Commit 7ffb0d31 authored by David S. Miller's avatar David S. Miller
Browse files

Merge tag 'batman-adv-fix-for-davem' of git://git.open-mesh.org/linux-merge 



Included changes:
- fix soft-interface MTU computation
- fix bogus pointer mangling when parsing the TT-TVLV
  container. This bug led to a wrong memory access.
- fix memory leak by properly releasing the VLAN object
  after CRC check
- properly check pskb_may_pull() return value
- avoid potential race condition while adding new neighbour
- fix potential memory leak by removing all the references
  to the orig_node object in case of initialization failure
- fix the TT CRC computation by ensuring that every node uses
  the same byte order when hosts with different endianess are
  part of the same network
- fix severe memory leak by freeing skb after a successful
  TVLV parsing
- avoid potential double free when orig_node initialization
  fails
- fix potential kernel paging error caused by the usage of
  the old value of skb->data after skb reallocation

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents a6254864 70b271a7

net/batman-adv/bat_iv_ogm.c

+20 −10
Original line number Diff line number Diff line
@@ -241,19 +241,19 @@ batadv_iv_ogm_orig_get(struct batadv_priv *bat_priv, const uint8_t *addr) 
	size = bat_priv->num_ifaces * sizeof(uint8_t);

	orig_node->bat_iv.bcast_own_sum = kzalloc(size, GFP_ATOMIC);

	if (!orig_node->bat_iv.bcast_own_sum)

		goto free_bcast_own;

		goto free_orig_node;



	hash_added = batadv_hash_add(bat_priv->orig_hash, batadv_compare_orig,

				     batadv_choose_orig, orig_node,

				     &orig_node->hash_entry);

	if (hash_added != 0)

		goto free_bcast_own;

		goto free_orig_node;



	return orig_node;



free_bcast_own:

	kfree(orig_node->bat_iv.bcast_own);

free_orig_node:

	/* free twice, as batadv_orig_node_new sets refcount to 2 */

	batadv_orig_node_free_ref(orig_node);

	batadv_orig_node_free_ref(orig_node);



	return NULL;
@@ -266,7 +266,7 @@ batadv_iv_ogm_neigh_new(struct batadv_hard_iface *hard_iface, 
			struct batadv_orig_node *orig_neigh)

{

	struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);

	struct batadv_neigh_node *neigh_node;

	struct batadv_neigh_node *neigh_node, *tmp_neigh_node;



	neigh_node = batadv_neigh_node_new(hard_iface, neigh_addr, orig_node);

	if (!neigh_node)
@@ -281,14 +281,24 @@ batadv_iv_ogm_neigh_new(struct batadv_hard_iface *hard_iface, 
	neigh_node->orig_node = orig_neigh;

	neigh_node->if_incoming = hard_iface;



	batadv_dbg(BATADV_DBG_BATMAN, bat_priv,

		   "Creating new neighbor %pM for orig_node %pM on interface %s\n",

		   neigh_addr, orig_node->orig, hard_iface->net_dev->name);



	spin_lock_bh(&orig_node->neigh_list_lock);

	tmp_neigh_node = batadv_neigh_node_get(orig_node, hard_iface,

					       neigh_addr);

	if (!tmp_neigh_node) {

		hlist_add_head_rcu(&neigh_node->list, &orig_node->neigh_list);

	} else {

		kfree(neigh_node);

		batadv_hardif_free_ref(hard_iface);

		neigh_node = tmp_neigh_node;

	}

	spin_unlock_bh(&orig_node->neigh_list_lock);



	if (!tmp_neigh_node)

		batadv_dbg(BATADV_DBG_BATMAN, bat_priv,

			   "Creating new neighbor %pM for orig_node %pM on interface %s\n",

			   neigh_addr, orig_node->orig,

			   hard_iface->net_dev->name);



out:

	return neigh_node;

}

net/batman-adv/hard-interface.c

+14 −8
Original line number Diff line number Diff line
@@ -241,7 +241,7 @@ int batadv_hardif_min_mtu(struct net_device *soft_iface) 
{

	struct batadv_priv *bat_priv = netdev_priv(soft_iface);

	const struct batadv_hard_iface *hard_iface;

	int min_mtu = ETH_DATA_LEN;

	int min_mtu = INT_MAX;



	rcu_read_lock();

	list_for_each_entry_rcu(hard_iface, &batadv_hardif_list, list) {
@@ -256,8 +256,6 @@ int batadv_hardif_min_mtu(struct net_device *soft_iface) 
	}

	rcu_read_unlock();



	atomic_set(&bat_priv->packet_size_max, min_mtu);



	if (atomic_read(&bat_priv->fragmentation) == 0)

		goto out;
@@ -268,13 +266,21 @@ int batadv_hardif_min_mtu(struct net_device *soft_iface) 
	min_mtu = min_t(int, min_mtu, BATADV_FRAG_MAX_FRAG_SIZE);

	min_mtu -= sizeof(struct batadv_frag_packet);

	min_mtu *= BATADV_FRAG_MAX_FRAGMENTS;

	atomic_set(&bat_priv->packet_size_max, min_mtu);



	/* with fragmentation enabled we can fragment external packets easily */

	min_mtu = min_t(int, min_mtu, ETH_DATA_LEN);



out:

	return min_mtu - batadv_max_header_len();

	/* report to the other components the maximum amount of bytes that

	 * batman-adv can send over the wire (without considering the payload

	 * overhead). For example, this value is used by TT to compute the

	 * maximum local table table size

	 */

	atomic_set(&bat_priv->packet_size_max, min_mtu);



	/* the real soft-interface MTU is computed by removing the payload

	 * overhead from the maximum amount of bytes that was just computed.

	 *

	 * However batman-adv does not support MTUs bigger than ETH_DATA_LEN

	 */

	return min_t(int, min_mtu - batadv_max_header_len(), ETH_DATA_LEN);

}



/* adjusts the MTU if a new interface with a smaller MTU appeared. */

net/batman-adv/originator.c

+36 −0
Original line number Diff line number Diff line
@@ -457,6 +457,42 @@ out: 
	return neigh_node;

}



/**

 * batadv_neigh_node_get - retrieve a neighbour from the list

 * @orig_node: originator which the neighbour belongs to

 * @hard_iface: the interface where this neighbour is connected to

 * @addr: the address of the neighbour

 *

 * Looks for and possibly returns a neighbour belonging to this originator list

 * which is connected through the provided hard interface.

 * Returns NULL if the neighbour is not found.

 */

struct batadv_neigh_node *

batadv_neigh_node_get(const struct batadv_orig_node *orig_node,

		      const struct batadv_hard_iface *hard_iface,

		      const uint8_t *addr)

{

	struct batadv_neigh_node *tmp_neigh_node, *res = NULL;



	rcu_read_lock();

	hlist_for_each_entry_rcu(tmp_neigh_node, &orig_node->neigh_list, list) {

		if (!batadv_compare_eth(tmp_neigh_node->addr, addr))

			continue;



		if (tmp_neigh_node->if_incoming != hard_iface)

			continue;



		if (!atomic_inc_not_zero(&tmp_neigh_node->refcount))

			continue;



		res = tmp_neigh_node;

		break;

	}

	rcu_read_unlock();



	return res;

}



/**

 * batadv_orig_ifinfo_free_rcu - free the orig_ifinfo object

 * @rcu: rcu pointer of the orig_ifinfo object

net/batman-adv/originator.h

+4 −0
Original line number Diff line number Diff line
@@ -29,6 +29,10 @@ void batadv_orig_node_free_ref_now(struct batadv_orig_node *orig_node); 
struct batadv_orig_node *batadv_orig_node_new(struct batadv_priv *bat_priv,

					      const uint8_t *addr);

struct batadv_neigh_node *

batadv_neigh_node_get(const struct batadv_orig_node *orig_node,

		      const struct batadv_hard_iface *hard_iface,

		      const uint8_t *addr);

struct batadv_neigh_node *

batadv_neigh_node_new(struct batadv_hard_iface *hard_iface,

		      const uint8_t *neigh_addr,

		      struct batadv_orig_node *orig_node);

net/batman-adv/routing.c

+3 −1
Original line number Diff line number Diff line
@@ -688,7 +688,7 @@ static int batadv_check_unicast_ttvn(struct batadv_priv *bat_priv, 
	int is_old_ttvn;



	/* check if there is enough data before accessing it */

	if (pskb_may_pull(skb, hdr_len + ETH_HLEN) < 0)

	if (!pskb_may_pull(skb, hdr_len + ETH_HLEN))

		return 0;



	/* create a copy of the skb (in case of for re-routing) to modify it. */
@@ -918,6 +918,8 @@ int batadv_recv_unicast_tvlv(struct sk_buff *skb, 


	if (ret != NET_RX_SUCCESS)

		ret = batadv_route_unicast_packet(skb, recv_if);

	else

		consume_skb(skb);



	return ret;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE