[B.A.T.M.A.N.] batman-adv crash on Intel 3945ABG & 4965 AGN

[B.A.T.M.A.N.] batman-adv crash on Intel 3945ABG & 4965 AGN

[Marek Lindner]

[-- Attachment #1: Type: text/plain, Size: 492 bytes --]


Hi,

2 days ago I proposed a patch which fixes the crash you reported in ticket 
#141. Although you confirmed the patch solves the issue I haven't pushed it yet 
as the cause seems to be a bug within the Intel driver and should be fixed 
there (unless we do something horribly wrong). 
Could you please let us know the driver version that was used in your test 
setup ? A 'modinfo iwlagn | grep version' should do. We will then get in touch 
with the Intel wifi maintainers.

Regards,
Marek

[-- Attachment #2: 0001-batman-adv-dropped-skbs-that-are-too-short-intel-bug.patch --]
[-- Type: text/x-patch, Size: 1099 bytes --]

From a2496fe3ade7f6295b47f1271279de319831a8a7 Mon Sep 17 00:00:00 2001
From: Marek Lindner <lindner_marek@yahoo.de>
Date: Sun, 21 Nov 2010 14:15:22 +0100
Subject: [PATCH] batman-adv: dropped skbs that are too short (intel bug?)

Reported-by: Lesniak <lesniak@sra.uni-hannover.de>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
---
 batman-adv/soft-interface.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/batman-adv/soft-interface.c b/batman-adv/soft-interface.c
index e93a99f..6ba796f 100644
--- a/batman-adv/soft-interface.c
+++ b/batman-adv/soft-interface.c
@@ -493,6 +493,11 @@ void interface_rx(struct net_device *soft_iface,
 		goto out;
 	}
 
+	printk(KERN_INFO "interface_rx(): skb->len: %i, skb->data_len: %i, bug: %i\n", skb->len, skb->data_len, skb->len - ETH_HLEN < skb->data_len);
+	if (!pskb_may_pull(skb, ETH_HLEN)) {
+		printk(KERN_INFO "interface_rx(): dropping small packet\n");
+		goto dropped;
+	}
 	/* skb->dev & skb->pkt_type are set here */
 	skb->protocol = eth_type_trans(skb, soft_iface);
 
-- 
1.7.2.3

[B.A.T.M.A.N.] [PATCH] batman-adv: Ensure that eth_type_trans gets linear memory

[Sven Eckelmann]

eth_type_trans tries to pull data with the length of the ethernet header
from the skb. We only ensured that enough data for the first ethernet
header and the batman header is available in non-paged memory of the skb
and not for the ethernet after the batman header.

eth_type_trans would fail sometimes with drivers which don't ensure that
all there data is perfectly linearised.

Reported-by: thorkill <lesniak@sra.uni-hannover.de>
Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>
---
 batman-adv/soft-interface.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/batman-adv/soft-interface.c b/batman-adv/soft-interface.c
index e93a99f..e89ede1 100644
--- a/batman-adv/soft-interface.c
+++ b/batman-adv/soft-interface.c
@@ -494,6 +494,8 @@ void interface_rx(struct net_device *soft_iface,
 	}
 
 	/* skb->dev & skb->pkt_type are set here */
+	if (unlikely(!pskb_may_pull(skb, ETH_HLEN)))
+		goto dropped;
 	skb->protocol = eth_type_trans(skb, soft_iface);
 
 	/* should not be neccesary anymore as we use skb_pull_rcsum()
-- 
1.7.2.3

Re: [B.A.T.M.A.N.] [PATCH] batman-adv: Ensure that eth_type_trans gets linear memory

[Marek Lindner]

On Sunday 21 November 2010 15:33:01 Sven Eckelmann wrote:
> eth_type_trans tries to pull data with the length of the ethernet header
> from the skb. We only ensured that enough data for the first ethernet
> header and the batman header is available in non-paged memory of the skb
> and not for the ethernet after the batman header.
> 
> eth_type_trans would fail sometimes with drivers which don't ensure that
> all there data is perfectly linearised.

Ok, I went ahead and applied this patch in revision 1874 after some 
discussion. No Intel user needs to suffer if we can avoid it.  ;-)

Thanks,
Marek