From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev,
syzbot+a6a4b5bb3da165594cff@syzkaller.appspotmail.com,
Sven Eckelmann <sven@narfation.org>,
Simon Wunderlich <sw@simonwunderlich.de>
Subject: [PATCH 5.15 01/45] batman-adv: Avoid infinite loop trying to resize local TT
Date: Mon, 15 Apr 2024 16:21:08 +0200 [thread overview]
Message-ID: <20240415141942.282701211@linuxfoundation.org> (raw)
In-Reply-To: <20240415141942.235939111@linuxfoundation.org>
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit b1f532a3b1e6d2e5559c7ace49322922637a28aa upstream.
If the MTU of one of an attached interface becomes too small to transmit
the local translation table then it must be resized to fit inside all
fragments (when enabled) or a single packet.
But if the MTU becomes too low to transmit even the header + the VLAN
specific part then the resizing of the local TT will never succeed. This
can for example happen when the usable space is 110 bytes and 11 VLANs are
on top of batman-adv. In this case, at least 116 byte would be needed.
There will just be an endless spam of
batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (110)
in the log but the function will never finish. Problem here is that the
timeout will be halved all the time and will then stagnate at 0 and
therefore never be able to reduce the table even more.
There are other scenarios possible with a similar result. The number of
BATADV_TT_CLIENT_NOPURGE entries in the local TT can for example be too
high to fit inside a packet. Such a scenario can therefore happen also with
only a single VLAN + 7 non-purgable addresses - requiring at least 120
bytes.
While this should be handled proactively when:
* interface with too low MTU is added
* VLAN is added
* non-purgeable local mac is added
* MTU of an attached interface is reduced
* fragmentation setting gets disabled (which most likely requires dropping
attached interfaces)
not all of these scenarios can be prevented because batman-adv is only
consuming events without the the possibility to prevent these actions
(non-purgable MAC address added, MTU of an attached interface is reduced).
It is therefore necessary to also make sure that the code is able to handle
also the situations when there were already incompatible system
configuration are present.
Cc: stable@vger.kernel.org
Fixes: a19d3d85e1b8 ("batman-adv: limit local translation table max size")
Reported-by: syzbot+a6a4b5bb3da165594cff@syzkaller.appspotmail.com
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/translation-table.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -3948,7 +3948,7 @@ void batadv_tt_local_resize_to_mtu(struc
spin_lock_bh(&bat_priv->tt.commit_lock);
- while (true) {
+ while (timeout) {
table_size = batadv_tt_local_table_transmit_size(bat_priv);
if (packet_size_max >= table_size)
break;
next prev parent reply other threads:[~2024-04-15 14:42 UTC|newest]
Thread overview: 55+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-15 14:21 [PATCH 5.15 00/45] 5.15.156-rc1 review Greg Kroah-Hartman
2024-04-15 14:21 ` Greg Kroah-Hartman [this message]
2024-04-15 14:21 ` [PATCH 5.15 02/45] ring-buffer: Only update pages_touched when a new page is touched Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 03/45] Bluetooth: Fix memory leak in hci_req_sync_complete() Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 04/45] media: cec: core: remove length check of Timer Status Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 05/45] arm64: dts: imx8-ss-conn: fix usdhc wrong lpcg clock order Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 06/45] Revert "drm/qxl: simplify qxl_fence_wait" Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 07/45] nouveau: fix function cast warning Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 08/45] scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 09/45] net: openvswitch: fix unwanted error log on timeout policy probing Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 10/45] u64_stats: Disable preemption on 32bit UP+SMP PREEMPT_RT during updates Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 11/45] xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 12/45] geneve: fix header validation in geneve[6]_xmit_skb Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 13/45] af_unix: Clear stale u->oob_skb Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 14/45] octeontx2-af: Fix NIX SQ mode and BP config Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 15/45] ipv6: fib: hide unused pn variable Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 16/45] ipv4/route: avoid unused-but-set-variable warning Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 17/45] ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 18/45] netfilter: complete validation of user input Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 19/45] net/mlx5: Properly link new fs rules into the tree Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 20/45] net: sparx5: fix wrong config being used when reconfiguring PCS Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 21/45] net: dsa: mt7530: trap link-local frames regardless of ST Port State Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 22/45] af_unix: Do not use atomic ops for unix_sk(sk)->inflight Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 23/45] af_unix: Fix garbage collector racing against connect() Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 24/45] net: ena: Fix potential sign extension issue Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 25/45] net: ena: Wrong missing IO completions check order Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 26/45] net: ena: Fix incorrect descriptor free behavior Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 27/45] tracing: hide unused ftrace_event_id_fops Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 28/45] iommu/vt-d: Allocate local memory for page request queue Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 29/45] btrfs: qgroup: correctly model root qgroup rsv in convert Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 30/45] drm/client: Fully protect modes[] with dev->mode_config.mutex Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 31/45] vhost: Add smp_rmb() in vhost_vq_avail_empty() Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 32/45] perf/x86: Fix out of range data Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 33/45] x86/cpu: Actually turn off mitigations by default for SPECULATION_MITIGATIONS=n Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 34/45] selftests: timers: Fix abs() warning in posix_timers test Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 35/45] x86/apic: Force native_apic_mem_read() to use the MOV instruction Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 36/45] irqflags: Explicitly ignore lockdep_hrtimer_exit() argument Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 37/45] x86/bugs: Fix return type of spectre_bhi_state() Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 38/45] x86/bugs: Fix BHI documentation Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 39/45] x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 40/45] x86/bugs: Rename various ia32_cap variables to x86_arch_cap_msr Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 41/45] x86/bugs: Fix BHI handling of RRSBA Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 42/45] x86/bugs: Clarify that syscall hardening isnt a BHI mitigation Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 43/45] x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 44/45] x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI Greg Kroah-Hartman
2024-04-15 14:21 ` [PATCH 5.15 45/45] drm/i915/cdclk: Fix CDCLK programming order when pipes are active Greg Kroah-Hartman
2024-04-15 16:47 ` [PATCH 5.15 00/45] 5.15.156-rc1 review Florian Fainelli
2024-04-15 23:53 ` Kelsey Steele
2024-04-16 0:20 ` Mark Brown
2024-04-16 6:45 ` Ron Economos
2024-04-16 7:45 ` Harshit Mogalapalli
2024-04-16 10:37 ` Jon Hunter
2024-04-16 14:30 ` Pascal Ernster
2024-04-16 14:46 ` Greg Kroah-Hartman
2024-04-17 7:12 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240415141942.282701211@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=patches@lists.linux.dev \
--cc=stable@vger.kernel.org \
--cc=sven@narfation.org \
--cc=sw@simonwunderlich.de \
--cc=syzbot+a6a4b5bb3da165594cff@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).