diff --git a/batman-adv/Makefile b/batman-adv/Makefile index 161953d..d51bc65 100644 --- a/batman-adv/Makefile +++ b/batman-adv/Makefile @@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=batman-adv PKG_VERSION:=2017.2 -PKG_RELEASE:=0 +PKG_RELEASE:=1 PKG_MD5SUM:=937b5f1d0188e3522d67ad45ee0a4f5a PKG_HASH:=d487974e21cb53d39f139e93a2cf297807df5b7bf63ba6d810bad6d91537394f diff --git a/batman-adv/patches/0001-batman-adv-fix-TT-sync-flag-inconsistencies.patch b/batman-adv/patches/0001-batman-adv-fix-TT-sync-flag-inconsistencies.patch new file mode 100644 index 0000000..c96f9fd --- /dev/null +++ b/batman-adv/patches/0001-batman-adv-fix-TT-sync-flag-inconsistencies.patch @@ -0,0 +1,208 @@ +From: Linus Lüssing +Date: Thu, 6 Jul 2017 07:02:25 +0200 +Subject: [PATCH] batman-adv: fix TT sync flag inconsistencies + +This patch fixes an issue in the translation table code potentially +leading to a TT Request + Response storm. The issue may occur for nodes +involving BLA and an inconsistent configuration of the batman-adv AP +isolation feature. However, since the new multicast optimizations, a +single, malformed packet may lead to a mesh-wide, persistent +Denial-of-Service, too. + +The issue occurs because nodes are currently OR-ing the TT sync flags of +all originators announcing a specific MAC address via the +translation table. When an intermediate node now receives a TT Request +and wants to answer this on behave of the destination node then this +intermediate node now responds with an altered flag field and broken +CRC. The next OGM of the real destination will lead to a CRC mismatch +and triggering a TT Request and Response again. + +Furthermore, the OR-ing is currently never undone as long as at least +one originator announcing the according MAC address remains, leading to +the potential persistency of this issue. + +This patch fixes this issue by storing the flags used in the CRC +calculation on a a per TT orig entry basis to be able to respond with +the correct, original flags in an intermediate TT Response for one +thing. And to be able to correctly unset sync flags once all nodes +announcing a sync flag vanish for another. + +Fixes: fa614fd04692 ("batman-adv: fix tt_global_entries flags update") +Signed-off-by: Linus Lüssing +Acked-by: Antonio Quartulli +Signed-off-by: Sven Eckelmann + +Origin: other, https://patchwork.open-mesh.org/patch/17072/ +--- + net/batman-adv/translation-table.c | 60 ++++++++++++++++++++++++++++++++------ + net/batman-adv/types.h | 2 ++ + 2 files changed, 53 insertions(+), 9 deletions(-) + +diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c +index e1133bc634b5e8ed9a4639677e577a0d52e7c1d5..8a3ce79b1307b7f260ce2f64e96bdacfb9a322f0 100644 +--- a/net/batman-adv/translation-table.c ++++ b/net/batman-adv/translation-table.c +@@ -1549,9 +1549,41 @@ batadv_tt_global_entry_has_orig(const struct batadv_tt_global_entry *entry, + return found; + } + ++/** ++ * batadv_tt_global_sync_flags - update TT sync flags ++ * @tt_global: the TT global entry to update sync flags in ++ * ++ * Updates the sync flag bits in the tt_global flag attribute with a logical ++ * OR of all sync flags from any of its TT orig entries. ++ */ ++static void ++batadv_tt_global_sync_flags(struct batadv_tt_global_entry *tt_global) ++{ ++ struct batadv_tt_orig_list_entry *orig_entry; ++ const struct hlist_head *head; ++ u16 flags = BATADV_NO_FLAGS; ++ ++ rcu_read_lock(); ++ head = &tt_global->orig_list; ++ hlist_for_each_entry_rcu(orig_entry, head, list) ++ flags |= orig_entry->flags; ++ rcu_read_unlock(); ++ ++ flags |= tt_global->common.flags & (~BATADV_TT_SYNC_MASK); ++ tt_global->common.flags = flags; ++} ++ ++/** ++ * batadv_tt_global_orig_entry_add - add or update a TT orig entry ++ * @tt_global: the TT global entry to add an orig entry in ++ * @orig_node: the originator to add an orig entry for ++ * @ttvn: translation table version number of this changeset ++ * @flags: TT sync flags ++ */ + static void + batadv_tt_global_orig_entry_add(struct batadv_tt_global_entry *tt_global, +- struct batadv_orig_node *orig_node, int ttvn) ++ struct batadv_orig_node *orig_node, int ttvn, ++ u8 flags) + { + struct batadv_tt_orig_list_entry *orig_entry; + +@@ -1561,7 +1593,8 @@ batadv_tt_global_orig_entry_add(struct batadv_tt_global_entry *tt_global, + * was added during a "temporary client detection" + */ + orig_entry->ttvn = ttvn; +- goto out; ++ orig_entry->flags = flags; ++ goto sync_flags; + } + + orig_entry = kmem_cache_zalloc(batadv_tt_orig_cache, GFP_ATOMIC); +@@ -1573,6 +1606,7 @@ batadv_tt_global_orig_entry_add(struct batadv_tt_global_entry *tt_global, + batadv_tt_global_size_inc(orig_node, tt_global->common.vid); + orig_entry->orig_node = orig_node; + orig_entry->ttvn = ttvn; ++ orig_entry->flags = flags; + kref_init(&orig_entry->refcount); + + spin_lock_bh(&tt_global->list_lock); +@@ -1582,6 +1616,8 @@ batadv_tt_global_orig_entry_add(struct batadv_tt_global_entry *tt_global, + spin_unlock_bh(&tt_global->list_lock); + atomic_inc(&tt_global->orig_list_count); + ++sync_flags: ++ batadv_tt_global_sync_flags(tt_global); + out: + if (orig_entry) + batadv_tt_orig_list_entry_put(orig_entry); +@@ -1703,10 +1739,10 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv, + } + + /* the change can carry possible "attribute" flags like the +- * TT_CLIENT_WIFI, therefore they have to be copied in the ++ * TT_CLIENT_TEMP, therefore they have to be copied in the + * client entry + */ +- common->flags |= flags; ++ common->flags |= flags & (~BATADV_TT_SYNC_MASK); + + /* If there is the BATADV_TT_CLIENT_ROAM flag set, there is only + * one originator left in the list and we previously received a +@@ -1723,7 +1759,8 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv, + } + add_orig_entry: + /* add the new orig_entry (if needed) or update it */ +- batadv_tt_global_orig_entry_add(tt_global_entry, orig_node, ttvn); ++ batadv_tt_global_orig_entry_add(tt_global_entry, orig_node, ttvn, ++ flags & BATADV_TT_SYNC_MASK); + + batadv_dbg(BATADV_DBG_TT, bat_priv, + "Creating new global tt entry: %pM (vid: %d, via %pM)\n", +@@ -1946,6 +1983,7 @@ batadv_tt_global_dump_subentry(struct sk_buff *msg, u32 portid, u32 seq, + struct batadv_tt_orig_list_entry *orig, + bool best) + { ++ u16 flags = (common->flags & (~BATADV_TT_SYNC_MASK)) | orig->flags; + void *hdr; + struct batadv_orig_node_vlan *vlan; + u8 last_ttvn; +@@ -1975,7 +2013,7 @@ batadv_tt_global_dump_subentry(struct sk_buff *msg, u32 portid, u32 seq, + nla_put_u8(msg, BATADV_ATTR_TT_LAST_TTVN, last_ttvn) || + nla_put_u32(msg, BATADV_ATTR_TT_CRC32, crc) || + nla_put_u16(msg, BATADV_ATTR_TT_VID, common->vid) || +- nla_put_u32(msg, BATADV_ATTR_TT_FLAGS, common->flags)) ++ nla_put_u32(msg, BATADV_ATTR_TT_FLAGS, flags)) + goto nla_put_failure; + + if (best && nla_put_flag(msg, BATADV_ATTR_FLAG_BEST)) +@@ -2589,6 +2627,7 @@ static u32 batadv_tt_global_crc(struct batadv_priv *bat_priv, + unsigned short vid) + { + struct batadv_hashtable *hash = bat_priv->tt.global_hash; ++ struct batadv_tt_orig_list_entry *tt_orig; + struct batadv_tt_common_entry *tt_common; + struct batadv_tt_global_entry *tt_global; + struct hlist_head *head; +@@ -2627,8 +2666,9 @@ static u32 batadv_tt_global_crc(struct batadv_priv *bat_priv, + /* find out if this global entry is announced by this + * originator + */ +- if (!batadv_tt_global_entry_has_orig(tt_global, +- orig_node)) ++ tt_orig = batadv_tt_global_orig_entry_find(tt_global, ++ orig_node); ++ if (!tt_orig) + continue; + + /* use network order to read the VID: this ensures that +@@ -2640,10 +2680,12 @@ static u32 batadv_tt_global_crc(struct batadv_priv *bat_priv, + /* compute the CRC on flags that have to be kept in sync + * among nodes + */ +- flags = tt_common->flags & BATADV_TT_SYNC_MASK; ++ flags = tt_orig->flags; + crc_tmp = crc32c(crc_tmp, &flags, sizeof(flags)); + + crc ^= crc32c(crc_tmp, tt_common->addr, ETH_ALEN); ++ ++ batadv_tt_orig_list_entry_put(tt_orig); + } + rcu_read_unlock(); + } +diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h +index ea43a64492479809fe6bdf95b436792078f50e9f..a62795868794103d7e712ba91def5997dc3a5779 100644 +--- a/net/batman-adv/types.h ++++ b/net/batman-adv/types.h +@@ -1260,6 +1260,7 @@ struct batadv_tt_global_entry { + * struct batadv_tt_orig_list_entry - orig node announcing a non-mesh client + * @orig_node: pointer to orig node announcing this non-mesh client + * @ttvn: translation table version number which added the non-mesh client ++ * @flags: per orig entry TT sync flags + * @list: list node for batadv_tt_global_entry::orig_list + * @refcount: number of contexts the object is used + * @rcu: struct used for freeing in an RCU-safe manner +@@ -1267,6 +1268,7 @@ struct batadv_tt_global_entry { + struct batadv_tt_orig_list_entry { + struct batadv_orig_node *orig_node; + u8 ttvn; ++ u8 flags; + struct hlist_node list; + struct kref refcount; + struct rcu_head rcu;