Merge pull request #469 from ecsv/batadv-for-18.06

openwrt-18.06: batman-adv: Merge bugfixes from 2019.2

11 files changed, 134 insertions, 9 deletions

diff --git a/batman-adv/Makefile b/batman-adv/Makefile
index 42f1300..f987b98 100644
--- a/batman-adv/Makefile
+++ b/batman-adv/Makefile
@@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=batman-adv
 
 PKG_VERSION:=2018.1
-PKG_RELEASE:=6
+PKG_RELEASE:=7
 PKG_HASH:=b866b28dbbe5c9238abbdf5abbc30fc526dea56898ce4c1bd76d5c017843048b
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
diff --git a/batman-adv/patches/0022-batman-adv-Use-explicit-tvlv-padding-for-ELP-packets.patch b/batman-adv/patches/0022-batman-adv-Use-explicit-tvlv-padding-for-ELP-packets.patch
index 3285e47..2f6c1f9 100644
--- a/batman-adv/patches/0022-batman-adv-Use-explicit-tvlv-padding-for-ELP-packets.patch
+++ b/batman-adv/patches/0022-batman-adv-Use-explicit-tvlv-padding-for-ELP-packets.patch
@@ -1,6 +1,6 @@
 From: Sven Eckelmann <sven@narfation.org>
 Date: Tue, 30 Oct 2018 12:17:10 +0100
-Subject: [PATCH] batman-adv: Use explicit tvlv padding for ELP packets
+Subject: batman-adv: Use explicit tvlv padding for ELP packets
 
 The announcement messages of batman-adv COMPAT_VERSION 15 have the
 possibility to announce additional information via a dynamic TVLV part.
@@ -21,9 +21,6 @@ Reported-by: Linus Lüssing <linus.luessing@c0d3.blue>
 Signed-off-by: Sven Eckelmann <sven@narfation.org>
 
 Origin: upstream, https://git.open-mesh.org/batman-adv.git/commit/974337ee9773c4bd0a2d5c322306cf2bea445e11
----
- net/batman-adv/bat_v_elp.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
 index 83b46654449df72ceda6ca3177f72e7faf0603ab..9aa3c7b2e9bad6c50b2939b6dbf5a9a2e713b93b 100644
diff --git a/batman-adv/patches/0023-batman-adv-Expand-merged-fragment-buffer-for-full-pa.patch b/batman-adv/patches/0023-batman-adv-Expand-merged-fragment-buffer-for-full-pa.patch
index 7133976..6bdb6bc 100644
--- a/batman-adv/patches/0023-batman-adv-Expand-merged-fragment-buffer-for-full-pa.patch
+++ b/batman-adv/patches/0023-batman-adv-Expand-merged-fragment-buffer-for-full-pa.patch
@@ -1,6 +1,6 @@
 From: Sven Eckelmann <sven@narfation.org>
 Date: Wed, 7 Nov 2018 23:09:12 +0100
-Subject: [PATCH] batman-adv: Expand merged fragment buffer for full packet
+Subject: batman-adv: Expand merged fragment buffer for full packet
 
 The complete size ("total_size") of the fragmented packet is stored in the
 fragment header and in the size of the fragment chain. When the fragments
@@ -25,9 +25,6 @@ Co-authored-by: Linus Lüssing <linus.luessing@c0d3.blue>
 Signed-off-by: Sven Eckelmann <sven@narfation.org>
 
 Origin: other, https://patchwork.open-mesh.org/patch/17616/
----
- net/batman-adv/fragmentation.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
 index 0fddc17106bd8a0e3f064fee9adba7c226f34682..5b71a289d04fc80de6c20e7a24d621727c77825a 100644
diff --git a/batman-adv/patches/0022-batman-adv-Avoid-WARN-on-net_device-without-parent-i.patch b/batman-adv/patches/0024-batman-adv-Avoid-WARN-on-net_device-without-parent-i.patch
index 0d8aa2c..0d8aa2c 100644
--- a/batman-adv/patches/0022-batman-adv-Avoid-WARN-on-net_device-without-parent-i.patch
+++ b/batman-adv/patches/0024-batman-adv-Avoid-WARN-on-net_device-without-parent-i.patch
diff --git a/batman-adv/patches/0023-batman-adv-Force-mac-header-to-start-of-data-on-xmit.patch b/batman-adv/patches/0025-batman-adv-Force-mac-header-to-start-of-data-on-xmit.patch
index f7fe6ce..f7fe6ce 100644
--- a/batman-adv/patches/0023-batman-adv-Force-mac-header-to-start-of-data-on-xmit.patch
+++ b/batman-adv/patches/0025-batman-adv-Force-mac-header-to-start-of-data-on-xmit.patch
diff --git a/batman-adv/patches/0024-batman-adv-fix-uninit-value-in-batadv_interface_tx.patch b/batman-adv/patches/0026-batman-adv-fix-uninit-value-in-batadv_interface_tx.patch
index dd2edad..dd2edad 100644
--- a/batman-adv/patches/0024-batman-adv-fix-uninit-value-in-batadv_interface_tx.patch
+++ b/batman-adv/patches/0026-batman-adv-fix-uninit-value-in-batadv_interface_tx.patch
diff --git a/batman-adv/patches/0025-batman-adv-Reduce-claim-hash-refcnt-only-for-removed.patch b/batman-adv/patches/0027-batman-adv-Reduce-claim-hash-refcnt-only-for-removed.patch
index 7a2f999..7a2f999 100644
--- a/batman-adv/patches/0025-batman-adv-Reduce-claim-hash-refcnt-only-for-removed.patch
+++ b/batman-adv/patches/0027-batman-adv-Reduce-claim-hash-refcnt-only-for-removed.patch
diff --git a/batman-adv/patches/0026-batman-adv-Reduce-tt_local-hash-refcnt-only-for-remo.patch b/batman-adv/patches/0028-batman-adv-Reduce-tt_local-hash-refcnt-only-for-remo.patch
index a6ffb25..a6ffb25 100644
--- a/batman-adv/patches/0026-batman-adv-Reduce-tt_local-hash-refcnt-only-for-remo.patch
+++ b/batman-adv/patches/0028-batman-adv-Reduce-tt_local-hash-refcnt-only-for-remo.patch
diff --git a/batman-adv/patches/0027-batman-adv-Reduce-tt_global-hash-refcnt-only-for-rem.patch b/batman-adv/patches/0029-batman-adv-Reduce-tt_global-hash-refcnt-only-for-rem.patch
index cd08563..cd08563 100644
--- a/batman-adv/patches/0027-batman-adv-Reduce-tt_global-hash-refcnt-only-for-rem.patch
+++ b/batman-adv/patches/0029-batman-adv-Reduce-tt_global-hash-refcnt-only-for-rem.patch
diff --git a/batman-adv/patches/0030-batman-adv-mcast-fix-multicast-tt-tvlv-worker-lockin.patch b/batman-adv/patches/0030-batman-adv-mcast-fix-multicast-tt-tvlv-worker-lockin.patch
new file mode 100644
index 0000000..3f3f3d9
--- /dev/null
+++ b/batman-adv/patches/0030-batman-adv-mcast-fix-multicast-tt-tvlv-worker-lockin.patch
@@ -0,0 +1,103 @@
+From: Linus Lüssing <linus.luessing@c0d3.blue>
+Date: Wed, 24 Apr 2019 03:19:14 +0200
+Subject: batman-adv: mcast: fix multicast tt/tvlv worker locking
+
+Syzbot has reported some issues with the locking assumptions made for
+the multicast tt/tvlv worker: It was able to trigger the WARN_ON() in
+batadv_mcast_mla_tt_retract() and batadv_mcast_mla_tt_add().
+While hard/not reproduceable for us so far it seems that the
+delayed_work_pending() we use might not be quite safe from reordering.
+
+Therefore this patch adds an explicit, new spinlock to protect the
+update of the mla_list and flags in bat_priv and then removes the
+WARN_ON(delayed_work_pending()).
+
+Reported-by: syzbot+83f2d54ec6b7e417e13f@syzkaller.appspotmail.com
+Reported-by: syzbot+050927a651272b145a5d@syzkaller.appspotmail.com
+Reported-by: syzbot+979ffc89b87309b1b94b@syzkaller.appspotmail.com
+Reported-by: syzbot+f9f3f388440283da2965@syzkaller.appspotmail.com
+Fixes: 40b384052672 ("batman-adv: Use own timer for multicast TT and TVLV updates")
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+
+Origin: upstream, https://git.open-mesh.org/batman-adv.git/commit/b736cf8119cfbc9d95fef90c8832fdec6e8f29c7
+
+diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
+index 53b329d24461819b4cf0d4118cfa5b0eb8d7261b..0286c651468443197434ccf0fcf25aaa66a0c7e9 100644
+--- a/net/batman-adv/main.c
++++ b/net/batman-adv/main.c
+@@ -160,6 +160,7 @@ int batadv_mesh_init(struct net_device *soft_iface)
+ 	spin_lock_init(&bat_priv->tt.commit_lock);
+ 	spin_lock_init(&bat_priv->gw.list_lock);
+ #ifdef CONFIG_BATMAN_ADV_MCAST
++	spin_lock_init(&bat_priv->mcast.mla_lock);
+ 	spin_lock_init(&bat_priv->mcast.want_lists_lock);
+ #endif
+ 	spin_lock_init(&bat_priv->tvlv.container_list_lock);
+diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
+index a35f597e8c8bf4f15ad0f01aff29849d2bebe36f..39640d3d6fbdf8244344db6e79f2d769eb0972d9 100644
+--- a/net/batman-adv/multicast.c
++++ b/net/batman-adv/multicast.c
+@@ -325,8 +325,6 @@ static void batadv_mcast_mla_list_free(struct hlist_head *mcast_list)
+  * translation table except the ones listed in the given mcast_list.
+  *
+  * If mcast_list is NULL then all are retracted.
+- *
+- * Do not call outside of the mcast worker! (or cancel mcast worker first)
+  */
+ static void batadv_mcast_mla_tt_retract(struct batadv_priv *bat_priv,
+ 					struct hlist_head *mcast_list)
+@@ -334,8 +332,6 @@ static void batadv_mcast_mla_tt_retract(struct batadv_priv *bat_priv,
+ 	struct batadv_hw_addr *mcast_entry;
+ 	struct hlist_node *tmp;
+ 
+-	WARN_ON(delayed_work_pending(&bat_priv->mcast.work));
+-
+ 	hlist_for_each_entry_safe(mcast_entry, tmp, &bat_priv->mcast.mla_list,
+ 				  list) {
+ 		if (mcast_list &&
+@@ -359,8 +355,6 @@ static void batadv_mcast_mla_tt_retract(struct batadv_priv *bat_priv,
+  *
+  * Adds multicast listener announcements from the given mcast_list to the
+  * translation table if they have not been added yet.
+- *
+- * Do not call outside of the mcast worker! (or cancel mcast worker first)
+  */
+ static void batadv_mcast_mla_tt_add(struct batadv_priv *bat_priv,
+ 				    struct hlist_head *mcast_list)
+@@ -368,8 +362,6 @@ static void batadv_mcast_mla_tt_add(struct batadv_priv *bat_priv,
+ 	struct batadv_hw_addr *mcast_entry;
+ 	struct hlist_node *tmp;
+ 
+-	WARN_ON(delayed_work_pending(&bat_priv->mcast.work));
+-
+ 	if (!mcast_list)
+ 		return;
+ 
+@@ -658,7 +650,10 @@ static void batadv_mcast_mla_update(struct work_struct *work)
+ 	priv_mcast = container_of(delayed_work, struct batadv_priv_mcast, work);
+ 	bat_priv = container_of(priv_mcast, struct batadv_priv, mcast);
+ 
++	spin_lock(&bat_priv->mcast.mla_lock);
+ 	__batadv_mcast_mla_update(bat_priv);
++	spin_unlock(&bat_priv->mcast.mla_lock);
++
+ 	batadv_mcast_start_timer(bat_priv);
+ }
+ 
+diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
+index 476b052ad9824d4cbcd6218dce40b603e3400fd2..6d07898d8d1a21007b3e68d5d2511b478110f659 100644
+--- a/net/batman-adv/types.h
++++ b/net/batman-adv/types.h
+@@ -1215,6 +1215,11 @@ struct batadv_priv_mcast {
+ 	/** @num_disabled: number of nodes that have no mcast tvlv */
+ 	atomic_t num_disabled;
+ 
++	/**
++	 * @mla_lock: a lock protecting mla_list and mla_flags
++	 */
++	spinlock_t mla_lock;
++
+ 	/**
+ 	 * @num_want_all_unsnoopables: number of nodes wanting unsnoopable IP
+ 	 *  traffic
diff --git a/batman-adv/patches/0031-batman-adv-fix-for-leaked-TVLV-handler.patch b/batman-adv/patches/0031-batman-adv-fix-for-leaked-TVLV-handler.patch
new file mode 100644
index 0000000..ce24a36
--- /dev/null
+++ b/batman-adv/patches/0031-batman-adv-fix-for-leaked-TVLV-handler.patch
@@ -0,0 +1,28 @@
+From: Jeremy Sowden <jeremy@azazel.net>
+Date: Tue, 21 May 2019 20:58:57 +0100
+Subject: batman-adv: fix for leaked TVLV handler.
+
+A handler for BATADV_TVLV_ROAM was being registered when the
+translation-table was initialized, but not unregistered when the
+translation-table was freed.  Unregister it.
+
+Fixes: 3de4e64df0f1 ("batman-adv: tvlv - convert roaming adv packet to use tvlv unicast packets")
+Reported-by: syzbot+d454a826e670502484b8@syzkaller.appspotmail.com
+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
+Signed-off-by: Sven Eckelmann <sven@narfation.org
+
+Origin: upstream, https://git.open-mesh.org/batman-adv.git/commit/87445d81c360a5f9833546114e98ffd2c1fd3a4d
+
+diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
+index 554fd886e652c7c206ff43a5627d342ccbcc2123..c29aadc5bd8b2020ba67779c517cc1e4ea9f6569 100644
+--- a/net/batman-adv/translation-table.c
++++ b/net/batman-adv/translation-table.c
+@@ -3821,6 +3821,8 @@ static void batadv_tt_purge(struct work_struct *work)
+  */
+ void batadv_tt_free(struct batadv_priv *bat_priv)
+ {
++	batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_ROAM, 1);
++
+ 	batadv_tvlv_container_unregister(bat_priv, BATADV_TVLV_TT, 1);
+ 	batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_TT, 1);
+