From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 13:14:20 +0000 (+0200) Subject: 5.10-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f87ae8a0dc3b488521e5e9a0d8311de4186d3a1b;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: batman-adv-clean-untagged-vlan-on-netdev-registration-failure.patch --- diff --git a/queue-5.10/batman-adv-clean-untagged-vlan-on-netdev-registration-failure.patch b/queue-5.10/batman-adv-clean-untagged-vlan-on-netdev-registration-failure.patch new file mode 100644 index 0000000000..ee7366cc02 --- /dev/null +++ b/queue-5.10/batman-adv-clean-untagged-vlan-on-netdev-registration-failure.patch @@ -0,0 +1,133 @@ +From 8669a550c752d86baebc5fdc83b8ff35c4372c0e Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Sat, 4 Jul 2026 09:46:09 +0200 +Subject: batman-adv: clean untagged VLAN on netdev registration failure + +From: Sven Eckelmann + +commit 8669a550c752d86baebc5fdc83b8ff35c4372c0e upstream. + +When an mesh interface is registered, it creates an untagged struct +batadv_meshif_vlan on top of it via the NETDEV_REGISTER notifier. But in +this process, another receiver of this notification can veto the +registration. The netdev registration will be aborted because of this veto. + +The register_netdevice() call will try to clean up the net_device using +unregister_netdevice_queue() - which only uses the .priv_destructor to +free private resources. In this situation, .dellink will not be called. + +The cleanup of the untagged batadv_meshif_vlan must thefore be done in the +destructor to avoid a leak of this object. + +Cc: stable@vger.kernel.org +Fixes: 5d2c05b21337 ("batman-adv: add per VLAN interface attribute framework") +Signed-off-by: Sven Eckelmann +[ switch to old "mesh_iface" name "soft_iface", Context, keep early + batadv_softif_destroy_netlink() cleanup in case sysfs support is active, + only run destructor VLAN code on non-softif_destroy context ] +Signed-off-by: Sven Eckelmann +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/main.c | 17 +++++++++++++++++ + net/batman-adv/soft-interface.c | 7 +++++-- + net/batman-adv/soft-interface.h | 2 ++ + net/batman-adv/types.h | 7 +++++++ + 4 files changed, 31 insertions(+), 2 deletions(-) + +--- a/net/batman-adv/main.c ++++ b/net/batman-adv/main.c +@@ -265,6 +265,7 @@ err_orig: + void batadv_mesh_free(struct net_device *soft_iface) + { + struct batadv_priv *bat_priv = netdev_priv(soft_iface); ++ struct batadv_softif_vlan *vlan; + + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); + +@@ -280,6 +281,22 @@ void batadv_mesh_free(struct net_device + + batadv_mcast_free(bat_priv); + ++ /* destroy the "untagged" VLAN in case of an register_netdevice() error. ++ * ++ * It will be handled normally by batadv_softif_destroy_netlink() and ++ * batadv_softif_destroy_sysfs() before they call batadv_sysfs_del_meshif(). ++ * ++ * But when a veto was received during the registration, the VLAN has to ++ * be cleaned up in the destructor. ++ */ ++ if (!bat_priv->softif_destroy) { ++ vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS); ++ if (vlan) { ++ batadv_softif_destroy_vlan(bat_priv, vlan); ++ batadv_softif_vlan_put(vlan); ++ } ++ } ++ + /* Free the TT and the originator tables only after having terminated + * all the other depending components which may use these structures for + * their purposes. +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -629,8 +629,8 @@ int batadv_softif_create_vlan(struct bat + * @bat_priv: the bat priv with all the soft interface information + * @vlan: the object to remove + */ +-static void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv, +- struct batadv_softif_vlan *vlan) ++void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv, ++ struct batadv_softif_vlan *vlan) + { + /* explicitly remove the associated TT local entry because it is marked + * with the NOPURGE flag +@@ -834,6 +834,7 @@ static int batadv_softif_init_late(struc + bat_priv->tt.last_changeset_len = 0; + bat_priv->isolation_mark = 0; + bat_priv->isolation_mark_mask = 0; ++ bat_priv->softif_destroy = false; + + /* randomize initial seqno to avoid collision */ + get_random_bytes(&random_seqno, sizeof(random_seqno)); +@@ -1121,6 +1122,7 @@ void batadv_softif_destroy_sysfs(struct + batadv_softif_vlan_put(vlan); + } + ++ bat_priv->softif_destroy = true; + batadv_sysfs_del_meshif(soft_iface); + unregister_netdevice(soft_iface); + } +@@ -1151,6 +1153,7 @@ static void batadv_softif_destroy_netlin + batadv_softif_vlan_put(vlan); + } + ++ bat_priv->softif_destroy = true; + batadv_sysfs_del_meshif(soft_iface); + unregister_netdevice_queue(soft_iface, head); + } +--- a/net/batman-adv/soft-interface.h ++++ b/net/batman-adv/soft-interface.h +@@ -25,6 +25,8 @@ void batadv_softif_destroy_sysfs(struct + bool batadv_softif_is_valid(const struct net_device *net_dev); + extern struct rtnl_link_ops batadv_link_ops; + int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid); ++void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv, ++ struct batadv_softif_vlan *vlan); + void batadv_softif_vlan_release(struct kref *ref); + struct batadv_softif_vlan *batadv_softif_vlan_get(struct batadv_priv *bat_priv, + unsigned short vid); +--- a/net/batman-adv/types.h ++++ b/net/batman-adv/types.h +@@ -1791,6 +1791,13 @@ struct batadv_priv { + /** @bat_v: B.A.T.M.A.N. V per soft-interface private data */ + struct batadv_priv_bat_v bat_v; + #endif ++ ++ /** ++ * @softif_destroy: whether the mesh_free() is called via the ++ * batadv_softif_destroy_sysfs() or batadv_softif_destroy_netlink() ++ * codepath and doesn't have to clean up the untagged VLAN (sysfs) ++ */ ++ bool softif_destroy:1; + }; + + /** diff --git a/queue-5.10/series b/queue-5.10/series index 7a14210402..3c4d092511 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -577,3 +577,4 @@ mtd-rawnand-lpc32xx_slc-fail-dma-transfer-on-completion-timeout.patch crypto-amcc-fix-incorrect-kernel-doc-comment-syntax-in-files.patch crypto-crypto4xx-remove-ahash-related-code.patch crypto-crypto4xx-remove-insecure-and-unused-rng_alg.patch +batman-adv-clean-untagged-vlan-on-netdev-registration-failure.patch