From: Sven Eckelmann <sven@narfation.org>
To: davem@davemloft.net
Cc: netdev@vger.kernel.org, b.a.t.m.a.n@lists.open-mesh.org,
Marek Lindner <lindner_marek@yahoo.de>
Subject: [B.A.T.M.A.N.] [PATCH 28/28] batman-adv: Disallow regular interface as mesh device
Date: Sat, 5 Mar 2011 13:28:42 +0100 [thread overview]
Message-ID: <1299328122-21468-29-git-send-email-sven@narfation.org> (raw)
In-Reply-To: <1299328122-21468-1-git-send-email-sven@narfation.org>
When trying to associate a net_device with another net_device which
already exists, batman-adv assumes that this interface is a fully
initialized batman mesh interface without checking it. The behaviour
when accessing data behind netdev_priv of a random net_device is
undefined and potentially dangerous.
Reported-by: Linus Lüssing <linus.luessing@ascom.ch>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
---
net/batman-adv/hard-interface.c | 34 ++++++++++++++++++++++------------
net/batman-adv/soft-interface.c | 13 +++++++++++++
net/batman-adv/soft-interface.h | 1 +
3 files changed, 36 insertions(+), 12 deletions(-)
diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
index 95a35b6..b3058e4 100644
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -79,13 +79,8 @@ static int is_valid_iface(struct net_device *net_dev)
return 0;
/* no batman over batman */
-#ifdef HAVE_NET_DEVICE_OPS
- if (net_dev->netdev_ops->ndo_start_xmit == interface_tx)
+ if (softif_is_valid(net_dev))
return 0;
-#else
- if (net_dev->hard_start_xmit == interface_tx)
- return 0;
-#endif
/* Device is being bridged */
/* if (net_dev->priv_flags & IFF_BRIDGE_PORT)
@@ -282,6 +277,8 @@ int hardif_enable_interface(struct hard_iface *hard_iface, char *iface_name)
{
struct bat_priv *bat_priv;
struct batman_packet *batman_packet;
+ struct net_device *soft_iface;
+ int ret;
if (hard_iface->if_status != IF_NOT_IN_USE)
goto out;
@@ -289,18 +286,30 @@ int hardif_enable_interface(struct hard_iface *hard_iface, char *iface_name)
if (!atomic_inc_not_zero(&hard_iface->refcount))
goto out;
- hard_iface->soft_iface = dev_get_by_name(&init_net, iface_name);
+ soft_iface = dev_get_by_name(&init_net, iface_name);
- if (!hard_iface->soft_iface) {
- hard_iface->soft_iface = softif_create(iface_name);
+ if (!soft_iface) {
+ soft_iface = softif_create(iface_name);
- if (!hard_iface->soft_iface)
+ if (!soft_iface) {
+ ret = -ENOMEM;
goto err;
+ }
/* dev_get_by_name() increases the reference counter for us */
- dev_hold(hard_iface->soft_iface);
+ dev_hold(soft_iface);
+ }
+
+ if (!softif_is_valid(soft_iface)) {
+ pr_err("Can't create batman mesh interface %s: "
+ "already exists as regular interface\n",
+ soft_iface->name);
+ dev_put(soft_iface);
+ ret = -EINVAL;
+ goto err;
}
+ hard_iface->soft_iface = soft_iface;
bat_priv = netdev_priv(hard_iface->soft_iface);
hard_iface->packet_len = BAT_PACKET_LEN;
hard_iface->packet_buff = kmalloc(hard_iface->packet_len, GFP_ATOMIC);
@@ -308,6 +317,7 @@ int hardif_enable_interface(struct hard_iface *hard_iface, char *iface_name)
if (!hard_iface->packet_buff) {
bat_err(hard_iface->soft_iface, "Can't add interface packet "
"(%s): out of memory\n", hard_iface->net_dev->name);
+ ret = -ENOMEM;
goto err;
}
@@ -370,7 +380,7 @@ out:
err:
hardif_free_ref(hard_iface);
- return -ENOMEM;
+ return ret;
}
void hardif_disable_interface(struct hard_iface *hard_iface)
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 6b514ec..9ed2614 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -622,6 +622,19 @@ void softif_destroy(struct net_device *soft_iface)
unregister_netdevice(soft_iface);
}
+int softif_is_valid(struct net_device *net_dev)
+{
+#ifdef HAVE_NET_DEVICE_OPS
+ if (net_dev->netdev_ops->ndo_start_xmit == interface_tx)
+ return 1;
+#else
+ if (net_dev->hard_start_xmit == interface_tx)
+ return 1;
+#endif
+
+ return 0;
+}
+
/* ethtool */
static int bat_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
{
diff --git a/net/batman-adv/soft-interface.h b/net/batman-adv/soft-interface.h
index 80a3607..4789b6f 100644
--- a/net/batman-adv/soft-interface.h
+++ b/net/batman-adv/soft-interface.h
@@ -31,5 +31,6 @@ void interface_rx(struct net_device *soft_iface,
int hdr_size);
struct net_device *softif_create(char *name);
void softif_destroy(struct net_device *soft_iface);
+int softif_is_valid(struct net_device *net_dev);
#endif /* _NET_BATMAN_ADV_SOFT_INTERFACE_H_ */
--
1.7.2.3
next prev parent reply other threads:[~2011-03-05 12:28 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-03-05 12:28 [B.A.T.M.A.N.] pull request: batman-adv 2011-03-05 Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 01/28] batman-adv: Remove two duplicate includes Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 02/28] batman-adv: protect neighbor nodes with reference counters Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 03/28] batman-adv: convert neighbor list to hlist Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 04/28] batman-adv: protect neighbor list with rcu locks Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 05/28] batman-adv: free neighbors when an interface is deactivated Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 06/28] batman-adv: protect neigh_nodes used outside of rcu_locks with refcounting Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 07/28] batman-adv: protect each hash row with rcu locks Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 08/28] batman-adv: protect originator nodes with reference counters Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 09/28] batman-adv: protect ogm counter arrays with spinlock Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 10/28] batman-adv: protect bonding with rcu locks Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 11/28] batman-adv: Correct rcu refcounting for neigh_node Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 12/28] batman-adv: Correct rcu refcounting for gw_node Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 13/28] batman-adv: Correct rcu refcounting for softif_neigh Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 14/28] batman-adv: Correct rcu refcounting for batman_if Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 15/28] batman-adv: protect bit operations to count OGMs with spinlock Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 16/28] batman-adv: make broadcast seqno operations atomic Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 17/28] batman-adv: Make bat_priv->curr_gw an rcu protected pointer Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 18/28] batman-adv: Increase orig_node refcount before releasing rcu read lock Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 19/28] batman-adv: Fix possible buffer overflow in softif neigh list output Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 20/28] batman-adv: separate ethernet comparing calls from hash functions Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 21/28] batman-adv: remove extra layer between hash and hash element - hash bucket Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 22/28] batman-adv: Correct rcu refcounting for orig_node Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 23/28] batman-adv: increase refcount in create_neighbor to be consistent Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 24/28] batman-adv: remove orig_hash spinlock Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 25/28] batman-adv: rename global if_list to hardif_list Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 26/28] batman-adv: rename batman_if struct to hard_iface Sven Eckelmann
2011-03-05 12:28 ` [B.A.T.M.A.N.] [PATCH 27/28] batman-adv: Remove unused hdr_size variable in route_unicast_packet() Sven Eckelmann
2011-03-05 12:28 ` Sven Eckelmann [this message]
2011-03-05 14:13 ` [B.A.T.M.A.N.] pull request: batman-adv 2011-03-05 Sven Eckelmann
2011-03-07 2:14 ` David Miller
2011-03-07 9:01 ` Sven Eckelmann
2011-03-07 9:19 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1299328122-21468-29-git-send-email-sven@narfation.org \
--to=sven@narfation.org \
--cc=b.a.t.m.a.n@lists.open-mesh.org \
--cc=davem@davemloft.net \
--cc=lindner_marek@yahoo.de \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).