Patch "batman-adv: Fix broadcast/ogm queue limit on a removed interface" has been added to the 3.14-stable tree

Patch "batman-adv: Fix broadcast/ogm queue limit on a removed interface" has been added to the 3.14-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    batman-adv: Fix broadcast/ogm queue limit on a removed interface

to the 3.14-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     batman-adv-fix-broadcast-ogm-queue-limit-on-a-removed-interface.patch
and it can be found in the queue-3.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From c4fdb6cff2aa0ae740c5f19b6f745cbbe786d42f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
Date: Fri, 11 Mar 2016 14:04:49 +0100
Subject: batman-adv: Fix broadcast/ogm queue limit on a removed interface
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From: Linus Lüssing <linus.luessing@c0d3.blue>

commit c4fdb6cff2aa0ae740c5f19b6f745cbbe786d42f upstream.

When removing a single interface while a broadcast or ogm packet is
still pending then we will free the forward packet without releasing the
queue slots again.

This patch is supposed to fix this issue.

Fixes: 6d5808d4ae1b ("batman-adv: Add missing hardif_free_ref in forw_packet_free")
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
[sven@narfation.org: fix conflicts with current version]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <a@unstable.cc>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/batman-adv/send.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -637,6 +637,12 @@ batadv_purge_outstanding_packets(struct
 
 		if (pending) {
 			hlist_del(&forw_packet->list);
+			if (!forw_packet->own)
+				atomic_inc(&bat_priv->bcast_queue_left);
+
+			if (!forw_packet->own)
+				atomic_inc(&bat_priv->batman_queue_left);
+
 			batadv_forw_packet_free(forw_packet);
 		}
 	}


Patches currently in stable-queue which might be from linus.luessing@c0d3.blue are

queue-3.14/batman-adv-fix-broadcast-ogm-queue-limit-on-a-removed-interface.patch

Re: Patch "batman-adv: Fix broadcast/ogm queue limit on a removed interface" has been added to the 3.14-stable tree

[Sven Eckelmann]

[-- Attachment #1: Type: text/plain, Size: 1658 bytes --]

On Friday 06 May 2016 14:36:56 gregkh@linuxfoundation.org wrote:
[...]
> The filename of the patch is:
>      batman-adv-fix-broadcast-ogm-queue-limit-on-a-removed-interface.patch
> and it can be found in the queue-3.14 subdirectory.
[...]
> --- a/net/batman-adv/send.c
> +++ b/net/batman-adv/send.c
> @@ -637,6 +637,12 @@ batadv_purge_outstanding_packets(struct
> 
>  		if (pending) {
>  			hlist_del(&forw_packet->list);
> +			if (!forw_packet->own)
> +				atomic_inc(&bat_priv->bcast_queue_left);
> +
> +			if (!forw_packet->own)
> +				atomic_inc(&bat_priv->batman_queue_left);
> +
>  			batadv_forw_packet_free(forw_packet);
>  		}
>  	}
> 

This looks odd. Why is this commit doing the inc twice in the same place? 
Looks different than the origin patch (which does it for two different 
places):

https://patchwork.open-mesh.org/patch/15974/

Same for the 4.4 and 4.5 stable changes. I've cherry-picked the commit for 
3.14 and my results look like this (not even compile tested):

--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -610,6 +610,9 @@ batadv_purge_outstanding_packets(struct batadv_priv 
*bat_priv,
 
 		if (pending) {
 			hlist_del(&forw_packet->list);
+			if (!forw_packet->own)
+				atomic_inc(&bat_priv->bcast_queue_left);
+
 			batadv_forw_packet_free(forw_packet);
 		}
 	}
@@ -637,6 +640,9 @@ batadv_purge_outstanding_packets(struct batadv_priv 
*bat_priv,
 
 		if (pending) {
 			hlist_del(&forw_packet->list);
+			if (!forw_packet->own)
+				atomic_inc(&bat_priv->batman_queue_left);
+
 			batadv_forw_packet_free(forw_packet);
 		}
 	}



Kind regards,
	Sven

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: Patch "batman-adv: Fix broadcast/ogm queue limit on a removed interface" has been added to the 3.14-stable tree

[Greg KH]

On Fri, May 06, 2016 at 10:03:50PM +0200, Sven Eckelmann wrote:
> On Friday 06 May 2016 14:36:56 gregkh@linuxfoundation.org wrote:
> [...]
> > The filename of the patch is:
> >      batman-adv-fix-broadcast-ogm-queue-limit-on-a-removed-interface.patch
> > and it can be found in the queue-3.14 subdirectory.
> [...]
> > --- a/net/batman-adv/send.c
> > +++ b/net/batman-adv/send.c
> > @@ -637,6 +637,12 @@ batadv_purge_outstanding_packets(struct
> > 
> >  		if (pending) {
> >  			hlist_del(&forw_packet->list);
> > +			if (!forw_packet->own)
> > +				atomic_inc(&bat_priv->bcast_queue_left);
> > +
> > +			if (!forw_packet->own)
> > +				atomic_inc(&bat_priv->batman_queue_left);
> > +
> >  			batadv_forw_packet_free(forw_packet);
> >  		}
> >  	}
> > 
> 
> This looks odd. Why is this commit doing the inc twice in the same place? 
> Looks different than the origin patch (which does it for two different 
> places):
> 
> https://patchwork.open-mesh.org/patch/15974/
> 
> Same for the 4.4 and 4.5 stable changes. I've cherry-picked the commit for 
> 3.14 and my results look like this (not even compile tested):
> 
> --- a/net/batman-adv/send.c
> +++ b/net/batman-adv/send.c
> @@ -610,6 +610,9 @@ batadv_purge_outstanding_packets(struct batadv_priv 
> *bat_priv,
>  
>  		if (pending) {
>  			hlist_del(&forw_packet->list);
> +			if (!forw_packet->own)
> +				atomic_inc(&bat_priv->bcast_queue_left);
> +
>  			batadv_forw_packet_free(forw_packet);
>  		}
>  	}
> @@ -637,6 +640,9 @@ batadv_purge_outstanding_packets(struct batadv_priv 
> *bat_priv,
>  
>  		if (pending) {
>  			hlist_del(&forw_packet->list);
> +			if (!forw_packet->own)
> +				atomic_inc(&bat_priv->batman_queue_left);
> +
>  			batadv_forw_packet_free(forw_packet);
>  		}
>  	}
> 

Oh that's really odd, thanks for letting me know.  Let me try to figure
out what went wrong...

greg k-h

Re: Patch "batman-adv: Fix broadcast/ogm queue limit on a removed interface" has been added to the 3.14-stable tree

[Greg KH]

On Sat, May 07, 2016 at 12:40:12AM -0400, Greg KH wrote:
> On Fri, May 06, 2016 at 10:03:50PM +0200, Sven Eckelmann wrote:
> > On Friday 06 May 2016 14:36:56 gregkh@linuxfoundation.org wrote:
> > [...]
> > > The filename of the patch is:
> > >      batman-adv-fix-broadcast-ogm-queue-limit-on-a-removed-interface.patch
> > > and it can be found in the queue-3.14 subdirectory.
> > [...]
> > > --- a/net/batman-adv/send.c
> > > +++ b/net/batman-adv/send.c
> > > @@ -637,6 +637,12 @@ batadv_purge_outstanding_packets(struct
> > > 
> > >  		if (pending) {
> > >  			hlist_del(&forw_packet->list);
> > > +			if (!forw_packet->own)
> > > +				atomic_inc(&bat_priv->bcast_queue_left);
> > > +
> > > +			if (!forw_packet->own)
> > > +				atomic_inc(&bat_priv->batman_queue_left);
> > > +
> > >  			batadv_forw_packet_free(forw_packet);
> > >  		}
> > >  	}
> > > 
> > 
> > This looks odd. Why is this commit doing the inc twice in the same place? 
> > Looks different than the origin patch (which does it for two different 
> > places):
> > 
> > https://patchwork.open-mesh.org/patch/15974/
> > 
> > Same for the 4.4 and 4.5 stable changes. I've cherry-picked the commit for 
> > 3.14 and my results look like this (not even compile tested):
> > 
> > --- a/net/batman-adv/send.c
> > +++ b/net/batman-adv/send.c
> > @@ -610,6 +610,9 @@ batadv_purge_outstanding_packets(struct batadv_priv 
> > *bat_priv,
> >  
> >  		if (pending) {
> >  			hlist_del(&forw_packet->list);
> > +			if (!forw_packet->own)
> > +				atomic_inc(&bat_priv->bcast_queue_left);
> > +
> >  			batadv_forw_packet_free(forw_packet);
> >  		}
> >  	}
> > @@ -637,6 +640,9 @@ batadv_purge_outstanding_packets(struct batadv_priv 
> > *bat_priv,
> >  
> >  		if (pending) {
> >  			hlist_del(&forw_packet->list);
> > +			if (!forw_packet->own)
> > +				atomic_inc(&bat_priv->batman_queue_left);
> > +
> >  			batadv_forw_packet_free(forw_packet);
> >  		}
> >  	}
> > 
> 
> Oh that's really odd, thanks for letting me know.  Let me try to figure
> out what went wrong...

This looks like a bug in patch.  Git creates the correct patch, but when
patch imports it, it messes it up and creates the version you saw.

I hand edited the file after it was patched to fix this up.

If I get a chance I'll go file a bug with the patch developers.

thanks,

greg k-h