20 Oct, 2018

1 commit

  • [ Upstream commit 5af96b9c59c72fb2af2d19c5cc2f3cdcee391dff ]

    The backbone_gw refcounter is to be decreased by the queued work and
    currently is never decreased if the queue_work() call fails.
    Fix by checking the queue_work() return value and decrease refcount
    if necessary.

    Signed-off-by: Marek Lindner
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Marek Lindner
     

30 May, 2018

2 commits

  • [ Upstream commit fce672db548ff19e76a08a32a829544617229bc2 ]

    The function batadv_bla_backbone_dump_bucket must be able to handle
    non-complete dumps of a single bucket. It tries to do that by saving the
    latest dumped index in *idx_skip to inform the caller about the current
    state.

    But the caller only assumes that buckets were not completely dumped when
    the return code is non-zero. This function must therefore also return a
    non-zero index when the dumping of an entry failed. Otherwise the caller
    will just skip all remaining buckets.

    And the function must also reset *idx_skip back to zero when it finished a
    bucket. Otherwise it will skip the same number of entries in the next
    bucket as the previous one had.

    Fixes: ea4152e11716 ("batman-adv: add backbone table netlink support")
    Reported-by: Linus Lüssing
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Sven Eckelmann
     
  • [ Upstream commit b0264ecdfeab5f889b02ec54af7ca8cc1c245e2f ]

    The function batadv_bla_claim_dump_bucket must be able to handle
    non-complete dumps of a single bucket. It tries to do that by saving the
    latest dumped index in *idx_skip to inform the caller about the current
    state.

    But the caller only assumes that buckets were not completely dumped when
    the return code is non-zero. This function must therefore also return a
    non-zero index when the dumping of an entry failed. Otherwise the caller
    will just skip all remaining buckets.

    And the function must also reset *idx_skip back to zero when it finished a
    bucket. Otherwise it will skip the same number of entries in the next
    bucket as the previous one had.

    Fixes: 04f3f5bf1883 ("batman-adv: add B.A.T.M.A.N. Dump BLA claims via netlink")
    Reported-by: Linus Lüssing
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    Sven Eckelmann
     

23 May, 2017

1 commit

  • The function names in batman-adv changed slightly in the past. But some of
    the debug messages were not updated correctly and therefore some messages
    were incorrect. To avoid this in the future, these kind of messages should
    use __func__ to automatically print the correct function name.

    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich

    Sven Eckelmann
     

22 Mar, 2017

3 commits

  • Consider the following situation which has been found in a test setup:
    Gateway B has claimed client C and gateway A has the same backbone
    network as B. C sends a broad- or multicast to B and directly after
    this packet decides to send another packet to A due to a better TQ
    value. B will forward the broad-/multicast into the backbone as it is
    the responsible gw and after that A will claim C as it has been
    chosen by C as the best gateway. If it now happens that A claims C
    before it has received the broad-/multicast forwarded by B (due to
    backbone topology or due to some delay in B when forwarding the
    packet) we get a critical situation: in the current code A will
    immediately unclaim C when receiving the multicast due to the
    roaming client scenario although the position of C has not changed
    in the mesh. If this happens the multi-/broadcast forwarded by B
    will be sent back into the mesh by A and we have looping packets
    until one of the gateways claims C again.
    In order to prevent this, unclaiming of a client due to the roaming
    client scenario is only done after a certain time is expired after
    the last claim of the client. 100 ms are used here, which should be
    slow enough for big backbones and slow gateways but fast enough not
    to break the roaming client use case.

    Acked-by: Simon Wunderlich
    Signed-off-by: Andreas Pape
    [sven@narfation.org: fix conflicts with current version]
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich

    Andreas Pape
     
  • Some of the bla debug messages are extended and additional messages are
    added for easier bla debugging. Some debug messages introduced with the
    dat changes in prior patches of this patch series have been changed to
    be more compliant to other existing debug messages.

    Acked-by: Simon Wunderlich
    Signed-off-by: Andreas Pape
    [sven@narfation.org: fix conflicts with current version]
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich

    Andreas Pape
     
  • If dat is enabled it must be made sure that only the backbone gw which has
    claimed the remote destination for the ARP request answers the ARP request
    directly if the MAC address is known due to the local dat table. This
    prevents multiple ARP replies in a common backbone if more than one
    gateway already knows the remote mac searched for in the ARP request.

    Signed-off-by: Andreas Pape
    Acked-by: Simon Wunderlich
    [sven@narfation.org: fix conflicts with current version]
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich

    Andreas Pape
     

17 Mar, 2017

1 commit


27 Jan, 2017

1 commit

  • Simon Wunderlich says:

    ====================
    This feature/cleanup patchset includes the following patches:

    - bump version strings, by Simon Wunderlich

    - ignore self-generated loop detect MAC addresses in translation table,
    by Simon Wunderlich

    - install uapi batman_adv.h header, by Sven Eckelmann

    - bump copyright years, by Sven Eckelmann

    - Remove an unused variable in translation table code, by Sven Eckelmann

    - Handle NET_XMIT_CN like NET_XMIT_SUCCESS (revised according to Davids
    suggestion), and a follow up code clean up, by Gao Feng (2 patches)
    ====================

    Signed-off-by: David S. Miller

    David S. Miller
     

26 Jan, 2017

1 commit


19 Jan, 2017

1 commit

  • The network stack no longer uses the last_rx member of struct net_device
    since the bonding driver switched to use its own private last_rx in
    commit 9f242738376d ("bonding: use last_arp_rx in slave_last_rx()").

    However, some drivers still (ab)use the field for their own purposes and
    some driver just update it without actually using it.

    Previously, there was an accompanying comment for the last_rx member
    added in commit 4dc89133f49b ("net: add a comment on netdev->last_rx")
    which asked drivers not to update is, unless really needed. However,
    this commend was removed in commit f8ff080dacec ("bonding: remove
    useless updating of slave->dev->last_rx"), so some drivers added later
    on still did update last_rx.

    Remove all usage of last_rx and switch three drivers (sky2, atp and
    smc91c92_cs) which actually read and write it to use their own private
    copy in netdev_priv.

    Compile-tested with allyesconfig and allmodconfig on x86 and arm.

    Cc: Eric Dumazet
    Cc: Jay Vosburgh
    Cc: Veaceslav Falico
    Cc: Andy Gospodarek
    Cc: Mirko Lindner
    Cc: Stephen Hemminger
    Signed-off-by: Tobias Klauser
    Acked-by: Eric Dumazet
    Reviewed-by: Jay Vosburgh
    Signed-off-by: David S. Miller

    Tobias Klauser
     

09 Aug, 2016

6 commits

  • The files provided by batman-adv via debugfs are currently converted to
    netlink. Tools which are not yet converted to use the netlink interface may
    still rely on the old debugfs files. But systems which already upgraded
    their tools can save some space by disabling this feature. The default
    configuration of batman-adv on amd64 can reduce the size of the module by
    around 11% when this feature is disabled.

    $ size net/batman-adv/batman-adv.ko*
    text data bss dec hex filename
    150507 10395 4160 165062 284c6 net/batman-adv/batman-adv.ko.y
    137106 7099 2112 146317 23b8d net/batman-adv/batman-adv.ko.n

    Signed-off-by: Sven Eckelmann
    Signed-off-by: Marek Lindner
    Signed-off-by: Simon Wunderlich

    Sven Eckelmann
     
  • It is hard to understand why the refcnt is increased when it isn't done
    near the actual place the new reference is used. So using kref_get right
    before the place which requires the reference and in the same function
    helps to avoid accidental problems caused by incorrect reference counting.

    Signed-off-by: Sven Eckelmann
    Signed-off-by: Marek Lindner
    Signed-off-by: Simon Wunderlich

    Sven Eckelmann
     
  • It is hard to understand why the refcnt is increased when it isn't done
    near the actual place the new reference is used. So using kref_get right
    before the place which requires the reference and in the same function
    helps to avoid accidental problems caused by incorrect reference counting.

    Signed-off-by: Sven Eckelmann
    Signed-off-by: Marek Lindner
    Signed-off-by: Simon Wunderlich

    Sven Eckelmann
     
  • Dump the list of bridge loop avoidance backbones via the netlink socket.

    Signed-off-by: Simon Wunderlich
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Marek Lindner

    Simon Wunderlich
     
  • Dump the list of bridge loop avoidance claims via the netlink socket.

    Signed-off-by: Andrew Lunn
    [sven.eckelmann@open-mesh.com: add policy for attributes, fix includes, fix
    soft_iface reference leak]
    Signed-off-by: Sven Eckelmann
    [sw@simonwunderlich.de: fix kerneldoc, fix error reporting]
    Signed-off-by: Simon Wunderlich
    Signed-off-by: Marek Lindner

    Andrew Lunn
     
  • net/batman-adv/bridge_loop_avoidance.c:1105:9-10: WARNING: return of 0/1 in function 'batadv_bla_process_claim' with return type bool

    Return statements in functions returning bool should use
    true/false instead of 1/0.
    Generated by: scripts/coccinelle/misc/boolreturn.cocci

    Signed-off-by: Fengguang Wu
    Signed-off-by: Marek Lindner
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Simon Wunderlich

    kbuild test robot
     

24 Jul, 2016

1 commit


05 Jul, 2016

2 commits

  • The pointer batadv_bla_claim::backbone_gw can be changed at any time.
    Therefore, access to it must be protected to ensure that two function
    accessing the same backbone_gw are actually accessing the same. This is
    especially important when the crc_lock is used or when the backbone_gw of a
    claim is exchanged.

    Not doing so leads to invalid memory access and/or reference leaks.

    Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code")
    Fixes: 5a1dd8a4773d ("batman-adv: lock crc access in bridge loop avoidance")
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Marek Lindner
    Signed-off-by: Simon Wunderlich

    Sven Eckelmann
     
  • vlan_insert_tag can return NULL on errors. The bridge loop avoidance code
    therefore has to check the return value of vlan_insert_tag for NULL before
    it can safely operate on this pointer.

    Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code")
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Marek Lindner
    Signed-off-by: Simon Wunderlich

    Sven Eckelmann
     

30 Jun, 2016

1 commit


10 May, 2016

2 commits

  • It is easier to understand that the returned value of a specific function
    doesn't have to be 0 when the functions was successful when the actual
    return type is bool. This is especially true when all surrounding functions
    with return type int use negative values to return the error code.

    Reported-by: Nicholas Krause
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Marek Lindner
    Signed-off-by: Antonio Quartulli

    Sven Eckelmann
     
  • There are network setups where the current bridge loop avoidance can't
    detect bridge loops. The minimal setup affected would consist of two
    LANs and two separate meshes, connected in a ring like that:

    A...(mesh1)...B
    | |
    (LAN1) (LAN2)
    | |
    C...(mesh2)...D

    Since both the meshes and backbones are separate, the bridge loop
    avoidance has not enough information to detect and avoid the loop
    in this case. Even if these scenarios can't be fixed easily,
    these kind of loops can be detected.

    This patch implements a periodic check (running every 60 seconds for
    now) which sends a broadcast frame with a random MAC address on
    each backbone VLAN. If a broadcast frame with the same MAC address
    is received shortly after on the mesh, we know that there must be a
    loop and report that incident as well as throw an uevent to let others
    handle that problem.

    Signed-off-by: Simon Wunderlich
    [sven@narfation.org: fix conflicts with current version]
    Signed-off-by: Sven Eckelmann
    Signed-off-by: Marek Lindner
    Signed-off-by: Antonio Quartulli

    Simon Wunderlich
     

04 May, 2016

5 commits


23 Feb, 2016

4 commits


10 Feb, 2016

2 commits

  • batman-adv uses a self-written reference implementation which is just based
    on atomic_t. This is less obvious when reading the code than kref and
    therefore increases the change that the reference counting will be missed.

    Signed-off-by: Sven Eckelmann
    Signed-off-by: Marek Lindner
    Signed-off-by: Antonio Quartulli

    Sven Eckelmann
     
  • batman-adv uses a self-written reference implementation which is just based
    on atomic_t. This is less obvious when reading the code than kref and
    therefore increases the change that the reference counting will be missed.

    Signed-off-by: Sven Eckelmann
    Signed-off-by: Marek Lindner
    Signed-off-by: Antonio Quartulli

    Sven Eckelmann
     

02 Feb, 2016

4 commits


16 Jan, 2016

1 commit

  • The batadv_claim_free_ref function uses call_rcu to delay the free of the
    batadv_bla_claim object until no (already started) rcu_read_lock is enabled
    anymore. This makes sure that no context is still trying to access the
    object which should be removed. But batadv_bla_claim also contains a
    reference to backbone_gw which must be removed.

    The reference drop of backbone_gw was done in the call_rcu function
    batadv_claim_free_rcu but should actually be done in the
    batadv_claim_release function to avoid nested call_rcus. This is important
    because rcu_barrier (e.g. batadv_softif_free or batadv_exit) will not
    detect the inner call_rcu as relevant for its execution. Otherwise this
    barrier will most likely be inserted in the queue before the callback of
    the first call_rcu was executed. The caller of rcu_barrier will therefore
    continue to run before the inner call_rcu callback finished.

    Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code")
    Signed-off-by: Sven Eckelmann
    Acked-by: Simon Wunderlich
    Signed-off-by: Marek Lindner
    Signed-off-by: Antonio Quartulli

    Sven Eckelmann
     

09 Jan, 2016

1 commit

  • When bridge loop avoidance is disabled through sysfs, the internal
    datastructures are not disabled, but only BLA operations are disabled.
    To be sure that they are removed, purge the data immediately. That is
    especially useful if a firmwares network state is changed, and the BLA
    wait periods should restart on the new network.

    Signed-off-by: Simon Wunderlich
    Signed-off-by: Marek Lindner
    Signed-off-by: Antonio Quartulli

    Simon Wunderlich