batman-adv/patches/0036-batman-adv-fix-error-handling.patch

   1 From: Pavel Skripkin <paskripkin@gmail.com>
   2 Date: Sun, 24 Oct 2021 16:13:56 +0300
   3 Subject: batman-adv: fix error handling
   4
   5 Syzbot reported ODEBUG warning in batadv_nc_mesh_free(). The problem was
   6 in wrong error handling in batadv_mesh_init().
   7
   8 Before this patch batadv_mesh_init() was calling batadv_mesh_free() in case
   9 of any batadv_*_init() calls failure. This approach may work well, when
  10 there is some kind of indicator, which can tell which parts of batadv are
  11 initialized; but there isn't any.
  12
  13 All written above lead to cleaning up uninitialized fields. Even if we hide
  14 ODEBUG warning by initializing bat_priv->nc.work, syzbot was able to hit
  15 GPF in batadv_nc_purge_paths(), because hash pointer in still NULL. [1]
  16
  17 To fix these bugs we can unwind batadv_*_init() calls one by one.
  18 It is good approach for 2 reasons: 1) It fixes bugs on error handling
  19 path 2) It improves the performance, since we won't call unneeded
  20 batadv_*_free() functions.
  21
  22 So, this patch makes all batadv_*_init() clean up all allocated memory
  23 before returning with an error to no call correspoing batadv_*_free()
  24 and open-codes batadv_mesh_free() with proper order to avoid touching
  25 uninitialized fields.
  26
  27 Link: https://lore.kernel.org/netdev/000000000000c87fbd05cef6bcb0@google.com/ [1]
  28 Reported-and-tested-by: syzbot+28b0702ada0bf7381f58@syzkaller.appspotmail.com
  29 Fixes: 21e838760727 ("[batman-adv] fix various race conditions during startup & shutdown")
  30 Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
  31 Signed-off-by: David S. Miller <davem@davemloft.net>
  32 Signed-off-by: Sven Eckelmann <sven@narfation.org>
  33 Origin: upstream, https://git.open-mesh.org/batman-adv.git/commit/0631e0825c8129cd3896926da62a09ac00bf13a0
  34
  35 --- a/net/batman-adv/bridge_loop_avoidance.c
  36 +++ b/net/batman-adv/bridge_loop_avoidance.c
  37 @@ -1561,10 +1561,14 @@ int batadv_bla_init(struct batadv_priv *
  38                 return 0;
  39
  40         bat_priv->bla.claim_hash = batadv_hash_new(128);
  41 -       bat_priv->bla.backbone_hash = batadv_hash_new(32);
  42 +       if (!bat_priv->bla.claim_hash)
  43 +               return -ENOMEM;
  44
  45 -       if (!bat_priv->bla.claim_hash || !bat_priv->bla.backbone_hash)
  46 +       bat_priv->bla.backbone_hash = batadv_hash_new(32);
  47 +       if (!bat_priv->bla.backbone_hash) {
  48 +               batadv_hash_destroy(bat_priv->bla.claim_hash);
  49                 return -ENOMEM;
  50 +       }
  51
  52         batadv_hash_set_lock_class(bat_priv->bla.claim_hash,
  53                                    &batadv_claim_hash_lock_class_key);
  54 --- a/net/batman-adv/main.c
  55 +++ b/net/batman-adv/main.c
  56 @@ -197,29 +197,41 @@ int batadv_mesh_init(struct net_device *
  57
  58         bat_priv->gw.generation = 0;
  59
  60 -       ret = batadv_v_mesh_init(bat_priv);
  61 -       if (ret < 0)
  62 -               goto err;
  63 -
  64         ret = batadv_originator_init(bat_priv);
  65 -       if (ret < 0)
  66 -               goto err;
  67 +       if (ret < 0) {
  68 +               atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
  69 +               goto err_orig;
  70 +       }
  71
  72         ret = batadv_tt_init(bat_priv);
  73 -       if (ret < 0)
  74 -               goto err;
  75 +       if (ret < 0) {
  76 +               atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
  77 +               goto err_tt;
  78 +       }
  79 +
  80 +       ret = batadv_v_mesh_init(bat_priv);
  81 +       if (ret < 0) {
  82 +               atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
  83 +               goto err_v;
  84 +       }
  85
  86         ret = batadv_bla_init(bat_priv);
  87 -       if (ret < 0)
  88 -               goto err;
  89 +       if (ret < 0) {
  90 +               atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
  91 +               goto err_bla;
  92 +       }
  93
  94         ret = batadv_dat_init(bat_priv);
  95 -       if (ret < 0)
  96 -               goto err;
  97 +       if (ret < 0) {
  98 +               atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
  99 +               goto err_dat;
 100 +       }
 101
 102         ret = batadv_nc_mesh_init(bat_priv);
 103 -       if (ret < 0)
 104 -               goto err;
 105 +       if (ret < 0) {
 106 +               atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
 107 +               goto err_nc;
 108 +       }
 109
 110         batadv_gw_init(bat_priv);
 111         batadv_mcast_init(bat_priv);
 112 @@ -229,8 +241,20 @@ int batadv_mesh_init(struct net_device *
 113
 114         return 0;
 115
 116 -err:
 117 -       batadv_mesh_free(soft_iface);
 118 +err_nc:
 119 +       batadv_dat_free(bat_priv);
 120 +err_dat:
 121 +       batadv_bla_free(bat_priv);
 122 +err_bla:
 123 +       batadv_v_mesh_free(bat_priv);
 124 +err_v:
 125 +       batadv_tt_free(bat_priv);
 126 +err_tt:
 127 +       batadv_originator_free(bat_priv);
 128 +err_orig:
 129 +       batadv_purge_outstanding_packets(bat_priv, NULL);
 130 +       atomic_set(&bat_priv->mesh_state, BATADV_MESH_INACTIVE);
 131 +
 132         return ret;
 133  }
 134
 135 --- a/net/batman-adv/network-coding.c
 136 +++ b/net/batman-adv/network-coding.c
 137 @@ -155,8 +155,10 @@ int batadv_nc_mesh_init(struct batadv_pr
 138                                    &batadv_nc_coding_hash_lock_class_key);
 139
 140         bat_priv->nc.decoding_hash = batadv_hash_new(128);
 141 -       if (!bat_priv->nc.decoding_hash)
 142 +       if (!bat_priv->nc.decoding_hash) {
 143 +               batadv_hash_destroy(bat_priv->nc.coding_hash);
 144                 goto err;
 145 +       }
 146
 147         batadv_hash_set_lock_class(bat_priv->nc.decoding_hash,
 148                                    &batadv_nc_decoding_hash_lock_class_key);
 149 --- a/net/batman-adv/translation-table.c
 150 +++ b/net/batman-adv/translation-table.c
 151 @@ -4405,8 +4405,10 @@ int batadv_tt_init(struct batadv_priv *b
 152                 return ret;
 153
 154         ret = batadv_tt_global_init(bat_priv);
 155 -       if (ret < 0)
 156 +       if (ret < 0) {
 157 +               batadv_tt_local_table_free(bat_priv);
 158                 return ret;
 159 +       }
 160
 161         batadv_tvlv_handler_register(bat_priv, batadv_tt_tvlv_ogm_handler_v1,
 162                                      batadv_tt_tvlv_unicast_handler_v1,