the currently selected gateway or not. This information is
    then transferred as flag BATADV_ATTR_FLAG_BEST.

    After the comparison of the current entry is done,
    batadv_iv_gw_dump_entry() has to decrease the reference counter again.
    Otherwise the reference will be held and thus prevents a proper shutdown of
    the batman-adv interfaces (and some of the interfaces enslaved in it).

    Fixes: efb766af06e3 ("batman-adv: add B.A.T.M.A.N. IV bat_gw_dump implementations")
    Reported-by: Andreas Ziegler
    Tested-by: Andreas Ziegler
    Signed-off-by: Sven Eckelmann
    Acked-by: Marek Lindner
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Sven Eckelmann
     

30 May, 2018

11 commits

  • [ Upstream commit a752c0a4524889cdc0765925258fd1fd72344100 ]

    DHCP connectivity issues can currently occur if the following conditions
    are met:

    1) A DHCP packet from a client to a server
    2) This packet has a multicast destination
    3) This destination has a matching entry in the translation table
    (FF:FF:FF:FF:FF:FF for IPv4, 33:33:00:01:00:02/33:33:00:01:00:03
    for IPv6)
    4) The orig-node determined by TT for the multicast destination
    does not match the orig-node determined by best-gateway-selection

    In this case the DHCP packet will be dropped.

    The "gateway-out-of-range" check is supposed to only be applied to
    unicasted DHCP packets to a specific DHCP server.

    In that case dropping the the unicasted frame forces the client to
    retry via a broadcasted one, but now directed to the new best
    gateway.

    A DHCP packet with broadcast/multicast destination is already ensured to
    always be delivered to the best gateway. Dropping a multicasted
    DHCP packet here will only prevent completing DHCP as there is no
    other fallback.

    So far, it seems the unicast check was implicitly performed by
    expecting the batadv_transtable_search() to return NULL for multicast
    destinations. However, a multicast address could have always ended up in
    the translation table and in fact is now common.

    To fix this potential loss of a DHCP client-to-server packet to a
    multicast address this patch adds an explicit multicast destination
    check to reliably bail out of the gateway-out-of-range check for such
    destinations.

    The issue and fix were tested in the following three node setup:

    - Line topology, A-B-C
    - A: gateway client, DHCP client
    - B: gateway server, hop-penalty increased: 30->60, DHCP server
    - C: gateway server, code modifications to announce FF:FF:FF:FF:FF:FF

    Without this patch, A would never transmit its DHCP Discover packet
    due to an always "out-of-range" condition. With this patch,
    a full DHCP handshake between A and B was possible again.

    Fixes: be7af5cf9cae ("batman-adv: refactoring gateway handling code")
    Signed-off-by: Linus Lüssing
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Linus Lüssing
     
  • [ Upstream commit f8fb3419ead44f9a3136995acd24e35da4525177 ]

    For multicast frames AP isolation is only supposed to be checked on
    the receiving nodes and never on the originating one.

    Furthermore, the isolation or wifi flag bits should only be intepreted
    as such for unicast and never multicast TT entries.

    By injecting flags to the multicast TT entry claimed by a single
    target node it was verified in tests that this multicast address
    becomes unreachable, leading to packet loss.

    Omitting the "src" parameter to the batadv_transtable_search() call
    successfully skipped the AP isolation check and made the target
    reachable again.

    Fixes: 1d8ab8d3c176 ("batman-adv: Modified forwarding behaviour for multicast packets")
    Signed-off-by: Linus Lüssing
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Linus Lüssing
     
  • [ Upstream commit fc04fdb2c8a894283259f5621d31d75610701091 ]

    batadv_check_unicast_ttvn may redirect a packet to itself or another
    originator. This involves rewriting the ttvn and the destination address in
    the batadv unicast header. These field were not yet pulled (with skb rcsum
    update) and thus any change to them also requires a change in the receive
    checksum.

    Reported-by: Matthias Schiffer
    Fixes: a73105b8d4c7 ("batman-adv: improved client announcement mechanism")
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Sven Eckelmann
     
  • [ Upstream commit 6f27d2c2a8c236d296201c19abb8533ec20d212b ]

    Checking for 0 is insufficient: when an SKB without a batadv header, but
    with a VLAN header is received, hdr_size will be 4, making the following
    code interpret the Ethernet header as a batadv header.

    Fixes: be1db4f6615b ("batman-adv: make the Distributed ARP Table vlan aware")
    Signed-off-by: Matthias Schiffer
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Matthias Schiffer
     
  • [ Upstream commit 74c12c630fe310eb7fcae1b292257d47781fff0a ]

    As the kernel doc describes too the code is supposed to skip adding
    multicast TT entries if both the WANT_ALL_IPV4 and WANT_ALL_IPV6 flags
    are present.

    Unfortunately, the current code even skips adding multicast TT entries
    if only either the WANT_ALL_IPV4 or WANT_ALL_IPV6 is present.

    This could lead to IPv6 multicast packet loss if only an IGMP but not an
    MLD querier is present for instance or vice versa.

    Fixes: 687937ab3489 ("batman-adv: Add multicast optimization support for bridged setups")
    Signed-off-by: Linus Lüssing
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Linus Lüssing
     
  • [ Upstream commit fce672db548ff19e76a08a32a829544617229bc2 ]

    The function batadv_bla_backbone_dump_bucket must be able to handle
    non-complete dumps of a single bucket. It tries to do that by saving the
    latest dumped index in *idx_skip to inform the caller about the current
    state.

    But the caller only assumes that buckets were not completely dumped when
    the return code is non-zero. This function must therefore also return a
    non-zero index when the dumping of an entry failed. Otherwise the caller
    will just skip all remaining buckets.

    And the function must also reset *idx_skip back to zero when it finished a
    bucket. Otherwise it will skip the same number of entries in the next
    bucket as the previous one had.

    Fixes: ea4152e11716 ("batman-adv: add backbone table netlink support")
    Reported-by: Linus Lüssing
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Sven Eckelmann
     
  • [ Upstream commit b0264ecdfeab5f889b02ec54af7ca8cc1c245e2f ]

    The function batadv_bla_claim_dump_bucket must be able to handle
    non-complete dumps of a single bucket. It tries to do that by saving the
    latest dumped index in *idx_skip to inform the caller about the current
    state.

    But the caller only assumes that buckets were not completely dumped when
    the return code is non-zero. This function must therefore also return a
    non-zero index when the dumping of an entry failed. Otherwise the caller
    will just skip all remaining buckets.

    And the function must also reset *idx_skip back to zero when it finished a
    bucket. Otherwise it will skip the same number of entries in the next
    bucket as the previous one had.

    Fixes: 04f3f5bf1883 ("batman-adv: add B.A.T.M.A.N. Dump BLA claims via netlink")
    Reported-by: Linus Lüssing
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Sven Eckelmann
     
  • [ Upstream commit 011c935fceae5252619ef730baa610c655281dda ]

    The function batadv_v_gw_dump stops the processing loop when
    batadv_v_gw_dump_entry returns a non-0 return code. This should only
    happen when the buffer is full. Otherwise, an empty message may be
    returned by batadv_gw_dump. This empty message will then stop the netlink
    dumping of gateway entries. At worst, not a single entry is returned to
    userspace even when plenty of possible gateways exist.

    Fixes: b71bb6f924fe ("batman-adv: add B.A.T.M.A.N. V bat_gw_dump implementations")
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Sven Eckelmann
     
  • [ Upstream commit 10d570284258a30dc104c50787c5289ec49f3d23 ]

    The function batadv_iv_gw_dump stops the processing loop when
    batadv_iv_gw_dump_entry returns a non-0 return code. This should only
    happen when the buffer is full. Otherwise, an empty message may be
    returned by batadv_gw_dump. This empty message will then stop the netlink
    dumping of gateway entries. At worst, not a single entry is returned to
    userspace even when plenty of possible gateways exist.

    Fixes: efb766af06e3 ("batman-adv: add B.A.T.M.A.N. IV bat_gw_dump implementations")
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Sven Eckelmann
     
  • [ Upstream commit 3bf2a09da956b43ecfaa630a2ef9a477f991a46a ]

    A more sophisticated implementation could try to combine fragment checksums
    when all fragments have CHECKSUM_COMPLETE and are split at even offsets.
    For now, we just set ip_summed to CHECKSUM_NONE to avoid "hw csum failure"
    warnings in the kernel log when fragmented frames are received. In
    consequence, skb_pull_rcsum() can be replaced with skb_pull().

    Note that in usual setups, packets don't reach batman-adv with
    CHECKSUM_COMPLETE (I assume NICs bail out of checksumming when they see
    batadv's ethtype?), which is why the log messages do not occur on every
    system using batman-adv. I could reproduce this issue by stacking
    batman-adv on top of a VXLAN interface.

    Fixes: 610bfc6bc99b ("batman-adv: Receive fragmented packets and merge")
    Tested-by: Maximilian Wilhelm
    Signed-off-by: Matthias Schiffer
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Matthias Schiffer
     
  • [ Upstream commit abd6360591d3f8259f41c34e31ac4826dfe621b8 ]

    eth_type_trans() internally calls skb_pull(), which does not adjust the
    skb checksum; skb_postpull_rcsum() is necessary to avoid log spam of the
    form "bat0: hw csum failure" when packets with CHECKSUM_COMPLETE are
    received.

    Note that in usual setups, packets don't reach batman-adv with
    CHECKSUM_COMPLETE (I assume NICs bail out of checksumming when they see
    batadv's ethtype?), which is why the log messages do not occur on every
    system using batman-adv. I could reproduce this issue by stacking
    batman-adv on top of a VXLAN interface.

    Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
    Tested-by: Maximilian Wilhelm
    Signed-off-by: Matthias Schiffer
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Matthias Schiffer
     

10 Aug, 2017

1 commit

  • The UDP offload conflict is dealt with by simply taking what is
    in net-next where we have removed all of the UFO handling code
    entirely.

    The TCP conflict was a case of local variables in a function
    being removed from both net and net-next.

    In netvsc we had an assignment right next to where a missing
    set of u64 stats sync object inits were added.

    Signed-off-by: David S. Miller

    David S. Miller
     

31 Jul, 2017

1 commit

  • This patch fixes an issue in the translation table code potentially
    leading to a TT Request + Response storm. The issue may occur for nodes
    involving BLA and an inconsistent configuration of the batman-adv AP
    isolation feature. However, since the new multicast optimizations, a
    single, malformed packet may lead to a mesh-wide, persistent
    Denial-of-Service, too.

    The issue occurs because nodes are currently OR-ing the TT sync flags of
    all originators announcing a specific MAC address via the
    translation table. When an intermediate node now receives a TT Request
    and wants to answer this on behalf of the destination node, then this
    intermediate node now responds with an altered flag field and broken
    CRC. The next OGM of the real destination will lead to a CRC mismatch
    and triggering a TT Request and Response again.

    Furthermore, the OR-ing is currently never undone as long as at least
    one originator announcing the according MAC address remains, leading to
    the potential persistency of this issue.

    This patch fixes this issue by storing the flags used in the CRC
    calculation on a a per TT orig entry basis to be able to respond with
    the correct, original flags in an intermediate TT Response for one
    thing. And to be able to correctly unset sync flags once all nodes
    announcing a sync flag vanish for another.

    Fixes: e9c00136a475 ("batman-adv: fix tt_global_entries flags update")
    Signed-off-by: Linus Lüssing
    Acked-by: Antonio Quartulli
    [sw: typo in commit message]
    Signed-off-by: Simon Wunderlich

    Linus Lüssing
     

29 Jul, 2017

5 commits


16 Jun, 2017

3 commits

  • It seems like a historic accident that these return unsigned char *,
    and in many places that means casts are required, more often than not.

    Make these functions (skb_put, __skb_put and pskb_put) return void *
    and remove all the casts across the tree, adding a (u8 *) cast only
    where the unsigned char pointer was used directly, all done with the
    following spatch:

    @@
    expression SKB, LEN;
    typedef u8;
    identifier fn = { skb_put, __skb_put };
    @@
    - *(fn(SKB, LEN))
    + *(u8 *)fn(SKB, LEN)

    @@
    expression E, SKB, LEN;
    identifier fn = { skb_put, __skb_put };
    type T;
    @@
    - E = ((T *)(fn(SKB, LEN)))
    + E = fn(SKB, LEN)

    which actually doesn't cover pskb_put since there are only three
    users overall.

    A handful of stragglers were converted manually, notably a macro in
    drivers/isdn/i4l/isdn_bsdcomp.c and, oddly enough, one of the many
    instances in net/bluetooth/hci_sock.c. In the former file, I also
    had to fix one whitespace problem spatch introduced.

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     
  • A common pattern with skb_put() is to just want to memcpy()
    some data into the new space, introduce skb_put_data() for
    this.

    An spatch similar to the one for skb_put_zero() converts many
    of the places using it:

    @@
    identifier p, p2;
    expression len, skb, data;
    type t, t2;
    @@
    (
    -p = skb_put(skb, len);
    +p = skb_put_data(skb, data, len);
    |
    -p = (t)skb_put(skb, len);
    +p = skb_put_data(skb, data, len);
    )
    (
    p2 = (t2)p;
    -memcpy(p2, data, len);
    |
    -memcpy(p, data, len);
    )

    @@
    type t, t2;
    identifier p, p2;
    expression skb, data;
    @@
    t *p;
    ...
    (
    -p = skb_put(skb, sizeof(t));
    +p = skb_put_data(skb, data, sizeof(t));
    |
    -p = (t *)skb_put(skb, sizeof(t));
    +p = skb_put_data(skb, data, sizeof(t));
    )
    (
    p2 = (t2)p;
    -memcpy(p2, data, sizeof(*p));
    |
    -memcpy(p, data, sizeof(*p));
    )

    @@
    expression skb, len, data;
    @@
    -memcpy(skb_put(skb, len), data, len);
    +skb_put_data(skb, data, len);

    (again, manually post-processed to retain some comments)

    Reviewed-by: Stephen Hemminger
    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     
  • There were many places that my previous spatch didn't find,
    as pointed out by yuan linyu in various patches.

    The following spatch found many more and also removes the
    now unnecessary casts:

    @@
    identifier p, p2;
    expression len;
    expression skb;
    type t, t2;
    @@
    (
    -p = skb_put(skb, len);
    +p = skb_put_zero(skb, len);
    |
    -p = (t)skb_put(skb, len);
    +p = skb_put_zero(skb, len);
    )
    ... when != p
    (
    p2 = (t2)p;
    -memset(p2, 0, len);
    |
    -memset(p, 0, len);
    )

    @@
    type t, t2;
    identifier p, p2;
    expression skb;
    @@
    t *p;
    ...
    (
    -p = skb_put(skb, sizeof(t));
    +p = skb_put_zero(skb, sizeof(t));
    |
    -p = (t *)skb_put(skb, sizeof(t));
    +p = skb_put_zero(skb, sizeof(t));
    )
    ... when != p
    (
    p2 = (t2)p;
    -memset(p2, 0, sizeof(*p));
    |
    -memset(p, 0, sizeof(*p));
    )

    @@
    expression skb, len;
    @@
    -memset(skb_put(skb, len), 0, len);
    +skb_put_zero(skb, len);

    Apply it to the tree (with one manual fixup to keep the
    comment in vxlan.c, which spatch removed.)

    Signed-off-by: Johannes Berg
    Signed-off-by: David S. Miller

    Johannes Berg
     

15 Jun, 2017

1 commit


14 Jun, 2017

1 commit


13 Jun, 2017

1 commit

  • The wifi driver can decide to not provide parts of the station info. For
    example, the expected throughput of the station can be omitted when the
    used rate control doesn't provide this kind of information.

    The B.A.T.M.A.N. V implementation must therefore check the filled bitfield
    before it tries to access the expected_throughput of the returned
    station_info.

    Reported-by: Alvaro Antelo
    Fixes: c833484e5f38 ("batman-adv: ELP - compute the metric based on the estimated throughput")
    Signed-off-by: Sven Eckelmann
    Reviewed-by: Marek Lindner
    Signed-off-by: Simon Wunderlich

    Sven Eckelmann