+++ /dev/null
-From: Antonio Quartulli <ordex@autistici.org>
-
-In the TT_RESPONSE packet, the number of carried entries is not correctly set.
-This leads to a wrong interpretation of the packet payload on the receiver side
-causing random entries to be added to the global translation table. Therefore
-the latter gets always corrupted, triggering a table recovery all the time.
-
-Signed-off-by: Antonio Quartulli <ordex@autistici.org>
----
- translation-table.c | 5 ++++-
- 1 files changed, 4 insertions(+), 1 deletions(-)
-
---- a/translation-table.c
-+++ b/translation-table.c
-@@ -1054,7 +1054,6 @@ static struct sk_buff *tt_response_fill_table(uint16_t tt_len, uint8_t ttvn,
- tt_response = (struct tt_query_packet *)skb_put(skb,
- tt_query_size + tt_len);
- tt_response->ttvn = ttvn;
-- tt_response->tt_data = htons(tt_tot);
-
- tt_change = (struct tt_change *)(skb->data + tt_query_size);
- tt_count = 0;
-@@ -1080,6 +1079,10 @@ static struct sk_buff *tt_response_fill_table(uint16_t tt_len, uint8_t ttvn,
- }
- rcu_read_unlock();
-
-+ /* store in the message the number of entries we have successfully
-+ * copied */
-+ tt_response->tt_data = htons(tt_count);
-+
- out:
- return skb;
- }
---
-1.7.3.4
-
+++ /dev/null
-From: Antonio Quartulli <ordex@autistici.org>
-
-Currently the counter of tt_local_entry structures (tt_local_num) is incremented
-each time the tt_local_reset_flags() is invoked causing the node to send wrong
-TT_REPONSE packets containing a copy of non-initialised memory thus corrupting
-other nodes global translation table and making higher level communication
-impossible.
-
-Reported-by: Junkeun Song <jun361@gmail.com>
-Signed-off-by: Antonio Quartulli <ordex@autistici.org>
-Acked-by: Junkeun Song <jun361@gmail.com>
----
- translation-table.c | 2 ++
- 1 files changed, 2 insertions(+), 0 deletions(-)
-
---- a/translation-table.c
-+++ b/translation-table.c
-@@ -1727,6 +1727,8 @@ static void tt_local_reset_flags(struct bat_priv *bat_priv, uint16_t flags)
- rcu_read_lock();
- hlist_for_each_entry_rcu(tt_local_entry, node,
- head, hash_entry) {
-+ if (!(tt_local_entry->flags & flags))
-+ continue;
- tt_local_entry->flags &= ~flags;
- atomic_inc(&bat_priv->num_local_tt);
- }
---
-1.7.3.4
-