2017-11-19 22:05:11 +08:00
|
|
|
/* SPDX-License-Identifier: GPL-2.0 */
|
2019-01-01 06:59:59 +08:00
|
|
|
/* Copyright (C) 2007-2019 B.A.T.M.A.N. contributors:
|
2010-12-13 19:19:28 +08:00
|
|
|
*
|
|
|
|
|
* Marek Lindner, Simon Wunderlich
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#ifndef _NET_BATMAN_ADV_SEND_H_
|
|
|
|
|
#define _NET_BATMAN_ADV_SEND_H_
|
|
|
|
|
|
2015-04-18 01:40:28 +08:00
|
|
|
#include "main.h"
|
|
|
|
|
|
|
|
|
|
#include <linux/compiler.h>
|
2019-05-25 02:11:17 +08:00
|
|
|
#include <linux/skbuff.h>
|
batman-adv: fix rare race conditions on interface removal
In rare cases during shutdown the following general protection fault can
happen:
general protection fault: 0000 [#1] SMP
Modules linked in: batman_adv(O-) [...]
CPU: 3 PID: 1714 Comm: rmmod Tainted: G O 4.6.0-rc6+ #1
[...]
Call Trace:
[<ffffffffa0363294>] batadv_hardif_disable_interface+0x29a/0x3a6 [batman_adv]
[<ffffffffa0373db4>] batadv_softif_destroy_netlink+0x4b/0xa4 [batman_adv]
[<ffffffff813b52f3>] __rtnl_link_unregister+0x48/0x92
[<ffffffff813b9240>] rtnl_link_unregister+0xc1/0xdb
[<ffffffff8108547c>] ? bit_waitqueue+0x87/0x87
[<ffffffffa03850d2>] batadv_exit+0x1a/0xf48 [batman_adv]
[<ffffffff810c26f9>] SyS_delete_module+0x136/0x1b0
[<ffffffff8144dc65>] entry_SYSCALL_64_fastpath+0x18/0xa8
[<ffffffff8108aaca>] ? trace_hardirqs_off_caller+0x37/0xa6
Code: 89 f7 e8 21 bd 0d e1 4d 85 e4 75 0e 31 f6 48 c7 c7 50 d7 3b a0 e8 50 16 f2 e0 49 8b 9c 24 28 01 00 00 48 85 db 0f 84 b2 00 00 00 <48> 8b 03 4d 85 ed 48 89 45 c8 74 09 4c 39 ab f8 00 00 00 75 1c
RIP [<ffffffffa0371852>] batadv_purge_outstanding_packets+0x1c8/0x291 [batman_adv]
RSP <ffff88001da5fd78>
---[ end trace 803b9bdc6a4a952b ]---
Kernel panic - not syncing: Fatal exception in interrupt
Kernel Offset: disabled
---[ end Kernel panic - not syncing: Fatal exception in interrupt
It does not happen often, but may potentially happen when frequently
shutting down and reinitializing an interface. With some carefully
placed msleep()s/mdelay()s it can be reproduced easily.
The issue is, that on interface removal, any still running worker thread
of a forwarding packet will race with the interface purging routine to
free a forwarding packet. Temporarily giving up a spin-lock to be able
to sleep in the purging routine is not safe.
Furthermore, there is a potential general protection fault not just for
the purging side shown above, but also on the worker side: Temporarily
removing a forw_packet from the according forw_{bcast,bat}_list will make
it impossible for the purging routine to catch and cancel it.
# How this patch tries to fix it:
With this patch we split the queue purging into three steps: Step 1),
removing forward packets from the queue of an interface and by that
claim it as our responsibility to free.
Step 2), we are either lucky to cancel a pending worker before it starts
to run. Or if it is already running, we wait and let it do its thing,
except two things:
Through the claiming in step 1) we prevent workers from a) re-arming
themselves. And b) prevent workers from freeing packets which we still
hold in the interface purging routine.
Finally, step 3, we are sure that no forwarding packets are pending or
even running anymore on the interface to remove. We can then safely free
the claimed forwarding packets.
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
2016-11-01 16:44:44 +08:00
|
|
|
#include <linux/spinlock.h>
|
2015-04-18 01:40:28 +08:00
|
|
|
#include <linux/types.h>
|
2017-12-21 17:17:41 +08:00
|
|
|
#include <uapi/linux/batadv_packet.h>
|
2015-04-18 01:40:28 +08:00
|
|
|
|
2016-07-18 03:04:00 +08:00
|
|
|
void batadv_forw_packet_free(struct batadv_forw_packet *forw_packet,
|
|
|
|
|
bool dropped);
|
2016-06-21 03:39:54 +08:00
|
|
|
struct batadv_forw_packet *
|
|
|
|
|
batadv_forw_packet_alloc(struct batadv_hard_iface *if_incoming,
|
|
|
|
|
struct batadv_hard_iface *if_outgoing,
|
|
|
|
|
atomic_t *queue_left,
|
2017-02-17 18:17:06 +08:00
|
|
|
struct batadv_priv *bat_priv,
|
|
|
|
|
struct sk_buff *skb);
|
batman-adv: fix rare race conditions on interface removal
In rare cases during shutdown the following general protection fault can
happen:
general protection fault: 0000 [#1] SMP
Modules linked in: batman_adv(O-) [...]
CPU: 3 PID: 1714 Comm: rmmod Tainted: G O 4.6.0-rc6+ #1
[...]
Call Trace:
[<ffffffffa0363294>] batadv_hardif_disable_interface+0x29a/0x3a6 [batman_adv]
[<ffffffffa0373db4>] batadv_softif_destroy_netlink+0x4b/0xa4 [batman_adv]
[<ffffffff813b52f3>] __rtnl_link_unregister+0x48/0x92
[<ffffffff813b9240>] rtnl_link_unregister+0xc1/0xdb
[<ffffffff8108547c>] ? bit_waitqueue+0x87/0x87
[<ffffffffa03850d2>] batadv_exit+0x1a/0xf48 [batman_adv]
[<ffffffff810c26f9>] SyS_delete_module+0x136/0x1b0
[<ffffffff8144dc65>] entry_SYSCALL_64_fastpath+0x18/0xa8
[<ffffffff8108aaca>] ? trace_hardirqs_off_caller+0x37/0xa6
Code: 89 f7 e8 21 bd 0d e1 4d 85 e4 75 0e 31 f6 48 c7 c7 50 d7 3b a0 e8 50 16 f2 e0 49 8b 9c 24 28 01 00 00 48 85 db 0f 84 b2 00 00 00 <48> 8b 03 4d 85 ed 48 89 45 c8 74 09 4c 39 ab f8 00 00 00 75 1c
RIP [<ffffffffa0371852>] batadv_purge_outstanding_packets+0x1c8/0x291 [batman_adv]
RSP <ffff88001da5fd78>
---[ end trace 803b9bdc6a4a952b ]---
Kernel panic - not syncing: Fatal exception in interrupt
Kernel Offset: disabled
---[ end Kernel panic - not syncing: Fatal exception in interrupt
It does not happen often, but may potentially happen when frequently
shutting down and reinitializing an interface. With some carefully
placed msleep()s/mdelay()s it can be reproduced easily.
The issue is, that on interface removal, any still running worker thread
of a forwarding packet will race with the interface purging routine to
free a forwarding packet. Temporarily giving up a spin-lock to be able
to sleep in the purging routine is not safe.
Furthermore, there is a potential general protection fault not just for
the purging side shown above, but also on the worker side: Temporarily
removing a forw_packet from the according forw_{bcast,bat}_list will make
it impossible for the purging routine to catch and cancel it.
# How this patch tries to fix it:
With this patch we split the queue purging into three steps: Step 1),
removing forward packets from the queue of an interface and by that
claim it as our responsibility to free.
Step 2), we are either lucky to cancel a pending worker before it starts
to run. Or if it is already running, we wait and let it do its thing,
except two things:
Through the claiming in step 1) we prevent workers from a) re-arming
themselves. And b) prevent workers from freeing packets which we still
hold in the interface purging routine.
Finally, step 3, we are sure that no forwarding packets are pending or
even running anymore on the interface to remove. We can then safely free
the claimed forwarding packets.
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
2016-11-01 16:44:44 +08:00
|
|
|
bool batadv_forw_packet_steal(struct batadv_forw_packet *packet, spinlock_t *l);
|
|
|
|
|
void batadv_forw_packet_ogmv1_queue(struct batadv_priv *bat_priv,
|
|
|
|
|
struct batadv_forw_packet *forw_packet,
|
|
|
|
|
unsigned long send_time);
|
2017-02-17 18:17:07 +08:00
|
|
|
bool batadv_forw_packet_is_rebroadcast(struct batadv_forw_packet *forw_packet);
|
2016-06-21 03:39:54 +08:00
|
|
|
|
2013-04-20 19:54:39 +08:00
|
|
|
int batadv_send_skb_to_orig(struct sk_buff *skb,
|
|
|
|
|
struct batadv_orig_node *orig_node,
|
|
|
|
|
struct batadv_hard_iface *recv_if);
|
2016-01-16 16:40:15 +08:00
|
|
|
int batadv_send_skb_packet(struct sk_buff *skb,
|
|
|
|
|
struct batadv_hard_iface *hard_iface,
|
|
|
|
|
const u8 *dst_addr);
|
|
|
|
|
int batadv_send_broadcast_skb(struct sk_buff *skb,
|
|
|
|
|
struct batadv_hard_iface *hard_iface);
|
|
|
|
|
int batadv_send_unicast_skb(struct sk_buff *skb,
|
|
|
|
|
struct batadv_neigh_node *neigh_node);
|
2012-06-06 04:31:31 +08:00
|
|
|
int batadv_add_bcast_packet_to_list(struct batadv_priv *bat_priv,
|
2012-05-12 08:09:37 +08:00
|
|
|
const struct sk_buff *skb,
|
batman-adv: Simple (re)broadcast avoidance
With this patch, (re)broadcasting on a specific interfaces is avoided:
* No neighbor: There is no need to broadcast on an interface if there
is no node behind it.
* Single neighbor is source: If there is just one neighbor on an
interface and if this neighbor is the one we actually got this
broadcast packet from, then we do not need to echo it back.
* Single neighbor is originator: If there is just one neighbor on
an interface and if this neighbor is the originator of this
broadcast packet, then we do not need to echo it back.
Goodies for BATMAN V:
("Upgrade your BATMAN IV network to V now to get these for free!")
Thanks to the split of OGMv1 into two packet types, OGMv2 and ELP
that is, we can now apply the same optimizations stated above to OGMv2
packets, too.
Furthermore, with BATMAN V, rebroadcasts can be reduced in certain
multi interface cases, too, where BATMAN IV cannot. This is thanks to
the removal of the "secondary interface originator" concept in BATMAN V.
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
2016-08-07 18:34:19 +08:00
|
|
|
unsigned long delay,
|
|
|
|
|
bool own_packet);
|
2012-06-06 04:31:31 +08:00
|
|
|
void
|
|
|
|
|
batadv_purge_outstanding_packets(struct batadv_priv *bat_priv,
|
|
|
|
|
const struct batadv_hard_iface *hard_iface);
|
2013-05-23 22:53:01 +08:00
|
|
|
bool batadv_send_skb_prepare_unicast_4addr(struct batadv_priv *bat_priv,
|
|
|
|
|
struct sk_buff *skb,
|
|
|
|
|
struct batadv_orig_node *orig_node,
|
|
|
|
|
int packet_subtype);
|
2014-02-16 00:47:52 +08:00
|
|
|
int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
|
|
|
|
|
struct sk_buff *skb, int packet_type,
|
|
|
|
|
int packet_subtype,
|
|
|
|
|
struct batadv_orig_node *orig_node,
|
|
|
|
|
unsigned short vid);
|
2013-07-03 16:40:00 +08:00
|
|
|
int batadv_send_skb_via_tt_generic(struct batadv_priv *bat_priv,
|
|
|
|
|
struct sk_buff *skb, int packet_type,
|
2015-05-27 00:34:26 +08:00
|
|
|
int packet_subtype, u8 *dst_hint,
|
2013-11-06 02:31:08 +08:00
|
|
|
unsigned short vid);
|
2013-07-03 16:40:00 +08:00
|
|
|
int batadv_send_skb_via_gw(struct batadv_priv *bat_priv, struct sk_buff *skb,
|
|
|
|
|
unsigned short vid);
|
2013-05-23 22:53:01 +08:00
|
|
|
|
|
|
|
|
/**
|
2017-12-03 02:51:47 +08:00
|
|
|
* batadv_send_skb_via_tt() - send an skb via TT lookup
|
2013-05-23 22:53:01 +08:00
|
|
|
* @bat_priv: the bat priv with all the soft interface information
|
|
|
|
|
* @skb: the payload to send
|
2014-02-15 18:58:01 +08:00
|
|
|
* @dst_hint: can be used to override the destination contained in the skb
|
2013-06-04 18:11:39 +08:00
|
|
|
* @vid: the vid to be used to search the translation table
|
2013-05-23 22:53:01 +08:00
|
|
|
*
|
2013-07-03 16:40:00 +08:00
|
|
|
* Look up the recipient node for the destination address in the ethernet
|
|
|
|
|
* header via the translation table. Wrap the given skb into a batman-adv
|
|
|
|
|
* unicast header. Then send this frame to the according destination node.
|
|
|
|
|
*
|
2015-09-16 01:00:48 +08:00
|
|
|
* Return: NET_XMIT_DROP in case of error or NET_XMIT_SUCCESS otherwise.
|
2013-05-23 22:53:01 +08:00
|
|
|
*/
|
2013-07-03 16:40:00 +08:00
|
|
|
static inline int batadv_send_skb_via_tt(struct batadv_priv *bat_priv,
|
2015-05-27 00:34:26 +08:00
|
|
|
struct sk_buff *skb, u8 *dst_hint,
|
2013-07-03 16:40:00 +08:00
|
|
|
unsigned short vid)
|
2013-05-23 22:53:01 +08:00
|
|
|
{
|
2013-07-03 16:40:00 +08:00
|
|
|
return batadv_send_skb_via_tt_generic(bat_priv, skb, BATADV_UNICAST, 0,
|
2013-11-06 02:31:08 +08:00
|
|
|
dst_hint, vid);
|
2013-05-23 22:53:01 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2017-12-03 02:51:47 +08:00
|
|
|
* batadv_send_skb_via_tt_4addr() - send an skb via TT lookup
|
2013-05-23 22:53:01 +08:00
|
|
|
* @bat_priv: the bat priv with all the soft interface information
|
|
|
|
|
* @skb: the payload to send
|
|
|
|
|
* @packet_subtype: the unicast 4addr packet subtype to use
|
2014-02-15 18:58:01 +08:00
|
|
|
* @dst_hint: can be used to override the destination contained in the skb
|
2013-06-04 18:11:39 +08:00
|
|
|
* @vid: the vid to be used to search the translation table
|
2013-05-23 22:53:01 +08:00
|
|
|
*
|
2013-07-03 16:40:00 +08:00
|
|
|
* Look up the recipient node for the destination address in the ethernet
|
|
|
|
|
* header via the translation table. Wrap the given skb into a batman-adv
|
|
|
|
|
* unicast-4addr header. Then send this frame to the according destination
|
|
|
|
|
* node.
|
|
|
|
|
*
|
2015-09-16 01:00:48 +08:00
|
|
|
* Return: NET_XMIT_DROP in case of error or NET_XMIT_SUCCESS otherwise.
|
2013-05-23 22:53:01 +08:00
|
|
|
*/
|
2013-07-03 16:40:00 +08:00
|
|
|
static inline int batadv_send_skb_via_tt_4addr(struct batadv_priv *bat_priv,
|
|
|
|
|
struct sk_buff *skb,
|
|
|
|
|
int packet_subtype,
|
2015-05-27 00:34:26 +08:00
|
|
|
u8 *dst_hint,
|
2013-07-03 16:40:00 +08:00
|
|
|
unsigned short vid)
|
2013-05-23 22:53:01 +08:00
|
|
|
{
|
2013-07-03 16:40:00 +08:00
|
|
|
return batadv_send_skb_via_tt_generic(bat_priv, skb,
|
|
|
|
|
BATADV_UNICAST_4ADDR,
|
2013-11-06 02:31:08 +08:00
|
|
|
packet_subtype, dst_hint, vid);
|
2013-05-23 22:53:01 +08:00
|
|
|
}
|
2010-12-13 19:19:28 +08:00
|
|
|
|
|
|
|
|
#endif /* _NET_BATMAN_ADV_SEND_H_ */
|