Home Explore Help
Register Sign In
wareck
/
openwrt-archive
1
0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Branch: master
Branches Tags
openwrt-archive
/
package
/
kernel
/
mac80211
/
patches
/
303-mac80211-mesh-flush-mesh-paths-unconditionally.patch

303-mac80211-mesh-flush-mesh-paths-unconditionally.patch 7.3 KB
Permalink History Raw

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146 
  1. From: Bob Copeland <me@bobcopeland.com>
    2. 

  2. Date: Sun, 15 May 2016 13:19:16 -0400
    3. 

  3. Subject: [PATCH] mac80211: mesh: flush mesh paths unconditionally
    4. 

  4. 

  5. Currently, the mesh paths associated with a nexthop station are cleaned
    6. 

  6. up in the following code path:
    7. 

  7. 

  8.     __sta_info_destroy_part1
    9. 

  9.     synchronize_net()
    10. 

  10.     __sta_info_destroy_part2
    11. 

  11.      -> cleanup_single_sta
    12. 

  12.        -> mesh_sta_cleanup
    13. 

  13.          -> mesh_plink_deactivate
    14. 

  14.            -> mesh_path_flush_by_nexthop
    15. 

  15. 

  16. However, there are a couple of problems here:
    17. 

  17. 

  18. 1) the paths aren't flushed at all if the MPM is running in userspace
    19. 

  19.    (e.g. when using wpa_supplicant or authsae)
    20. 

  20. 

  21. 2) there is no synchronize_rcu between removing the path and readers
    22. 

  22.    accessing the nexthop, which means the following race is possible:
    23. 

  23. 

  24. CPU0                            CPU1
    25. 

  25. ~~~~                            ~~~~
    26. 

  26.                                 sta_info_destroy_part1()
    27. 

  27.                                 synchronize_net()
    28. 

  28. rcu_read_lock()
    29. 

  29. mesh_nexthop_resolve()
    30. 

  30.   mpath = mesh_path_lookup()
    31. 

  31.                                 [...] -> mesh_path_flush_by_nexthop()
    32. 

  32.   sta = rcu_dereference(
    33. 

  33.     mpath->next_hop)
    34. 

  34.                                 kfree(sta)
    35. 

  35.   access sta <-- CRASH
    36. 

  36. 

  37. Fix both of these by unconditionally flushing paths before destroying
    38. 

  38. the sta, and by adding a synchronize_net() after path flush to ensure
    39. 

  39. no active readers can still dereference the sta.
    40. 

  40. 

  41. Fixes this crash:
    42. 

  42. 

  43. [  348.529295] BUG: unable to handle kernel paging request at 00020040
    44. 

  44. [  348.530014] IP: [<f929245d>] ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211]
    45. 

  45. [  348.530014] *pde = 00000000
    46. 

  46. [  348.530014] Oops: 0000 [#1] PREEMPT
    47. 

  47. [  348.530014] Modules linked in: drbg ansi_cprng ctr ccm ppp_generic slhc ipt_MASQUERADE nf_nat_masquerade_ipv4 8021q ]
    48. 

  48. [  348.530014] CPU: 0 PID: 20597 Comm: wget Tainted: G           O 4.6.0-rc5-wt=V1 #1
    49. 

  49. [  348.530014] Hardware name: To Be Filled By O.E.M./To be filled by O.E.M., BIOS 080016  11/07/2014
    50. 

  50. [  348.530014] task: f64fa280 ti: f4f9c000 task.ti: f4f9c000
    51. 

  51. [  348.530014] EIP: 0060:[<f929245d>] EFLAGS: 00010246 CPU: 0
    52. 

  52. [  348.530014] EIP is at ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211]
    53. 

  53. [  348.530014] EAX: f4ce63e0 EBX: 00000088 ECX: f3788416 EDX: 00020008
    54. 

  54. [  348.530014] ESI: 00000000 EDI: 00000088 EBP: f6409a4c ESP: f6409a40
    55. 

  55. [  348.530014]  DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
    56. 

  56. [  348.530014] CR0: 80050033 CR2: 00020040 CR3: 33190000 CR4: 00000690
    57. 

  57. [  348.530014] Stack:
    58. 

  58. [  348.530014]  00000000 f4ce63e0 f5f9bd80 f6409a64 f9291d80 0000ce67 f5d51e00 f4ce63e0
    59. 

  59. [  348.530014]  f3788416 f6409a80 f9291dc1 f4ce8320 f4ce63e0 f5d51e00 f4ce63e0 f4ce8320
    60. 

  60. [  348.530014]  f6409a98 f9277f6f 00000000 00000000 0000007c 00000000 f6409b2c f9278dd1
    61. 

  61. [  348.530014] Call Trace:
    62. 

  62. [  348.530014]  [<f9291d80>] mesh_nexthop_lookup+0xbb/0xc8 [mac80211]
    63. 

  63. [  348.530014]  [<f9291dc1>] mesh_nexthop_resolve+0x34/0xd8 [mac80211]
    64. 

  64. [  348.530014]  [<f9277f6f>] ieee80211_xmit+0x92/0xc1 [mac80211]
    65. 

  65. [  348.530014]  [<f9278dd1>] __ieee80211_subif_start_xmit+0x807/0x83c [mac80211]
    66. 

  66. [  348.530014]  [<c04df012>] ? sch_direct_xmit+0xd7/0x1b3
    67. 

  67. [  348.530014]  [<c022a8c6>] ? __local_bh_enable_ip+0x5d/0x7b
    68. 

  68. [  348.530014]  [<f956870c>] ? nf_nat_ipv4_out+0x4c/0xd0 [nf_nat_ipv4]
    69. 

  69. [  348.530014]  [<f957e036>] ? iptable_nat_ipv4_fn+0xf/0xf [iptable_nat]
    70. 

  70. [  348.530014]  [<c04c6f45>] ? netif_skb_features+0x14d/0x30a
    71. 

  71. [  348.530014]  [<f9278e10>] ieee80211_subif_start_xmit+0xa/0xe [mac80211]
    72. 

  72. [  348.530014]  [<c04c769c>] dev_hard_start_xmit+0x1f8/0x267
    73. 

  73. [  348.530014]  [<c04c7261>] ?  validate_xmit_skb.isra.120.part.121+0x10/0x253
    74. 

  74. [  348.530014]  [<c04defc6>] sch_direct_xmit+0x8b/0x1b3
    75. 

  75. [  348.530014]  [<c04c7a9c>] __dev_queue_xmit+0x2c8/0x513
    76. 

  76. [  348.530014]  [<c04c7cfb>] dev_queue_xmit+0xa/0xc
    77. 

  77. [  348.530014]  [<f91bfc7a>] batadv_send_skb_packet+0xd6/0xec [batman_adv]
    78. 

  78. [  348.530014]  [<f91bfdc4>] batadv_send_unicast_skb+0x15/0x4a [batman_adv]
    79. 

  79. [  348.530014]  [<f91b5938>] batadv_dat_send_data+0x27e/0x310 [batman_adv]
    80. 

  80. [  348.530014]  [<f91c30b5>] ? batadv_tt_global_hash_find.isra.11+0x8/0xa [batman_adv]
    81. 

  81. [  348.530014]  [<f91b63f3>] batadv_dat_snoop_outgoing_arp_request+0x208/0x23d [batman_adv]
    82. 

  82. [  348.530014]  [<f91c0cd9>] batadv_interface_tx+0x206/0x385 [batman_adv]
    83. 

  83. [  348.530014]  [<c04c769c>] dev_hard_start_xmit+0x1f8/0x267
    84. 

  84. [  348.530014]  [<c04c7261>] ?  validate_xmit_skb.isra.120.part.121+0x10/0x253
    85. 

  85. [  348.530014]  [<c04defc6>] sch_direct_xmit+0x8b/0x1b3
    86. 

  86. [  348.530014]  [<c04c7a9c>] __dev_queue_xmit+0x2c8/0x513
    87. 

  87. [  348.530014]  [<f80cbd2a>] ? igb_xmit_frame+0x57/0x72 [igb]
    88. 

  88. [  348.530014]  [<c04c7cfb>] dev_queue_xmit+0xa/0xc
    89. 

  89. [  348.530014]  [<f843a326>] br_dev_queue_push_xmit+0xeb/0xfb [bridge]
    90. 

  90. [  348.530014]  [<f843a35f>] br_forward_finish+0x29/0x74 [bridge]
    91. 

  91. [  348.530014]  [<f843a23b>] ? deliver_clone+0x3b/0x3b [bridge]
    92. 

  92. [  348.530014]  [<f843a714>] __br_forward+0x89/0xe7 [bridge]
    93. 

  93. [  348.530014]  [<f843a336>] ? br_dev_queue_push_xmit+0xfb/0xfb [bridge]
    94. 

  94. [  348.530014]  [<f843a234>] deliver_clone+0x34/0x3b [bridge]
    95. 

  95. [  348.530014]  [<f843a68b>] ? br_flood+0x95/0x95 [bridge]
    96. 

  96. [  348.530014]  [<f843a66d>] br_flood+0x77/0x95 [bridge]
    97. 

  97. [  348.530014]  [<f843a809>] br_flood_forward+0x13/0x1a [bridge]
    98. 

  98. [  348.530014]  [<f843a68b>] ? br_flood+0x95/0x95 [bridge]
    99. 

  99. [  348.530014]  [<f843b877>] br_handle_frame_finish+0x392/0x3db [bridge]
    100. 

  100. [  348.530014]  [<c04e9b2b>] ? nf_iterate+0x2b/0x6b
    101. 

  101. [  348.530014]  [<f843baa6>] br_handle_frame+0x1e6/0x240 [bridge]
    102. 

  102. [  348.530014]  [<f843b4e5>] ? br_handle_local_finish+0x6a/0x6a [bridge]
    103. 

  103. [  348.530014]  [<c04c4ba0>] __netif_receive_skb_core+0x43a/0x66b
    104. 

  104. [  348.530014]  [<f843b8c0>] ? br_handle_frame_finish+0x3db/0x3db [bridge]
    105. 

  105. [  348.530014]  [<c023cea4>] ? resched_curr+0x19/0x37
    106. 

  106. [  348.530014]  [<c0240707>] ? check_preempt_wakeup+0xbf/0xfe
    107. 

  107. [  348.530014]  [<c0255dec>] ? ktime_get_with_offset+0x5c/0xfc
    108. 

  108. [  348.530014]  [<c04c4fc1>] __netif_receive_skb+0x47/0x55
    109. 

  109. [  348.530014]  [<c04c57ba>] netif_receive_skb_internal+0x40/0x5a
    110. 

  110. [  348.530014]  [<c04c61ef>] napi_gro_receive+0x3a/0x94
    111. 

  111. [  348.530014]  [<f80ce8d5>] igb_poll+0x6fd/0x9ad [igb]
    112. 

  112. [  348.530014]  [<c0242bd8>] ? swake_up_locked+0x14/0x26
    113. 

  113. [  348.530014]  [<c04c5d29>] net_rx_action+0xde/0x250
    114. 

  114. [  348.530014]  [<c022a743>] __do_softirq+0x8a/0x163
    115. 

  115. [  348.530014]  [<c022a6b9>] ? __hrtimer_tasklet_trampoline+0x19/0x19
    116. 

  116. [  348.530014]  [<c021100f>] do_softirq_own_stack+0x26/0x2c
    117. 

  117. [  348.530014]  <IRQ>
    118. 

  118. [  348.530014]  [<c022a957>] irq_exit+0x31/0x6f
    119. 

  119. [  348.530014]  [<c0210eb2>] do_IRQ+0x8d/0xa0
    120. 

  120. [  348.530014]  [<c058152c>] common_interrupt+0x2c/0x40
    121. 

  121. [  348.530014] Code: e7 8c 00 66 81 ff 88 00 75 12 85 d2 75 0e b2 c3 b8 83 e9 29 f9 e8 a7 5f f9 c6 eb 74 66 81 e3 8c 005
    122. 

  122. [  348.530014] EIP: [<f929245d>] ieee80211_mps_set_frame_flags+0x40/0xaa [mac80211] SS:ESP 0068:f6409a40
    123. 

  123. [  348.530014] CR2: 0000000000020040
    124. 

  124. [  348.530014] ---[ end trace 48556ac26779732e ]---
    125. 

  125. [  348.530014] Kernel panic - not syncing: Fatal exception in interrupt
    126. 

  126. [  348.530014] Kernel Offset: disabled
    127. 

  127. 

  128. Cc: stable@vger.kernel.org
    129. 

  129. Reported-by: Fred Veldini <fred.veldini@gmail.com>
    130. 

  130. Tested-by: Fred Veldini <fred.veldini@gmail.com>
    131. 

  131. Signed-off-by: Bob Copeland <me@bobcopeland.com>
    132. 

  132. ---
    133. 

  133. 

  134. --- a/net/mac80211/mesh.c
    135. 

  135. +++ b/net/mac80211/mesh.c
    136. 

  136. @@ -161,6 +161,10 @@ void mesh_sta_cleanup(struct sta_info *s
    137. 

  137.  		del_timer_sync(&sta->mesh->plink_timer);
    138. 

  138.  	}
    139. 

  139.  
    140. 

  140. +	/* make sure no readers can access nexthop sta from here on */
    141. 

  141. +	mesh_path_flush_by_nexthop(sta);
    142. 

  142. +	synchronize_net();
    143. 

  143. +
    144. 

  144.  	if (changed)
    145. 

  145.  		ieee80211_mbss_info_change_notify(sdata, changed);
    146. 

  146.  }
    147.