* [B.A.T.M.A.N.] [PATCH 01/11] batman-adv: Avoid probe ELP information leak
2018-09-19 12:22 [B.A.T.M.A.N.] [PATCH 00/11] pull request for net: batman-adv 2018-09-19 Simon Wunderlich
@ 2018-09-19 12:22 ` Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 02/11] batman-adv: Fix segfault when writing to throughput_override Simon Wunderlich
` (10 subsequent siblings)
11 siblings, 0 replies; 14+ messages in thread
From: Simon Wunderlich @ 2018-09-19 12:22 UTC (permalink / raw)
To: davem; +Cc: netdev, b.a.t.m.a.n, Sven Eckelmann, Simon Wunderlich
From: Sven Eckelmann <sven@narfation.org>
The probe ELPs for WiFi interfaces are expanded to contain at least
BATADV_ELP_MIN_PROBE_SIZE bytes. This is usually a lot more than the
number of bytes which the template ELP packet requires.
These extra padding bytes were not initialized and thus could contain data
which were previously stored at the same location. It is therefore required
to set it to some predefined or random values to avoid leaking private
information from the system transmitting these kind of packets.
Fixes: e4623c913508 ("batman-adv: Avoid probe ELP information leak")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Acked-by: Antonio Quartulli <a@unstable.cc>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
net/batman-adv/bat_v_elp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
index 71c20c1d4002..e103c759b7ab 100644
--- a/net/batman-adv/bat_v_elp.c
+++ b/net/batman-adv/bat_v_elp.c
@@ -241,7 +241,7 @@ batadv_v_elp_wifi_neigh_probe(struct batadv_hardif_neigh_node *neigh)
* the packet to be exactly of that size to make the link
* throughput estimation effective.
*/
- skb_put(skb, probe_len - hard_iface->bat_v.elp_skb->len);
+ skb_put_zero(skb, probe_len - hard_iface->bat_v.elp_skb->len);
batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
"Sending unicast (probe) ELP packet on interface %s to %pM\n",
--
2.11.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [B.A.T.M.A.N.] [PATCH 02/11] batman-adv: Fix segfault when writing to throughput_override
2018-09-19 12:22 [B.A.T.M.A.N.] [PATCH 00/11] pull request for net: batman-adv 2018-09-19 Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 01/11] batman-adv: Avoid probe ELP information leak Simon Wunderlich
@ 2018-09-19 12:22 ` Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 03/11] batman-adv: Fix segfault when writing to sysfs elp_interval Simon Wunderlich
` (9 subsequent siblings)
11 siblings, 0 replies; 14+ messages in thread
From: Simon Wunderlich @ 2018-09-19 12:22 UTC (permalink / raw)
To: davem; +Cc: netdev, b.a.t.m.a.n, Sven Eckelmann, Simon Wunderlich
From: Sven Eckelmann <sven@narfation.org>
The per hardif sysfs file "batman_adv/throughput_override" prints the
resulting change as info text when the users writes to this file. It uses
the helper function batadv_info to add it at the same time to the kernel
ring buffer and to the batman-adv debug log (when CONFIG_BATMAN_ADV_DEBUG
is enabled).
The function batadv_info requires as first parameter the batman-adv softif
net_device. This parameter is then used to find the private buffer which
contains the debug log for this batman-adv interface. But
batadv_store_throughput_override used as first argument the slave
net_device. This slave device doesn't have the batadv_priv private data
which is access by batadv_info.
Writing to this file with CONFIG_BATMAN_ADV_DEBUG enabled can either lead
to a segfault or to memory corruption.
Fixes: 0b5ecc6811bd ("batman-adv: add throughput override attribute to hard_ifaces")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Acked-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
net/batman-adv/sysfs.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/batman-adv/sysfs.c b/net/batman-adv/sysfs.c
index f2eef43bd2ec..3a76e8970c02 100644
--- a/net/batman-adv/sysfs.c
+++ b/net/batman-adv/sysfs.c
@@ -1090,8 +1090,9 @@ static ssize_t batadv_store_throughput_override(struct kobject *kobj,
if (old_tp_override == tp_override)
goto out;
- batadv_info(net_dev, "%s: Changing from: %u.%u MBit to: %u.%u MBit\n",
- "throughput_override",
+ batadv_info(hard_iface->soft_iface,
+ "%s: %s: Changing from: %u.%u MBit to: %u.%u MBit\n",
+ "throughput_override", net_dev->name,
old_tp_override / 10, old_tp_override % 10,
tp_override / 10, tp_override % 10);
--
2.11.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [B.A.T.M.A.N.] [PATCH 03/11] batman-adv: Fix segfault when writing to sysfs elp_interval
2018-09-19 12:22 [B.A.T.M.A.N.] [PATCH 00/11] pull request for net: batman-adv 2018-09-19 Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 01/11] batman-adv: Avoid probe ELP information leak Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 02/11] batman-adv: Fix segfault when writing to throughput_override Simon Wunderlich
@ 2018-09-19 12:22 ` Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 04/11] batman-adv: Prevent duplicated gateway_node entry Simon Wunderlich
` (8 subsequent siblings)
11 siblings, 0 replies; 14+ messages in thread
From: Simon Wunderlich @ 2018-09-19 12:22 UTC (permalink / raw)
To: davem; +Cc: netdev, b.a.t.m.a.n, Sven Eckelmann, Simon Wunderlich
From: Sven Eckelmann <sven@narfation.org>
The per hardif sysfs file "batman_adv/elp_interval" is using the generic
functions to store/show uint values. The helper __batadv_store_uint_attr
requires the softif net_device as parameter to print the resulting change
as info text when the users writes to this file. It uses the helper
function batadv_info to add it at the same time to the kernel ring buffer
and to the batman-adv debug log (when CONFIG_BATMAN_ADV_DEBUG is enabled).
The function batadv_info requires as first parameter the batman-adv softif
net_device. This parameter is then used to find the private buffer which
contains the debug log for this batman-adv interface. But
batadv_store_throughput_override used as first argument the slave
net_device. This slave device doesn't have the batadv_priv private data
which is access by batadv_info.
Writing to this file with CONFIG_BATMAN_ADV_DEBUG enabled can either lead
to a segfault or to memory corruption.
Fixes: 0744ff8fa8fa ("batman-adv: Add hard_iface specific sysfs wrapper macros for UINT")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Acked-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
net/batman-adv/sysfs.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)
diff --git a/net/batman-adv/sysfs.c b/net/batman-adv/sysfs.c
index 3a76e8970c02..09427fc6494a 100644
--- a/net/batman-adv/sysfs.c
+++ b/net/batman-adv/sysfs.c
@@ -188,7 +188,8 @@ ssize_t batadv_store_##_name(struct kobject *kobj, \
\
return __batadv_store_uint_attr(buff, count, _min, _max, \
_post_func, attr, \
- &bat_priv->_var, net_dev); \
+ &bat_priv->_var, net_dev, \
+ NULL); \
}
#define BATADV_ATTR_SIF_SHOW_UINT(_name, _var) \
@@ -262,7 +263,9 @@ ssize_t batadv_store_##_name(struct kobject *kobj, \
\
length = __batadv_store_uint_attr(buff, count, _min, _max, \
_post_func, attr, \
- &hard_iface->_var, net_dev); \
+ &hard_iface->_var, \
+ hard_iface->soft_iface, \
+ net_dev); \
\
batadv_hardif_put(hard_iface); \
return length; \
@@ -356,10 +359,12 @@ __batadv_store_bool_attr(char *buff, size_t count,
static int batadv_store_uint_attr(const char *buff, size_t count,
struct net_device *net_dev,
+ struct net_device *slave_dev,
const char *attr_name,
unsigned int min, unsigned int max,
atomic_t *attr)
{
+ char ifname[IFNAMSIZ + 3] = "";
unsigned long uint_val;
int ret;
@@ -385,8 +390,11 @@ static int batadv_store_uint_attr(const char *buff, size_t count,
if (atomic_read(attr) == uint_val)
return count;
- batadv_info(net_dev, "%s: Changing from: %i to: %lu\n",
- attr_name, atomic_read(attr), uint_val);
+ if (slave_dev)
+ snprintf(ifname, sizeof(ifname), "%s: ", slave_dev->name);
+
+ batadv_info(net_dev, "%s: %sChanging from: %i to: %lu\n",
+ attr_name, ifname, atomic_read(attr), uint_val);
atomic_set(attr, uint_val);
return count;
@@ -397,12 +405,13 @@ static ssize_t __batadv_store_uint_attr(const char *buff, size_t count,
void (*post_func)(struct net_device *),
const struct attribute *attr,
atomic_t *attr_store,
- struct net_device *net_dev)
+ struct net_device *net_dev,
+ struct net_device *slave_dev)
{
int ret;
- ret = batadv_store_uint_attr(buff, count, net_dev, attr->name, min, max,
- attr_store);
+ ret = batadv_store_uint_attr(buff, count, net_dev, slave_dev,
+ attr->name, min, max, attr_store);
if (post_func && ret)
post_func(net_dev);
@@ -571,7 +580,7 @@ static ssize_t batadv_store_gw_sel_class(struct kobject *kobj,
return __batadv_store_uint_attr(buff, count, 1, BATADV_TQ_MAX_VALUE,
batadv_post_gw_reselect, attr,
&bat_priv->gw.sel_class,
- bat_priv->soft_iface);
+ bat_priv->soft_iface, NULL);
}
static ssize_t batadv_show_gw_bwidth(struct kobject *kobj,
--
2.11.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [B.A.T.M.A.N.] [PATCH 04/11] batman-adv: Prevent duplicated gateway_node entry
2018-09-19 12:22 [B.A.T.M.A.N.] [PATCH 00/11] pull request for net: batman-adv 2018-09-19 Simon Wunderlich
` (2 preceding siblings ...)
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 03/11] batman-adv: Fix segfault when writing to sysfs elp_interval Simon Wunderlich
@ 2018-09-19 12:22 ` Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 05/11] batman-adv: Prevent duplicated nc_node entry Simon Wunderlich
` (7 subsequent siblings)
11 siblings, 0 replies; 14+ messages in thread
From: Simon Wunderlich @ 2018-09-19 12:22 UTC (permalink / raw)
To: davem; +Cc: netdev, b.a.t.m.a.n, Sven Eckelmann, Simon Wunderlich
From: Sven Eckelmann <sven@narfation.org>
The function batadv_gw_node_add is responsible for adding new gw_node to
the gateway_list. It is expecting that the caller already checked that
there is not already an entry with the same key or not.
But the lock for the list is only held when the list is really modified.
This could lead to duplicated entries because another context could create
an entry with the same key between the check and the list manipulation.
The check and the manipulation of the list must therefore be in the same
locked code section.
Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Acked-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
net/batman-adv/gateway_client.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index 8b198ee798c9..140c61a3f1ec 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -32,6 +32,7 @@
#include <linux/kernel.h>
#include <linux/kref.h>
#include <linux/list.h>
+#include <linux/lockdep.h>
#include <linux/netdevice.h>
#include <linux/netlink.h>
#include <linux/rculist.h>
@@ -348,6 +349,9 @@ void batadv_gw_check_election(struct batadv_priv *bat_priv,
* @bat_priv: the bat priv with all the soft interface information
* @orig_node: originator announcing gateway capabilities
* @gateway: announced bandwidth information
+ *
+ * Has to be called with the appropriate locks being acquired
+ * (gw.list_lock).
*/
static void batadv_gw_node_add(struct batadv_priv *bat_priv,
struct batadv_orig_node *orig_node,
@@ -355,6 +359,8 @@ static void batadv_gw_node_add(struct batadv_priv *bat_priv,
{
struct batadv_gw_node *gw_node;
+ lockdep_assert_held(&bat_priv->gw.list_lock);
+
if (gateway->bandwidth_down == 0)
return;
@@ -369,10 +375,8 @@ static void batadv_gw_node_add(struct batadv_priv *bat_priv,
gw_node->bandwidth_down = ntohl(gateway->bandwidth_down);
gw_node->bandwidth_up = ntohl(gateway->bandwidth_up);
- spin_lock_bh(&bat_priv->gw.list_lock);
kref_get(&gw_node->refcount);
hlist_add_head_rcu(&gw_node->list, &bat_priv->gw.gateway_list);
- spin_unlock_bh(&bat_priv->gw.list_lock);
batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
"Found new gateway %pM -> gw bandwidth: %u.%u/%u.%u MBit\n",
@@ -428,11 +432,14 @@ void batadv_gw_node_update(struct batadv_priv *bat_priv,
{
struct batadv_gw_node *gw_node, *curr_gw = NULL;
+ spin_lock_bh(&bat_priv->gw.list_lock);
gw_node = batadv_gw_node_get(bat_priv, orig_node);
if (!gw_node) {
batadv_gw_node_add(bat_priv, orig_node, gateway);
+ spin_unlock_bh(&bat_priv->gw.list_lock);
goto out;
}
+ spin_unlock_bh(&bat_priv->gw.list_lock);
if (gw_node->bandwidth_down == ntohl(gateway->bandwidth_down) &&
gw_node->bandwidth_up == ntohl(gateway->bandwidth_up))
--
2.11.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [B.A.T.M.A.N.] [PATCH 05/11] batman-adv: Prevent duplicated nc_node entry
2018-09-19 12:22 [B.A.T.M.A.N.] [PATCH 00/11] pull request for net: batman-adv 2018-09-19 Simon Wunderlich
` (3 preceding siblings ...)
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 04/11] batman-adv: Prevent duplicated gateway_node entry Simon Wunderlich
@ 2018-09-19 12:22 ` Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 06/11] batman-adv: Prevent duplicated softif_vlan entry Simon Wunderlich
` (6 subsequent siblings)
11 siblings, 0 replies; 14+ messages in thread
From: Simon Wunderlich @ 2018-09-19 12:22 UTC (permalink / raw)
To: davem; +Cc: netdev, b.a.t.m.a.n, Sven Eckelmann, Simon Wunderlich
From: Sven Eckelmann <sven@narfation.org>
The function batadv_nc_get_nc_node is responsible for adding new nc_nodes
to the in_coding_list and out_coding_list. It first checks whether the
entry already is in the list or not. If it is, then the creation of a new
entry is aborted.
But the lock for the list is only held when the list is really modified.
This could lead to duplicated entries because another context could create
an entry with the same key between the check and the list manipulation.
The check and the manipulation of the list must therefore be in the same
locked code section.
Fixes: d56b1705e28c ("batman-adv: network coding - detect coding nodes and remove these after timeout")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Acked-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
net/batman-adv/network-coding.c | 27 +++++++++++++++------------
1 file changed, 15 insertions(+), 12 deletions(-)
diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
index c3578444f3cb..34caf129a9bf 100644
--- a/net/batman-adv/network-coding.c
+++ b/net/batman-adv/network-coding.c
@@ -854,16 +854,27 @@ batadv_nc_get_nc_node(struct batadv_priv *bat_priv,
spinlock_t *lock; /* Used to lock list selected by "int in_coding" */
struct list_head *list;
+ /* Select ingoing or outgoing coding node */
+ if (in_coding) {
+ lock = &orig_neigh_node->in_coding_list_lock;
+ list = &orig_neigh_node->in_coding_list;
+ } else {
+ lock = &orig_neigh_node->out_coding_list_lock;
+ list = &orig_neigh_node->out_coding_list;
+ }
+
+ spin_lock_bh(lock);
+
/* Check if nc_node is already added */
nc_node = batadv_nc_find_nc_node(orig_node, orig_neigh_node, in_coding);
/* Node found */
if (nc_node)
- return nc_node;
+ goto unlock;
nc_node = kzalloc(sizeof(*nc_node), GFP_ATOMIC);
if (!nc_node)
- return NULL;
+ goto unlock;
/* Initialize nc_node */
INIT_LIST_HEAD(&nc_node->list);
@@ -872,22 +883,14 @@ batadv_nc_get_nc_node(struct batadv_priv *bat_priv,
kref_get(&orig_neigh_node->refcount);
nc_node->orig_node = orig_neigh_node;
- /* Select ingoing or outgoing coding node */
- if (in_coding) {
- lock = &orig_neigh_node->in_coding_list_lock;
- list = &orig_neigh_node->in_coding_list;
- } else {
- lock = &orig_neigh_node->out_coding_list_lock;
- list = &orig_neigh_node->out_coding_list;
- }
-
batadv_dbg(BATADV_DBG_NC, bat_priv, "Adding nc_node %pM -> %pM\n",
nc_node->addr, nc_node->orig_node->orig);
/* Add nc_node to orig_node */
- spin_lock_bh(lock);
kref_get(&nc_node->refcount);
list_add_tail_rcu(&nc_node->list, list);
+
+unlock:
spin_unlock_bh(lock);
return nc_node;
--
2.11.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [B.A.T.M.A.N.] [PATCH 06/11] batman-adv: Prevent duplicated softif_vlan entry
2018-09-19 12:22 [B.A.T.M.A.N.] [PATCH 00/11] pull request for net: batman-adv 2018-09-19 Simon Wunderlich
` (4 preceding siblings ...)
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 05/11] batman-adv: Prevent duplicated nc_node entry Simon Wunderlich
@ 2018-09-19 12:22 ` Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 07/11] batman-adv: Prevent duplicated global TT entry Simon Wunderlich
` (5 subsequent siblings)
11 siblings, 0 replies; 14+ messages in thread
From: Simon Wunderlich @ 2018-09-19 12:22 UTC (permalink / raw)
To: davem; +Cc: netdev, b.a.t.m.a.n, Sven Eckelmann, Simon Wunderlich
From: Sven Eckelmann <sven@narfation.org>
The function batadv_softif_vlan_get is responsible for adding new
softif_vlan to the softif_vlan_list. It first checks whether the entry
already is in the list or not. If it is, then the creation of a new entry
is aborted.
But the lock for the list is only held when the list is really modified.
This could lead to duplicated entries because another context could create
an entry with the same key between the check and the list manipulation.
The check and the manipulation of the list must therefore be in the same
locked code section.
Fixes: 5d2c05b21337 ("batman-adv: add per VLAN interface attribute framework")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
net/batman-adv/soft-interface.c | 25 ++++++++++++++++++-------
1 file changed, 18 insertions(+), 7 deletions(-)
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 1485263a348b..626ddca332db 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -574,15 +574,20 @@ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid)
struct batadv_softif_vlan *vlan;
int err;
+ spin_lock_bh(&bat_priv->softif_vlan_list_lock);
+
vlan = batadv_softif_vlan_get(bat_priv, vid);
if (vlan) {
batadv_softif_vlan_put(vlan);
+ spin_unlock_bh(&bat_priv->softif_vlan_list_lock);
return -EEXIST;
}
vlan = kzalloc(sizeof(*vlan), GFP_ATOMIC);
- if (!vlan)
+ if (!vlan) {
+ spin_unlock_bh(&bat_priv->softif_vlan_list_lock);
return -ENOMEM;
+ }
vlan->bat_priv = bat_priv;
vlan->vid = vid;
@@ -590,17 +595,23 @@ int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid)
atomic_set(&vlan->ap_isolation, 0);
+ kref_get(&vlan->refcount);
+ hlist_add_head_rcu(&vlan->list, &bat_priv->softif_vlan_list);
+ spin_unlock_bh(&bat_priv->softif_vlan_list_lock);
+
+ /* batadv_sysfs_add_vlan cannot be in the spinlock section due to the
+ * sleeping behavior of the sysfs functions and the fs_reclaim lock
+ */
err = batadv_sysfs_add_vlan(bat_priv->soft_iface, vlan);
if (err) {
- kfree(vlan);
+ /* ref for the function */
+ batadv_softif_vlan_put(vlan);
+
+ /* ref for the list */
+ batadv_softif_vlan_put(vlan);
return err;
}
- spin_lock_bh(&bat_priv->softif_vlan_list_lock);
- kref_get(&vlan->refcount);
- hlist_add_head_rcu(&vlan->list, &bat_priv->softif_vlan_list);
- spin_unlock_bh(&bat_priv->softif_vlan_list_lock);
-
/* add a new TT local entry. This one will be marked with the NOPURGE
* flag
*/
--
2.11.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [B.A.T.M.A.N.] [PATCH 07/11] batman-adv: Prevent duplicated global TT entry
2018-09-19 12:22 [B.A.T.M.A.N.] [PATCH 00/11] pull request for net: batman-adv 2018-09-19 Simon Wunderlich
` (5 preceding siblings ...)
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 06/11] batman-adv: Prevent duplicated softif_vlan entry Simon Wunderlich
@ 2018-09-19 12:22 ` Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 08/11] batman-adv: Prevent duplicated tvlv handler Simon Wunderlich
` (4 subsequent siblings)
11 siblings, 0 replies; 14+ messages in thread
From: Simon Wunderlich @ 2018-09-19 12:22 UTC (permalink / raw)
To: davem; +Cc: netdev, b.a.t.m.a.n, Sven Eckelmann, Simon Wunderlich
From: Sven Eckelmann <sven@narfation.org>
The function batadv_tt_global_orig_entry_add is responsible for adding new
tt_orig_list_entry to the orig_list. It first checks whether the entry
already is in the list or not. If it is, then the creation of a new entry
is aborted.
But the lock for the list is only held when the list is really modified.
This could lead to duplicated entries because another context could create
an entry with the same key between the check and the list manipulation.
The check and the manipulation of the list must therefore be in the same
locked code section.
Fixes: d657e621a0f5 ("batman-adv: add reference counting for type batadv_tt_orig_list_entry")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
net/batman-adv/translation-table.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 12a2b7d21376..d21624c44665 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -1613,6 +1613,8 @@ batadv_tt_global_orig_entry_add(struct batadv_tt_global_entry *tt_global,
{
struct batadv_tt_orig_list_entry *orig_entry;
+ spin_lock_bh(&tt_global->list_lock);
+
orig_entry = batadv_tt_global_orig_entry_find(tt_global, orig_node);
if (orig_entry) {
/* refresh the ttvn: the current value could be a bogus one that
@@ -1635,11 +1637,9 @@ batadv_tt_global_orig_entry_add(struct batadv_tt_global_entry *tt_global,
orig_entry->flags = flags;
kref_init(&orig_entry->refcount);
- spin_lock_bh(&tt_global->list_lock);
kref_get(&orig_entry->refcount);
hlist_add_head_rcu(&orig_entry->list,
&tt_global->orig_list);
- spin_unlock_bh(&tt_global->list_lock);
atomic_inc(&tt_global->orig_list_count);
sync_flags:
@@ -1647,6 +1647,8 @@ batadv_tt_global_orig_entry_add(struct batadv_tt_global_entry *tt_global,
out:
if (orig_entry)
batadv_tt_orig_list_entry_put(orig_entry);
+
+ spin_unlock_bh(&tt_global->list_lock);
}
/**
--
2.11.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [B.A.T.M.A.N.] [PATCH 08/11] batman-adv: Prevent duplicated tvlv handler
2018-09-19 12:22 [B.A.T.M.A.N.] [PATCH 00/11] pull request for net: batman-adv 2018-09-19 Simon Wunderlich
` (6 preceding siblings ...)
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 07/11] batman-adv: Prevent duplicated global TT entry Simon Wunderlich
@ 2018-09-19 12:22 ` Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 09/11] batman-adv: fix backbone_gw refcount on queue_work() failure Simon Wunderlich
` (3 subsequent siblings)
11 siblings, 0 replies; 14+ messages in thread
From: Simon Wunderlich @ 2018-09-19 12:22 UTC (permalink / raw)
To: davem; +Cc: netdev, b.a.t.m.a.n, Sven Eckelmann, Simon Wunderlich
From: Sven Eckelmann <sven@narfation.org>
The function batadv_tvlv_handler_register is responsible for adding new
tvlv_handler to the handler_list. It first checks whether the entry
already is in the list or not. If it is, then the creation of a new entry
is aborted.
But the lock for the list is only held when the list is really modified.
This could lead to duplicated entries because another context could create
an entry with the same key between the check and the list manipulation.
The check and the manipulation of the list must therefore be in the same
locked code section.
Fixes: ef26157747d4 ("batman-adv: tvlv - basic infrastructure")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
net/batman-adv/tvlv.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/batman-adv/tvlv.c b/net/batman-adv/tvlv.c
index a637458205d1..40e69c9346d2 100644
--- a/net/batman-adv/tvlv.c
+++ b/net/batman-adv/tvlv.c
@@ -529,15 +529,20 @@ void batadv_tvlv_handler_register(struct batadv_priv *bat_priv,
{
struct batadv_tvlv_handler *tvlv_handler;
+ spin_lock_bh(&bat_priv->tvlv.handler_list_lock);
+
tvlv_handler = batadv_tvlv_handler_get(bat_priv, type, version);
if (tvlv_handler) {
+ spin_unlock_bh(&bat_priv->tvlv.handler_list_lock);
batadv_tvlv_handler_put(tvlv_handler);
return;
}
tvlv_handler = kzalloc(sizeof(*tvlv_handler), GFP_ATOMIC);
- if (!tvlv_handler)
+ if (!tvlv_handler) {
+ spin_unlock_bh(&bat_priv->tvlv.handler_list_lock);
return;
+ }
tvlv_handler->ogm_handler = optr;
tvlv_handler->unicast_handler = uptr;
@@ -547,7 +552,6 @@ void batadv_tvlv_handler_register(struct batadv_priv *bat_priv,
kref_init(&tvlv_handler->refcount);
INIT_HLIST_NODE(&tvlv_handler->list);
- spin_lock_bh(&bat_priv->tvlv.handler_list_lock);
kref_get(&tvlv_handler->refcount);
hlist_add_head_rcu(&tvlv_handler->list, &bat_priv->tvlv.handler_list);
spin_unlock_bh(&bat_priv->tvlv.handler_list_lock);
--
2.11.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [B.A.T.M.A.N.] [PATCH 09/11] batman-adv: fix backbone_gw refcount on queue_work() failure
2018-09-19 12:22 [B.A.T.M.A.N.] [PATCH 00/11] pull request for net: batman-adv 2018-09-19 Simon Wunderlich
` (7 preceding siblings ...)
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 08/11] batman-adv: Prevent duplicated tvlv handler Simon Wunderlich
@ 2018-09-19 12:22 ` Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 10/11] batman-adv: fix hardif_neigh " Simon Wunderlich
` (2 subsequent siblings)
11 siblings, 0 replies; 14+ messages in thread
From: Simon Wunderlich @ 2018-09-19 12:22 UTC (permalink / raw)
To: davem
Cc: netdev, b.a.t.m.a.n, Marek Lindner, Sven Eckelmann, Simon Wunderlich
From: Marek Lindner <mareklindner@neomailbox.ch>
The backbone_gw refcounter is to be decreased by the queued work and
currently is never decreased if the queue_work() call fails.
Fix by checking the queue_work() return value and decrease refcount
if necessary.
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
net/batman-adv/bridge_loop_avoidance.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index ff9659af6b91..5f1aeeded0e3 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -1772,6 +1772,7 @@ batadv_bla_loopdetect_check(struct batadv_priv *bat_priv, struct sk_buff *skb,
{
struct batadv_bla_backbone_gw *backbone_gw;
struct ethhdr *ethhdr;
+ bool ret;
ethhdr = eth_hdr(skb);
@@ -1795,8 +1796,13 @@ batadv_bla_loopdetect_check(struct batadv_priv *bat_priv, struct sk_buff *skb,
if (unlikely(!backbone_gw))
return true;
- queue_work(batadv_event_workqueue, &backbone_gw->report_work);
- /* backbone_gw is unreferenced in the report work function function */
+ ret = queue_work(batadv_event_workqueue, &backbone_gw->report_work);
+
+ /* backbone_gw is unreferenced in the report work function function
+ * if queue_work() call was successful
+ */
+ if (!ret)
+ batadv_backbone_gw_put(backbone_gw);
return true;
}
--
2.11.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [B.A.T.M.A.N.] [PATCH 10/11] batman-adv: fix hardif_neigh refcount on queue_work() failure
2018-09-19 12:22 [B.A.T.M.A.N.] [PATCH 00/11] pull request for net: batman-adv 2018-09-19 Simon Wunderlich
` (8 preceding siblings ...)
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 09/11] batman-adv: fix backbone_gw refcount on queue_work() failure Simon Wunderlich
@ 2018-09-19 12:22 ` Simon Wunderlich
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 11/11] batman-adv: Increase version number to 2018.3 Simon Wunderlich
2018-09-20 3:34 ` [B.A.T.M.A.N.] [PATCH 00/11] pull request for net: batman-adv 2018-09-19 David Miller
11 siblings, 0 replies; 14+ messages in thread
From: Simon Wunderlich @ 2018-09-19 12:22 UTC (permalink / raw)
To: davem
Cc: netdev, b.a.t.m.a.n, Marek Lindner, Sven Eckelmann, Simon Wunderlich
From: Marek Lindner <mareklindner@neomailbox.ch>
The hardif_neigh refcounter is to be decreased by the queued work and
currently is never decreased if the queue_work() call fails.
Fix by checking the queue_work() return value and decrease refcount
if necessary.
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
net/batman-adv/bat_v_elp.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
index e103c759b7ab..9f481cfdf77d 100644
--- a/net/batman-adv/bat_v_elp.c
+++ b/net/batman-adv/bat_v_elp.c
@@ -268,6 +268,7 @@ static void batadv_v_elp_periodic_work(struct work_struct *work)
struct batadv_priv *bat_priv;
struct sk_buff *skb;
u32 elp_interval;
+ bool ret;
bat_v = container_of(work, struct batadv_hard_iface_bat_v, elp_wq.work);
hard_iface = container_of(bat_v, struct batadv_hard_iface, bat_v);
@@ -329,8 +330,11 @@ static void batadv_v_elp_periodic_work(struct work_struct *work)
* may sleep and that is not allowed in an rcu protected
* context. Therefore schedule a task for that.
*/
- queue_work(batadv_event_workqueue,
- &hardif_neigh->bat_v.metric_work);
+ ret = queue_work(batadv_event_workqueue,
+ &hardif_neigh->bat_v.metric_work);
+
+ if (!ret)
+ batadv_hardif_neigh_put(hardif_neigh);
}
rcu_read_unlock();
--
2.11.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* [B.A.T.M.A.N.] [PATCH 11/11] batman-adv: Increase version number to 2018.3
2018-09-19 12:22 [B.A.T.M.A.N.] [PATCH 00/11] pull request for net: batman-adv 2018-09-19 Simon Wunderlich
` (9 preceding siblings ...)
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 10/11] batman-adv: fix hardif_neigh " Simon Wunderlich
@ 2018-09-19 12:22 ` Simon Wunderlich
2018-09-20 3:34 ` [B.A.T.M.A.N.] [PATCH 00/11] pull request for net: batman-adv 2018-09-19 David Miller
11 siblings, 0 replies; 14+ messages in thread
From: Simon Wunderlich @ 2018-09-19 12:22 UTC (permalink / raw)
To: davem; +Cc: netdev, b.a.t.m.a.n, Sven Eckelmann, Simon Wunderlich
From: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
net/batman-adv/main.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/batman-adv/main.h b/net/batman-adv/main.h
index 8da3c9336111..3ccc75ee719c 100644
--- a/net/batman-adv/main.h
+++ b/net/batman-adv/main.h
@@ -25,7 +25,7 @@
#define BATADV_DRIVER_DEVICE "batman-adv"
#ifndef BATADV_SOURCE_VERSION
-#define BATADV_SOURCE_VERSION "2018.2"
+#define BATADV_SOURCE_VERSION "2018.3"
#endif
/* B.A.T.M.A.N. parameters */
--
2.11.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* Re: [B.A.T.M.A.N.] [PATCH 00/11] pull request for net: batman-adv 2018-09-19
2018-09-19 12:22 [B.A.T.M.A.N.] [PATCH 00/11] pull request for net: batman-adv 2018-09-19 Simon Wunderlich
` (10 preceding siblings ...)
2018-09-19 12:22 ` [B.A.T.M.A.N.] [PATCH 11/11] batman-adv: Increase version number to 2018.3 Simon Wunderlich
@ 2018-09-20 3:34 ` David Miller
2018-09-20 8:09 ` Simon Wunderlich
11 siblings, 1 reply; 14+ messages in thread
From: David Miller @ 2018-09-20 3:34 UTC (permalink / raw)
To: sw; +Cc: netdev, b.a.t.m.a.n
From: Simon Wunderlich <sw@simonwunderlich.de>
Date: Wed, 19 Sep 2018 14:22:02 +0200
> here are some bugfixes which we would like to see integrated into net.
>
> We forgot to bump the version number in the last round for net-next, so
> the belated patch to do that is included - we hope you can adopt it.
> This will most likely create a merge conflict later when merging into
> net-next with this rounds net-next patchset, but net-next should keep
> the 2018.4 version[1].
>
> Please pull or let me know of any problem!
Pulled, thanks Simon.
In the future, you can put that merge resolution guidance into the
merge commit message.
When people give annotations like this, I refer to them when I do
merges and it helps me a lot. If it's in the actual GIT history,
that is tons easier than if it just appeared in your pull request
email.
I manually included it in the merge commit message this time.
Thanks!
^ permalink raw reply [flat|nested] 14+ messages in thread* Re: [B.A.T.M.A.N.] [PATCH 00/11] pull request for net: batman-adv 2018-09-19
2018-09-20 3:34 ` [B.A.T.M.A.N.] [PATCH 00/11] pull request for net: batman-adv 2018-09-19 David Miller
@ 2018-09-20 8:09 ` Simon Wunderlich
0 siblings, 0 replies; 14+ messages in thread
From: Simon Wunderlich @ 2018-09-20 8:09 UTC (permalink / raw)
To: David Miller; +Cc: netdev, b.a.t.m.a.n
[-- Attachment #1: Type: text/plain, Size: 1115 bytes --]
On Wednesday, September 19, 2018 8:34:34 PM CEST David Miller wrote:
> From: Simon Wunderlich <sw@simonwunderlich.de>
> Date: Wed, 19 Sep 2018 14:22:02 +0200
>
> > here are some bugfixes which we would like to see integrated into net.
> >
> > We forgot to bump the version number in the last round for net-next, so
> > the belated patch to do that is included - we hope you can adopt it.
> > This will most likely create a merge conflict later when merging into
> > net-next with this rounds net-next patchset, but net-next should keep
> > the 2018.4 version[1].
> >
> > Please pull or let me know of any problem!
>
> Pulled, thanks Simon.
Great, thanks!
>
> In the future, you can put that merge resolution guidance into the
> merge commit message.
>
> When people give annotations like this, I refer to them when I do
> merges and it helps me a lot. If it's in the actual GIT history,
> that is tons easier than if it just appeared in your pull request
> email.
>
> I manually included it in the merge commit message this time.
>
> Thanks!
OK, thanks for the hint! We will do this.
Cheers,
Simon
[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 14+ messages in thread