[PATCH 2.6.37] mac80211: fix mesh forwarding

[PATCH 2.6.37] mac80211: fix mesh forwarding

[Johannes Berg]

From: Johannes Berg <johannes.berg@intel.com>

Under memory pressure, the mac80211 mesh code
may helpfully print a message that it failed
to clone a mesh frame and then will proceed
to crash trying to use it anyway. Fix that.

Cc: stable@kernel.org [2.6.27+]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
 net/mac80211/rx.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- wireless-testing.orig/net/mac80211/rx.c	2010-12-22 10:05:58.000000000 +0100
+++ wireless-testing/net/mac80211/rx.c	2010-12-22 10:06:08.000000000 +0100
@@ -1831,9 +1831,11 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
 
 			fwd_skb = skb_copy(skb, GFP_ATOMIC);
 
-			if (!fwd_skb && net_ratelimit())
+			if (!fwd_skb && net_ratelimit()) {
 				printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
 						   sdata->name);
+				goto out;
+			}
 
 			fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
 			memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
@@ -1871,6 +1873,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
 		}
 	}
 
+ out:
 	if (is_multicast_ether_addr(hdr->addr1) ||
 	    sdata->dev->flags & IFF_PROMISC)
 		return RX_CONTINUE;

Re: [PATCH 2.6.37] mac80211: fix mesh forwarding

[Javier Cardona]

Johannes,

Had I encountered this I would have changed the "failed to clone mesh
frame" message to "I'm about to crash".  Your fix is better.

Thanks!

On Wed, Dec 22, 2010 at 1:15 AM, Johannes Berg
<johannes@sipsolutions.net> wrote:
> From: Johannes Berg <johannes.berg@intel.com>
>
> Under memory pressure, the mac80211 mesh code
> may helpfully print a message that it failed
> to clone a mesh frame and then will proceed
> to crash trying to use it anyway. Fix that.
>
> Cc: stable@kernel.org [2.6.27+]
> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Acked-by: Javier Cardona <javier@cozybit.com>

> ---
>  net/mac80211/rx.c |    5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> --- wireless-testing.orig/net/mac80211/rx.c     2010-12-22 10:05:58.000000000 +0100
> +++ wireless-testing/net/mac80211/rx.c  2010-12-22 10:06:08.000000000 +0100
> @@ -1831,9 +1831,11 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
>
>                        fwd_skb = skb_copy(skb, GFP_ATOMIC);
>
> -                       if (!fwd_skb && net_ratelimit())
> +                       if (!fwd_skb && net_ratelimit()) {
>                                printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
>                                                   sdata->name);
> +                               goto out;
> +                       }
>
>                        fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
>                        memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
> @@ -1871,6 +1873,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
>                }
>        }
>
> + out:
>        if (is_multicast_ether_addr(hdr->addr1) ||
>            sdata->dev->flags & IFF_PROMISC)
>                return RX_CONTINUE;
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>



-- 
Javier Cardona
cozybit Inc.
http://www.cozybit.com

[PATCH] mac80211: fix mesh forwarding when ratelimited too

[Milton Miller]

Commit b51aff057c9d0ef6c529dc25fd9f775faf7b6c63 said:

    Under memory pressure, the mac80211 mesh code
    may helpfully print a message that it failed
    to clone a mesh frame and then will proceed
    to crash trying to use it anyway. Fix that.
    
Avoid the reference whenever the frame copy is unsuccessful
regardless of the debug message being suppressed or printed.

Cc: stable@kernel.org [2.6.27+] 
Signed-off-by: Milton Miller <miltonm@bga.com>
---
I chose a seperate if vs nesting the ratelimit check to avoid shifting
the printk further to the right.

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index b01e467..e98668f 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1788,11 +1788,11 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
 
 			fwd_skb = skb_copy(skb, GFP_ATOMIC);
 
-			if (!fwd_skb && net_ratelimit()) {
+			if (!fwd_skb && net_ratelimit())
 				printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
 						   sdata->name);
+			if (!fwd_skb)
 				goto out;
-			}
 
 			fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
 			memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);

Re: [PATCH] mac80211: fix mesh forwarding when ratelimited too

[Johannes Berg]

On Thu, 2010-12-30 at 02:01 -0600, Milton Miller wrote:
> Commit b51aff057c9d0ef6c529dc25fd9f775faf7b6c63 said:
> 
>     Under memory pressure, the mac80211 mesh code
>     may helpfully print a message that it failed
>     to clone a mesh frame and then will proceed
>     to crash trying to use it anyway. Fix that.
>     
> Avoid the reference whenever the frame copy is unsuccessful
> regardless of the debug message being suppressed or printed.
> 
> Cc: stable@kernel.org [2.6.27+] 
> Signed-off-by: Milton Miller <miltonm@bga.com>
> ---
> I chose a seperate if vs nesting the ratelimit check to avoid shifting
> the printk further to the right.
> 
> diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
> index b01e467..e98668f 100644
> --- a/net/mac80211/rx.c
> +++ b/net/mac80211/rx.c
> @@ -1788,11 +1788,11 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
>  
>  			fwd_skb = skb_copy(skb, GFP_ATOMIC);
>  
> -			if (!fwd_skb && net_ratelimit()) {
> +			if (!fwd_skb && net_ratelimit())
>  				printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
>  						   sdata->name);
> +			if (!fwd_skb)
>  				goto out;
> -			}

Oops, good catch! Thanks.

johannes