Skip to content

Commit eaa4aba

Browse files
ecsvecsv
committed
batman-adv: Merge bugfixes from 2024.4
* Do not send uninitialized TT changes * Remove uninitialized data in full table TT response * Do not let TT changes list grows indefinitely Signed-off-by: Sven Eckelmann <[email protected]>
1 parent 3f15699 commit eaa4aba

4 files changed

+229
-1
lines changed

‎batman-adv/Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ include $(TOPDIR)/rules.mk
44

55
PKG_NAME:=batman-adv
66
PKG_VERSION:=2024.3
7-
PKG_RELEASE:=2
7+
PKG_RELEASE:=3
88

99
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
1010
PKG_SOURCE_URL:=https://downloads.open-mesh.org/batman/releases/batman-adv-$(PKG_VERSION)

‎batman-adv/patches/0003-batman-adv-Do-not-send-uninitialized-TT-changes.patch

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
From: Remi Pommarel <[email protected]>
2+
Date: Fri, 22 Nov 2024 16:52:48 +0100
3+
Subject: batman-adv: Do not send uninitialized TT changes
4+
5+
The number of TT changes can be less than initially expected in
6+
batadv_tt_tvlv_container_update() (changes can be removed by
7+
batadv_tt_local_event() in ADD+DEL sequence between reading
8+
tt_diff_entries_num and actually iterating the change list under lock).
9+
10+
Thus tt_diff_len could be bigger than the actual changes size that need
11+
to be sent. Because batadv_send_my_tt_response sends the whole
12+
packet, uninitialized data can be interpreted as TT changes on other
13+
nodes leading to weird TT global entries on those nodes such as:
14+
15+
* 00:00:00:00:00:00 -1 [....] ( 0) 88:12:4e:ad:7e:ba (179) (0x45845380)
16+
* 00:00:00:00:78:79 4092 [.W..] ( 0) 88:12:4e:ad:7e:3c (145) (0x8ebadb8b)
17+
18+
All of the above also applies to OGM tvlv container buffer's tvlv_len.
19+
20+
Remove the extra allocated space to avoid sending uninitialized TT
21+
changes in batadv_send_my_tt_response() and batadv_v_ogm_send_softif().
22+
23+
Fixes: 8405301b9794 ("batman-adv: tvlv - convert tt data sent within OGMs")
24+
Signed-off-by: Remi Pommarel <[email protected]>
25+
Signed-off-by: Sven Eckelmann <[email protected]>
26+
Origin: upstream, https://git.open-mesh.org/batman-adv.git/commit/5fe3a7a48ea6374280dc855db7b802d70b1870c6
27+
28+
--- a/net/batman-adv/translation-table.c
29+
+++ b/net/batman-adv/translation-table.c
30+
@@ -990,6 +990,7 @@ static void batadv_tt_tvlv_container_upd
31+
int tt_diff_len, tt_change_len = 0;
32+
int tt_diff_entries_num = 0;
33+
int tt_diff_entries_count = 0;
34+
+ size_t tt_extra_len = 0;
35+
u16 tvlv_len;
36+
37+
tt_diff_entries_num = atomic_read(&bat_priv->tt.local_changes);
38+
@@ -1027,6 +1028,9 @@ static void batadv_tt_tvlv_container_upd
39+
}
40+
spin_unlock_bh(&bat_priv->tt.changes_list_lock);
41+
42+
+ tt_extra_len = batadv_tt_len(tt_diff_entries_num -
43+
+ tt_diff_entries_count);
44+
+
45+
/* Keep the buffer for possible tt_request */
46+
spin_lock_bh(&bat_priv->tt.last_changeset_lock);
47+
kfree(bat_priv->tt.last_changeset);
48+
@@ -1035,6 +1039,7 @@ static void batadv_tt_tvlv_container_upd
49+
tt_change_len = batadv_tt_len(tt_diff_entries_count);
50+
/* check whether this new OGM has no changes due to size problems */
51+
if (tt_diff_entries_count > 0) {
52+
+ tt_diff_len -= tt_extra_len;
53+
/* if kmalloc() fails we will reply with the full table
54+
* instead of providing the diff
55+
*/
56+
@@ -1047,6 +1052,8 @@ static void batadv_tt_tvlv_container_upd
57+
}
58+
spin_unlock_bh(&bat_priv->tt.last_changeset_lock);
59+
60+
+ /* Remove extra packet space for OGM */
61+
+ tvlv_len -= tt_extra_len;
62+
container_register:
63+
batadv_tvlv_container_register(bat_priv, BATADV_TVLV_TT, 1, tt_data,
64+
tvlv_len);

‎batman-adv/patches/0004-batman-adv-Remove-uninitialized-data-in-full-table-T.patch

+101
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
From: Remi Pommarel <[email protected]>
2+
Date: Fri, 22 Nov 2024 16:52:49 +0100
3+
Subject: batman-adv: Remove uninitialized data in full table TT response
4+
5+
The number of entries filled by batadv_tt_tvlv_generate() can be less
6+
than initially expected in batadv_tt_prepare_tvlv_{global,local}_data()
7+
(changes can be removed by batadv_tt_local_event() in ADD+DEL sequence
8+
in the meantime as the lock held during the whole tvlv global/local data
9+
generation).
10+
11+
Thus tvlv_len could be bigger than the actual TT entry size that need
12+
to be sent so full table TT_RESPONSE could hold invalid TT entries such
13+
as below.
14+
15+
* 00:00:00:00:00:00 -1 [....] ( 0) 88:12:4e:ad:7e:ba (179) (0x45845380)
16+
* 00:00:00:00:78:79 4092 [.W..] ( 0) 88:12:4e:ad:7e:3c (145) (0x8ebadb8b)
17+
18+
Remove the extra allocated space to avoid sending uninitialized entries
19+
for full table TT_RESPONSE in both batadv_send_other_tt_response() and
20+
batadv_send_my_tt_response().
21+
22+
Fixes: 21a57f6e7a3b ("batman-adv: make the TT CRC logic VLAN specific")
23+
Signed-off-by: Remi Pommarel <[email protected]>
24+
Signed-off-by: Sven Eckelmann <[email protected]>
25+
Origin: upstream, https://git.open-mesh.org/batman-adv.git/commit/095c3965bdc29e43546a9cdd21f179f952e01f48
26+
27+
--- a/net/batman-adv/translation-table.c
28+
+++ b/net/batman-adv/translation-table.c
29+
@@ -2754,14 +2754,16 @@ static bool batadv_tt_global_valid(const
30+
*
31+
* Fills the tvlv buff with the tt entries from the specified hash. If valid_cb
32+
* is not provided then this becomes a no-op.
33+
+ *
34+
+ * Return: Remaining unused length in tvlv_buff.
35+
*/
36+
-static void batadv_tt_tvlv_generate(struct batadv_priv *bat_priv,
37+
- struct batadv_hashtable *hash,
38+
- void *tvlv_buff, u16 tt_len,
39+
- bool (*valid_cb)(const void *,
40+
- const void *,
41+
- u8 *flags),
42+
- void *cb_data)
43+
+static u16 batadv_tt_tvlv_generate(struct batadv_priv *bat_priv,
44+
+ struct batadv_hashtable *hash,
45+
+ void *tvlv_buff, u16 tt_len,
46+
+ bool (*valid_cb)(const void *,
47+
+ const void *,
48+
+ u8 *flags),
49+
+ void *cb_data)
50+
{
51+
struct batadv_tt_common_entry *tt_common_entry;
52+
struct batadv_tvlv_tt_change *tt_change;
53+
@@ -2775,7 +2777,7 @@ static void batadv_tt_tvlv_generate(stru
54+
tt_change = tvlv_buff;
55+
56+
if (!valid_cb)
57+
- return;
58+
+ return tt_len;
59+
60+
rcu_read_lock();
61+
for (i = 0; i < hash->size; i++) {
62+
@@ -2801,6 +2803,8 @@ static void batadv_tt_tvlv_generate(stru
63+
}
64+
}
65+
rcu_read_unlock();
66+
+
67+
+ return batadv_tt_len(tt_tot - tt_num_entries);
68+
}
69+
70+
/**
71+
@@ -3076,10 +3080,11 @@ static bool batadv_send_other_tt_respons
72+
goto out;
73+
74+
/* fill the rest of the tvlv with the real TT entries */
75+
- batadv_tt_tvlv_generate(bat_priv, bat_priv->tt.global_hash,
76+
- tt_change, tt_len,
77+
- batadv_tt_global_valid,
78+
- req_dst_orig_node);
79+
+ tvlv_len -= batadv_tt_tvlv_generate(bat_priv,
80+
+ bat_priv->tt.global_hash,
81+
+ tt_change, tt_len,
82+
+ batadv_tt_global_valid,
83+
+ req_dst_orig_node);
84+
}
85+
86+
/* Don't send the response, if larger than fragmented packet. */
87+
@@ -3203,9 +3208,11 @@ static bool batadv_send_my_tt_response(s
88+
goto out;
89+
90+
/* fill the rest of the tvlv with the real TT entries */
91+
- batadv_tt_tvlv_generate(bat_priv, bat_priv->tt.local_hash,
92+
- tt_change, tt_len,
93+
- batadv_tt_local_valid, NULL);
94+
+ tvlv_len -= batadv_tt_tvlv_generate(bat_priv,
95+
+ bat_priv->tt.local_hash,
96+
+ tt_change, tt_len,
97+
+ batadv_tt_local_valid,
98+
+ NULL);
99+
}
100+
101+
tvlv_tt_data->flags = BATADV_TT_RESPONSE;

‎batman-adv/patches/0005-batman-adv-Do-not-let-TT-changes-list-grows-indefini.patch

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
From: Remi Pommarel <[email protected]>
2+
Date: Fri, 22 Nov 2024 16:52:50 +0100
3+
Subject: batman-adv: Do not let TT changes list grows indefinitely
4+
5+
When TT changes list is too big to fit in packet due to MTU size, an
6+
empty OGM is sent expected other node to send TT request to get the
7+
changes. The issue is that tt.last_changeset was not built thus the
8+
originator was responding with previous changes to those TT requests
9+
(see batadv_send_my_tt_response). Also the changes list was never
10+
cleaned up effectively never ending growing from this point onwards,
11+
repeatedly sending the same TT response changes over and over, and
12+
creating a new empty OGM every OGM interval expecting for the local
13+
changes to be purged.
14+
15+
When there is more TT changes that can fit in packet, drop all changes,
16+
send empty OGM and wait for TT request so we can respond with a full
17+
table instead.
18+
19+
Fixes: 8405301b9794 ("batman-adv: tvlv - convert tt data sent within OGMs")
20+
Signed-off-by: Remi Pommarel <[email protected]>
21+
Acked-by: Antonio Quartulli <[email protected]>
22+
Signed-off-by: Sven Eckelmann <[email protected]>
23+
Origin: upstream, https://git.open-mesh.org/batman-adv.git/commit/4d49d6e9d60c41a6da727108518cb8fb33295537
24+
25+
--- a/net/batman-adv/translation-table.c
26+
+++ b/net/batman-adv/translation-table.c
27+
@@ -990,6 +990,7 @@ static void batadv_tt_tvlv_container_upd
28+
int tt_diff_len, tt_change_len = 0;
29+
int tt_diff_entries_num = 0;
30+
int tt_diff_entries_count = 0;
31+
+ bool drop_changes = false;
32+
size_t tt_extra_len = 0;
33+
u16 tvlv_len;
34+
35+
@@ -997,10 +998,17 @@ static void batadv_tt_tvlv_container_upd
36+
tt_diff_len = batadv_tt_len(tt_diff_entries_num);
37+
38+
/* if we have too many changes for one packet don't send any
39+
- * and wait for the tt table request which will be fragmented
40+
+ * and wait for the tt table request so we can reply with the full
41+
+ * (fragmented) table.
42+
+ *
43+
+ * The local change history should still be cleaned up so the next
44+
+ * TT round can start again with a clean state.
45+
*/
46+
- if (tt_diff_len > bat_priv->soft_iface->mtu)
47+
+ if (tt_diff_len > bat_priv->soft_iface->mtu) {
48+
tt_diff_len = 0;
49+
+ tt_diff_entries_num = 0;
50+
+ drop_changes = true;
51+
+ }
52+
53+
tvlv_len = batadv_tt_prepare_tvlv_local_data(bat_priv, &tt_data,
54+
&tt_change, &tt_diff_len);
55+
@@ -1009,7 +1017,7 @@ static void batadv_tt_tvlv_container_upd
56+
57+
tt_data->flags = BATADV_TT_OGM_DIFF;
58+
59+
- if (tt_diff_len == 0)
60+
+ if (!drop_changes && tt_diff_len == 0)
61+
goto container_register;
62+
63+
spin_lock_bh(&bat_priv->tt.changes_list_lock);

0 commit comments

Comments
 (0)