Merge branch 'master' of github.com:openwrt-routing/packages

babeld/Makefile

@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=babeld
-PKG_VERSION:=1.6.0
+PKG_VERSION:=1.6.1
-PKG_RELEASE:=3
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=http://www.pps.univ-paris-diderot.fr/~jch/software/files/
-PKG_MD5SUM:=b0602a6124ddafb37225bd1a2d8abb13
+PKG_MD5SUM:=74290f6c3678f314c79bdc0ab99d9f22
 PKG_LICENSE:=MIT
 
 include $(INCLUDE_DIR)/package.mk

batctl/Makefile

@@ -9,9 +9,9 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=batctl
 
-PKG_VERSION:=2014.4.0
+PKG_VERSION:=2015.0
 PKG_RELEASE:=1
-PKG_MD5SUM:=f3a14565699313258ee6ba3de783eb0a
+PKG_MD5SUM:=d28ad89d71888ad6b99a1f6b30c9d47c
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=http://downloads.open-mesh.org/batman/releases/batman-adv-$(PKG_VERSION)

batctl/patches/0001-batctl-use-netinet-if_ether.h-instead-of-linux-if_et.patch

@@ -0,0 +1,66 @@
+From 6423e3e5cdc1f79625dbf90ff6444b0ad8b02185 Mon Sep 17 00:00:00 2001
+From: Alex Suykov <alex.suykov@gmail.com>
+Date: Mon, 6 Apr 2015 17:29:13 +0300
+Subject: [PATCH] batctl: use netinet/if_ether.h instead of linux/if_ether.h
+
+musl does not allow including netinet/* and linux/* headers together.
+batctl includes netinet/if_ether.h indirectly via net/ethernet.h,
+so netinet/if_ether.h must be used instead of linux/if_ether.h.
+
+Signed-off-by: Alex Suykov <alex.suykov at gmail.com>
+Acked-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+---
+ ping.c       | 2 +-
+ tcpdump.h    | 2 +-
+ traceroute.c | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/ping.c b/ping.c
+index bdca222..7880a82 100644
+--- a/ping.c
++++ b/ping.c
+@@ -34,7 +34,7 @@
+ #include <stdint.h>
+ #include <sys/select.h>
+ #include <sys/time.h>
+-#include <linux/if_ether.h>
++#include <netinet/if_ether.h>
+ 
+ #include "main.h"
+ #include "ping.h"
+diff --git a/tcpdump.h b/tcpdump.h
+index 5d936f2..3c9126c 100644
+--- a/tcpdump.h
++++ b/tcpdump.h
+@@ -23,7 +23,7 @@
+ #define _BATCTL_TCPDUMP_H
+ 
+ #include <netpacket/packet.h>
+-#include <linux/if_ether.h>
++#include <netinet/if_ether.h>
+ #include <net/if_arp.h>
+ #include <sys/types.h>
+ #include "main.h"
+diff --git a/traceroute.c b/traceroute.c
+index 4ebfec2..373fe90 100644
+--- a/traceroute.c
++++ b/traceroute.c
+@@ -22,13 +22,13 @@
+ 
+ 
+ #include <netinet/in.h>
++#include <netinet/if_ether.h>
+ #include <errno.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <unistd.h>
+ #include <fcntl.h>
+ #include <string.h>
+-#include <linux/if_ether.h>
+ #include <stddef.h>
+ #include <sys/select.h>
+ #include <sys/time.h>
+-- 
+2.1.4
+

batctl/patches/0002-batctl-Add-required-includes-to-all-files.patch

@@ -0,0 +1,54 @@
+From fb51f72f3fe911103abe565ebe88b7545a18d963 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Fri, 17 Apr 2015 19:40:28 +0200
+Subject: [PATCH] batctl: Add required includes to all files
+
+The header files could not be build indepdent from each other. This is happened
+because headers didn't include the files for things they've used. This was
+problematic because the success of a build depended on the knowledge about the
+right order of local includes.
+
+Also source files were not including everything they've used explicitly.
+Instead they required that transitive includes are always stable. This is
+problematic because some transitive includes are not obvious, depend on config
+settings and may not be stable in the future.
+
+The order for include blocks are:
+
+ * primary headers (main.h and the *.h file of a *.c file)
+ * global linux headers
+ * required local headers
+ * extra forward declarations for pointers in function/struct declarations
+
+The only exceptions are linux/bitops.h and linux/if_ether.h in packet.h. This
+header file is shared with userspace applications like batctl and must
+therefore build together with userspace applications. The header linux/bitops.h
+is not part of the uapi headers and linux/if_ether.h conflicts with the musl
+implementation of netinet/if_ether.h. The maintainers rejected the use of
+__KERNEL__ preprocessor checks and thus these two headers are only in main.h.
+All files using packet.h first have to include main.h to work correctly.
+
+Reported-by: Markus Pargmann <mpa@pengutronix.de>
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+---
+ packet.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/packet.h b/packet.h
+index b81fbbf..7a9cb7a 100644
+--- a/packet.h
++++ b/packet.h
+@@ -18,6 +18,9 @@
+ #ifndef _NET_BATMAN_ADV_PACKET_H_
+ #define _NET_BATMAN_ADV_PACKET_H_
+ 
++#include <asm/byteorder.h>
++#include <linux/types.h>
++
+ /**
+  * enum batadv_packettype - types for batman-adv encapsulated packets
+  * @BATADV_IV_OGM: originator messages for B.A.T.M.A.N. IV
+-- 
+2.1.4
+

batman-adv/Makefile

@@ -10,9 +10,9 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=batman-adv
 
-PKG_VERSION:=2014.4.0
+PKG_VERSION:=2015.0
 PKG_RELEASE:=1
-PKG_MD5SUM:=b1518e84ce530883d224c6ca4c673ce8
+PKG_MD5SUM:=178b082266a8bfb3041178a0c821d843
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=http://downloads.open-mesh.org/batman/releases/batman-adv-$(PKG_VERSION)

batman-adv/patches/0001-batman-adv-Avoid-u32-overflow-during-gateway-select.patch

@@ -0,0 +1,42 @@
+From f63c54bba31d2c86269982fd8efdfb618f1daabe Mon Sep 17 00:00:00 2001
+From: Ruben Wisniewski <ruben@freifunk-nrw.de>
+Date: Tue, 26 May 2015 18:34:27 +0200
+Subject: [PATCH 01/13] batman-adv: Avoid u32 overflow during gateway select
+
+The gateway selection based on fast connections is using a single value
+calculated from the average tq (0-255) and the download bandwidth (in
+100Kibit). The formula for the first step (tq ** 2 * 10000 * bandwidth)
+tends to overflow a u32 with low bandwidth settings like 50 [100KiBit]
+and a tq value of over 92.
+
+Changing this to a 64 bit unsigned integer allows to support a
+bandwidth_down with up to ~2.8e10 [100KiBit] and a perfect tq of 255. This
+is ~6.6 times higher than the maximum possible value of the gateway
+announcement TVLV.
+
+This problem only affects the non-default gw_sel_class 1.
+
+Signed-off-by: Ruben Wisniewsi <ruben@vfn-nrw.de>
+[sven@narfation.org: rewritten commit message, changed to kernel type]
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+---
+ gateway_client.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/gateway_client.c b/gateway_client.c
+index a85eaca..3f32357 100644
+--- a/gateway_client.c
++++ b/gateway_client.c
+@@ -133,7 +133,7 @@ batadv_gw_get_best_gw_node(struct batadv_priv *bat_priv)
+ 	struct batadv_neigh_node *router;
+ 	struct batadv_neigh_ifinfo *router_ifinfo;
+ 	struct batadv_gw_node *gw_node, *curr_gw = NULL;
+-	uint32_t max_gw_factor = 0, tmp_gw_factor = 0;
++	uint64_t max_gw_factor = 0, tmp_gw_factor = 0;
+ 	uint32_t gw_divisor;
+ 	uint8_t max_tq = 0;
+ 	uint8_t tq_avg;
+-- 
+2.1.4
+

batman-adv/patches/0002-batman-adv-avoid-DAT-to-mess-up-LAN-state.patch

@@ -0,0 +1,74 @@
+From 9bbd794030657fe0d38590cd67d4801b989cebf9 Mon Sep 17 00:00:00 2001
+From: Antonio Quartulli <antonio@meshcoding.com>
+Date: Mon, 1 Jun 2015 17:29:57 +0200
+Subject: [PATCH 02/13] batman-adv: avoid DAT to mess up LAN state
+
+When a node running DAT receives an ARP request from the LAN for the
+first time, it is likely that this node will request the ARP entry
+through the distributed ARP table (DAT) in the mesh.
+
+Once a DAT reply is received the asking node must check if the MAC
+address for which the IP address has been asked is local. If it is, the
+node must drop the ARP reply bceause the client should have replied on
+its own locally.
+
+Forwarding this reply means fooling any L2 bridge (e.g. Ethernet
+switches) lying between the batman-adv node and the LAN. This happens
+because the L2 bridge will think that the client sending the ARP reply
+lies somewhere in the mesh, while this node is sitting in the same LAN.
+
+Reported-by: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+---
+ distributed-arp-table.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/distributed-arp-table.c b/distributed-arp-table.c
+index da1742d..0d791dc 100644
+--- a/distributed-arp-table.c
++++ b/distributed-arp-table.c
+@@ -1107,6 +1107,9 @@ void batadv_dat_snoop_outgoing_arp_reply(struct batadv_priv *bat_priv,
+  * @bat_priv: the bat priv with all the soft interface information
+  * @skb: packet to check
+  * @hdr_size: size of the encapsulation header
++ *
++ * Returns true if the packet was snooped and consumed by DAT. False if the
++ * packet has to be delivered to the interface
+  */
+ bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,
+ 					 struct sk_buff *skb, int hdr_size)
+@@ -1114,7 +1117,7 @@ bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,
+ 	uint16_t type;
+ 	__be32 ip_src, ip_dst;
+ 	uint8_t *hw_src, *hw_dst;
+-	bool ret = false;
++	bool dropped = false;
+ 	unsigned short vid;
+ 
+ 	if (!atomic_read(&bat_priv->distributed_arp_table))
+@@ -1143,12 +1146,17 @@ bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,
+ 	/* if this REPLY is directed to a client of mine, let's deliver the
+ 	 * packet to the interface
+ 	 */
+-	ret = !batadv_is_my_client(bat_priv, hw_dst, vid);
++	dropped = !batadv_is_my_client(bat_priv, hw_dst, vid);
++
++	/* if this REPLY is sent on behalf of a client of mine, let's drop the
++	 * packet because the client will reply by itself
++	 */
++	dropped |= batadv_is_my_client(bat_priv, hw_src, vid);
+ out:
+-	if (ret)
++	if (dropped)
+ 		kfree_skb(skb);
+-	/* if ret == false -> packet has to be delivered to the interface */
+-	return ret;
++	/* if dropped == false -> deliver to the interface */
++	return dropped;
+ }
+ 
+ /**
+-- 
+2.1.4
+

batman-adv/patches/0003-batman-adv-Make-DAT-capability-changes-atomic.patch

@@ -0,0 +1,54 @@
+From bfd0fbaef270ac4ed8e4457a38ef8d91190c0540 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
+Date: Tue, 16 Jun 2015 17:10:22 +0200
+Subject: [PATCH 03/13] batman-adv: Make DAT capability changes atomic
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Bitwise OR/AND assignments in C aren't guaranteed to be atomic. One
+OGM handler might undo the set/clear of a specific bit from another
+handler run in between.
+
+Fix this by using the atomic set_bit()/clear_bit() functions.
+
+Fixes: 2b1c07b918d2 ("batman-adv: tvlv - add distributed arp table container")
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+---
+ distributed-arp-table.c | 4 ++--
+ types.h                 | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/distributed-arp-table.c b/distributed-arp-table.c
+index 0d791dc..b2cc19b 100644
+--- a/distributed-arp-table.c
++++ b/distributed-arp-table.c
+@@ -682,9 +682,9 @@ static void batadv_dat_tvlv_ogm_handler_v1(struct batadv_priv *bat_priv,
+ 					   uint16_t tvlv_value_len)
+ {
+ 	if (flags & BATADV_TVLV_HANDLER_OGM_CIFNOTFND)
+-		orig->capabilities &= ~BATADV_ORIG_CAPA_HAS_DAT;
++		clear_bit(BATADV_ORIG_CAPA_HAS_DAT, &orig->capabilities);
+ 	else
+-		orig->capabilities |= BATADV_ORIG_CAPA_HAS_DAT;
++		set_bit(BATADV_ORIG_CAPA_HAS_DAT, &orig->capabilities);
+ }
+ 
+ /**
+diff --git a/types.h b/types.h
+index 28f2461..e33b5aa 100644
+--- a/types.h
++++ b/types.h
+@@ -256,7 +256,7 @@ struct batadv_orig_node {
+ 	struct hlist_node mcast_want_all_ipv4_node;
+ 	struct hlist_node mcast_want_all_ipv6_node;
+ #endif
+-	uint8_t capabilities;
++	unsigned long capabilities;
+ 	uint8_t capa_initialized;
+ 	atomic_t last_ttvn;
+ 	unsigned char *tt_buff;
+-- 
+2.1.4
+

batman-adv/patches/0004-batman-adv-Make-NC-capability-changes-atomic.patch

@@ -0,0 +1,40 @@
+From 586df9e2537b51c0df7ce99576c3cee1681b64de Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
+Date: Tue, 16 Jun 2015 17:10:23 +0200
+Subject: [PATCH 04/13] batman-adv: Make NC capability changes atomic
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Bitwise OR/AND assignments in C aren't guaranteed to be atomic. One
+OGM handler might undo the set/clear of a specific bit from another
+handler run in between.
+
+Fix this by using the atomic set_bit()/clear_bit() functions.
+
+Fixes: 7dd9d8992b0c ("batman-adv: tvlv - add network coding container")
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+---
+ network-coding.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/network-coding.c b/network-coding.c
+index 89e1d47..3ce493e 100644
+--- a/network-coding.c
++++ b/network-coding.c
+@@ -105,9 +105,9 @@ static void batadv_nc_tvlv_ogm_handler_v1(struct batadv_priv *bat_priv,
+ 					  uint16_t tvlv_value_len)
+ {
+ 	if (flags & BATADV_TVLV_HANDLER_OGM_CIFNOTFND)
+-		orig->capabilities &= ~BATADV_ORIG_CAPA_HAS_NC;
++		clear_bit(BATADV_ORIG_CAPA_HAS_NC, &orig->capabilities);
+ 	else
+-		orig->capabilities |= BATADV_ORIG_CAPA_HAS_NC;
++		set_bit(BATADV_ORIG_CAPA_HAS_NC, &orig->capabilities);
+ }
+ 
+ /**
+-- 
+2.1.4
+

batman-adv/patches/0005-batman-adv-Make-TT-capability-changes-atomic.patch

@@ -0,0 +1,60 @@
+From a51fa16ecf3f079518baaa56bffae343bd5694f0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
+Date: Tue, 16 Jun 2015 17:10:24 +0200
+Subject: [PATCH 05/13] batman-adv: Make TT capability changes atomic
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Bitwise OR/AND assignments in C aren't guaranteed to be atomic. One
+OGM handler might undo the set/clear of a specific bit from another
+handler run in between.
+
+Fix this by using the atomic set_bit()/clear_bit() functions.
+
+Fixes: 5d2121af6d31 ("batman-adv: introduce capability initialization bitfield")
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+---
+ translation-table.c | 4 ++--
+ types.h             | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/translation-table.c b/translation-table.c
+index b098e53..e95a424 100644
+--- a/translation-table.c
++++ b/translation-table.c
+@@ -1843,7 +1843,7 @@ void batadv_tt_global_del_orig(struct batadv_priv *bat_priv,
+ 		}
+ 		spin_unlock_bh(list_lock);
+ 	}
+-	orig_node->capa_initialized &= ~BATADV_ORIG_CAPA_HAS_TT;
++	clear_bit(BATADV_ORIG_CAPA_HAS_TT, &orig_node->capa_initialized);
+ }
+ 
+ static bool batadv_tt_global_to_purge(struct batadv_tt_global_entry *tt_global,
+@@ -2802,7 +2802,7 @@ static void _batadv_tt_update_changes(struct batadv_priv *bat_priv,
+ 				return;
+ 		}
+ 	}
+-	orig_node->capa_initialized |= BATADV_ORIG_CAPA_HAS_TT;
++	set_bit(BATADV_ORIG_CAPA_HAS_TT, &orig_node->capa_initialized);
+ }
+ 
+ static void batadv_tt_fill_gtable(struct batadv_priv *bat_priv,
+diff --git a/types.h b/types.h
+index e33b5aa..c6ec558 100644
+--- a/types.h
++++ b/types.h
+@@ -257,7 +257,7 @@ struct batadv_orig_node {
+ 	struct hlist_node mcast_want_all_ipv6_node;
+ #endif
+ 	unsigned long capabilities;
+-	uint8_t capa_initialized;
++	unsigned long capa_initialized;
+ 	atomic_t last_ttvn;
+ 	unsigned char *tt_buff;
+ 	int16_t tt_buff_len;
+-- 
+2.1.4
+

batman-adv/patches/0006-batman-adv-Make-MCAST-capability-changes-atomic.patch

@@ -0,0 +1,50 @@
+From 201a54ba710ab7f40b82ad3c109f702c47d0761f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
+Date: Tue, 16 Jun 2015 17:10:25 +0200
+Subject: [PATCH 06/13] batman-adv: Make MCAST capability changes atomic
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Bitwise OR/AND assignments in C aren't guaranteed to be atomic. One
+OGM handler might undo the set/clear of a specific bit from another
+handler run in between.
+
+Fix this by using the atomic set_bit()/clear_bit() functions.
+
+Fixes: 77ec494490d6 ("batman-adv: Announce new capability via multicast TVLV")
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+---
+ multicast.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/multicast.c b/multicast.c
+index 09f2838..00612bf 100644
+--- a/multicast.c
++++ b/multicast.c
+@@ -684,7 +684,7 @@ static void batadv_mcast_tvlv_ogm_handler_v1(struct batadv_priv *bat_priv,
+ 	    !(orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST)) {
+ 		if (orig_initialized)
+ 			atomic_dec(&bat_priv->mcast.num_disabled);
+-		orig->capabilities |= BATADV_ORIG_CAPA_HAS_MCAST;
++		set_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capabilities);
+ 	/* If mcast support is being switched off or if this is an initial
+ 	 * OGM without mcast support then increase the disabled mcast
+ 	 * node counter.
+@@ -693,10 +693,10 @@ static void batadv_mcast_tvlv_ogm_handler_v1(struct batadv_priv *bat_priv,
+ 		   (orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST ||
+ 		    !orig_initialized)) {
+ 		atomic_inc(&bat_priv->mcast.num_disabled);
+-		orig->capabilities &= ~BATADV_ORIG_CAPA_HAS_MCAST;
++		clear_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capabilities);
+ 	}
+ 
+-	orig->capa_initialized |= BATADV_ORIG_CAPA_HAS_MCAST;
++	set_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capa_initialized);
+ 
+ 	if (orig_mcast_enabled && tvlv_value &&
+ 	    (tvlv_value_len >= sizeof(mcast_flags)))
+-- 
+2.1.4
+

batman-adv/patches/0007-batman-adv-Fix-potential-synchronization-issues-in-m.patch

@@ -0,0 +1,254 @@
+From 7f220ed1f063be00833bd34a013c8f3f45884031 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
+Date: Tue, 16 Jun 2015 17:10:26 +0200
+Subject: [PATCH 07/13] batman-adv: Fix potential synchronization issues in
+ mcast tvlv handler
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+So far the mcast tvlv handler did not anticipate the processing of
+multiple incoming OGMs from the same originator at the same time. This
+can lead to various issues:
+
+* Broken refcounting: For instance two mcast handlers might both assume
+  that an originator just got multicast capabilities and will together
+  wrongly decrease mcast.num_disabled by two, potentially leading to
+  an integer underflow.
+
+* Potential kernel panic on hlist_del_rcu(): Two mcast handlers might
+  one after another try to do an
+  hlist_del_rcu(&orig->mcast_want_all_*_node). The second one will
+  cause memory corruption / crashes.
+  (Reported by: Sven Eckelmann <sven@narfation.org>)
+
+Right in the beginning the code path makes assumptions about the current
+multicast related state of an originator and bases all updates on that. The
+easiest and least error prune way to fix the issues in this case is to
+serialize multiple mcast handler invocations with a spinlock.
+
+Fixes: 77ec494490d6 ("batman-adv: Announce new capability via multicast TVLV")
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+---
+ multicast.c  | 62 +++++++++++++++++++++++++++++++++++++++++++++++-------------
+ originator.c |  4 ++++
+ types.h      |  3 +++
+ 3 files changed, 56 insertions(+), 13 deletions(-)
+
+diff --git a/multicast.c b/multicast.c
+index 00612bf..b75bcc3 100644
+--- a/multicast.c
++++ b/multicast.c
+@@ -565,19 +565,26 @@ batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb,
+  *
+  * If the BATADV_MCAST_WANT_ALL_UNSNOOPABLES flag of this originator,
+  * orig, has toggled then this method updates counter and list accordingly.
++ *
++ * Caller needs to hold orig->mcast_handler_lock.
+  */
+ static void batadv_mcast_want_unsnoop_update(struct batadv_priv *bat_priv,
+ 					     struct batadv_orig_node *orig,
+ 					     uint8_t mcast_flags)
+ {
++	struct hlist_node *node = &orig->mcast_want_all_unsnoopables_node;
++	struct hlist_head *head = &bat_priv->mcast.want_all_unsnoopables_list;
++
+ 	/* switched from flag unset to set */
+ 	if (mcast_flags & BATADV_MCAST_WANT_ALL_UNSNOOPABLES &&
+ 	    !(orig->mcast_flags & BATADV_MCAST_WANT_ALL_UNSNOOPABLES)) {
+ 		atomic_inc(&bat_priv->mcast.num_want_all_unsnoopables);
+ 
+ 		spin_lock_bh(&bat_priv->mcast.want_lists_lock);
+-		hlist_add_head_rcu(&orig->mcast_want_all_unsnoopables_node,
+-				   &bat_priv->mcast.want_all_unsnoopables_list);
++		/* flag checks above + mcast_handler_lock prevents this */
++		BUG_ON(!hlist_unhashed(node));
++
++		hlist_add_head_rcu(node, head);
+ 		spin_unlock_bh(&bat_priv->mcast.want_lists_lock);
+ 	/* switched from flag set to unset */
+ 	} else if (!(mcast_flags & BATADV_MCAST_WANT_ALL_UNSNOOPABLES) &&
+@@ -585,7 +592,10 @@ static void batadv_mcast_want_unsnoop_update(struct batadv_priv *bat_priv,
+ 		atomic_dec(&bat_priv->mcast.num_want_all_unsnoopables);
+ 
+ 		spin_lock_bh(&bat_priv->mcast.want_lists_lock);
+-		hlist_del_rcu(&orig->mcast_want_all_unsnoopables_node);
++		/* flag checks above + mcast_handler_lock prevents this */
++		BUG_ON(hlist_unhashed(node));
++
++		hlist_del_init_rcu(node);
+ 		spin_unlock_bh(&bat_priv->mcast.want_lists_lock);
+ 	}
+ }
+@@ -598,19 +608,26 @@ static void batadv_mcast_want_unsnoop_update(struct batadv_priv *bat_priv,
+  *
+  * If the BATADV_MCAST_WANT_ALL_IPV4 flag of this originator, orig, has
+  * toggled then this method updates counter and list accordingly.
++ *
++ * Caller needs to hold orig->mcast_handler_lock.
+  */
+ static void batadv_mcast_want_ipv4_update(struct batadv_priv *bat_priv,
+ 					  struct batadv_orig_node *orig,
+ 					  uint8_t mcast_flags)
+ {
++	struct hlist_node *node = &orig->mcast_want_all_ipv4_node;
++	struct hlist_head *head = &bat_priv->mcast.want_all_ipv4_list;
++
+ 	/* switched from flag unset to set */
+ 	if (mcast_flags & BATADV_MCAST_WANT_ALL_IPV4 &&
+ 	    !(orig->mcast_flags & BATADV_MCAST_WANT_ALL_IPV4)) {
+ 		atomic_inc(&bat_priv->mcast.num_want_all_ipv4);
+ 
+ 		spin_lock_bh(&bat_priv->mcast.want_lists_lock);
+-		hlist_add_head_rcu(&orig->mcast_want_all_ipv4_node,
+-				   &bat_priv->mcast.want_all_ipv4_list);
++		/* flag checks above + mcast_handler_lock prevents this */
++		BUG_ON(!hlist_unhashed(node));
++
++		hlist_add_head_rcu(node, head);
+ 		spin_unlock_bh(&bat_priv->mcast.want_lists_lock);
+ 	/* switched from flag set to unset */
+ 	} else if (!(mcast_flags & BATADV_MCAST_WANT_ALL_IPV4) &&
+@@ -618,7 +635,10 @@ static void batadv_mcast_want_ipv4_update(struct batadv_priv *bat_priv,
+ 		atomic_dec(&bat_priv->mcast.num_want_all_ipv4);
+ 
+ 		spin_lock_bh(&bat_priv->mcast.want_lists_lock);
+-		hlist_del_rcu(&orig->mcast_want_all_ipv4_node);
++		/* flag checks above + mcast_handler_lock prevents this */
++		BUG_ON(hlist_unhashed(node));
++
++		hlist_del_init_rcu(node);
+ 		spin_unlock_bh(&bat_priv->mcast.want_lists_lock);
+ 	}
+ }
+@@ -631,19 +651,26 @@ static void batadv_mcast_want_ipv4_update(struct batadv_priv *bat_priv,
+  *
+  * If the BATADV_MCAST_WANT_ALL_IPV6 flag of this originator, orig, has
+  * toggled then this method updates counter and list accordingly.
++ *
++ * Caller needs to hold orig->mcast_handler_lock.
+  */
+ static void batadv_mcast_want_ipv6_update(struct batadv_priv *bat_priv,
+ 					  struct batadv_orig_node *orig,
+ 					  uint8_t mcast_flags)
+ {
++	struct hlist_node *node = &orig->mcast_want_all_ipv6_node;
++	struct hlist_head *head = &bat_priv->mcast.want_all_ipv6_list;
++
+ 	/* switched from flag unset to set */
+ 	if (mcast_flags & BATADV_MCAST_WANT_ALL_IPV6 &&
+ 	    !(orig->mcast_flags & BATADV_MCAST_WANT_ALL_IPV6)) {
+ 		atomic_inc(&bat_priv->mcast.num_want_all_ipv6);
+ 
+ 		spin_lock_bh(&bat_priv->mcast.want_lists_lock);
+-		hlist_add_head_rcu(&orig->mcast_want_all_ipv6_node,
+-				   &bat_priv->mcast.want_all_ipv6_list);
++		/* flag checks above + mcast_handler_lock prevents this */
++		BUG_ON(!hlist_unhashed(node));
++
++		hlist_add_head_rcu(node, head);
+ 		spin_unlock_bh(&bat_priv->mcast.want_lists_lock);
+ 	/* switched from flag set to unset */
+ 	} else if (!(mcast_flags & BATADV_MCAST_WANT_ALL_IPV6) &&
+@@ -651,7 +678,10 @@ static void batadv_mcast_want_ipv6_update(struct batadv_priv *bat_priv,
+ 		atomic_dec(&bat_priv->mcast.num_want_all_ipv6);
+ 
+ 		spin_lock_bh(&bat_priv->mcast.want_lists_lock);
+-		hlist_del_rcu(&orig->mcast_want_all_ipv6_node);
++		/* flag checks above + mcast_handler_lock prevents this */
++		BUG_ON(hlist_unhashed(node));
++
++		hlist_del_init_rcu(node);
+ 		spin_unlock_bh(&bat_priv->mcast.want_lists_lock);
+ 	}
+ }
+@@ -674,6 +704,11 @@ static void batadv_mcast_tvlv_ogm_handler_v1(struct batadv_priv *bat_priv,
+ 	uint8_t mcast_flags = BATADV_NO_FLAGS;
+ 	bool orig_initialized;
+ 
++	if (orig_mcast_enabled && tvlv_value &&
++	    (tvlv_value_len >= sizeof(mcast_flags)))
++		mcast_flags = *(uint8_t *)tvlv_value;
++
++	spin_lock_bh(&orig->mcast_handler_lock);
+ 	orig_initialized = orig->capa_initialized & BATADV_ORIG_CAPA_HAS_MCAST;
+ 
+ 	/* If mcast support is turned on decrease the disabled mcast node
+@@ -698,15 +733,12 @@ static void batadv_mcast_tvlv_ogm_handler_v1(struct batadv_priv *bat_priv,
+ 
+ 	set_bit(BATADV_ORIG_CAPA_HAS_MCAST, &orig->capa_initialized);
+ 
+-	if (orig_mcast_enabled && tvlv_value &&
+-	    (tvlv_value_len >= sizeof(mcast_flags)))
+-		mcast_flags = *(uint8_t *)tvlv_value;
+-
+ 	batadv_mcast_want_unsnoop_update(bat_priv, orig, mcast_flags);
+ 	batadv_mcast_want_ipv4_update(bat_priv, orig, mcast_flags);
+ 	batadv_mcast_want_ipv6_update(bat_priv, orig, mcast_flags);
+ 
+ 	orig->mcast_flags = mcast_flags;
++	spin_unlock_bh(&orig->mcast_handler_lock);
+ }
+ 
+ /**
+@@ -740,6 +772,8 @@ void batadv_mcast_purge_orig(struct batadv_orig_node *orig)
+ {
+ 	struct batadv_priv *bat_priv = orig->bat_priv;
+ 
++	spin_lock_bh(&orig->mcast_handler_lock);
++
+ 	if (!(orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST) &&
+ 	    orig->capa_initialized & BATADV_ORIG_CAPA_HAS_MCAST)
+ 		atomic_dec(&bat_priv->mcast.num_disabled);
+@@ -747,4 +781,6 @@ void batadv_mcast_purge_orig(struct batadv_orig_node *orig)
+ 	batadv_mcast_want_unsnoop_update(bat_priv, orig, BATADV_NO_FLAGS);
+ 	batadv_mcast_want_ipv4_update(bat_priv, orig, BATADV_NO_FLAGS);
+ 	batadv_mcast_want_ipv6_update(bat_priv, orig, BATADV_NO_FLAGS);
++
++	spin_unlock_bh(&orig->mcast_handler_lock);
+ }
+diff --git a/originator.c b/originator.c
+index e3900e4..a2ba182 100644
+--- a/originator.c
++++ b/originator.c
+@@ -658,11 +658,15 @@ struct batadv_orig_node *batadv_orig_node_new(struct batadv_priv *bat_priv,
+ 	INIT_HLIST_HEAD(&orig_node->neigh_list);
+ 	INIT_LIST_HEAD(&orig_node->vlan_list);
+ 	INIT_HLIST_HEAD(&orig_node->ifinfo_list);
++	INIT_HLIST_NODE(&orig_node->mcast_want_all_unsnoopables_node);
++	INIT_HLIST_NODE(&orig_node->mcast_want_all_ipv4_node);
++	INIT_HLIST_NODE(&orig_node->mcast_want_all_ipv6_node);
+ 	spin_lock_init(&orig_node->bcast_seqno_lock);
+ 	spin_lock_init(&orig_node->neigh_list_lock);
+ 	spin_lock_init(&orig_node->tt_buff_lock);
+ 	spin_lock_init(&orig_node->tt_lock);
+ 	spin_lock_init(&orig_node->vlan_list_lock);
++	spin_lock_init(&orig_node->mcast_handler_lock);
+ 
+ 	batadv_nc_init_orig(orig_node);
+ 
+diff --git a/types.h b/types.h
+index c6ec558..65dc6bf 100644
+--- a/types.h
++++ b/types.h
+@@ -204,6 +204,7 @@ struct batadv_orig_bat_iv {
+  * @batadv_dat_addr_t:  address of the orig node in the distributed hash
+  * @last_seen: time when last packet from this node was received
+  * @bcast_seqno_reset: time when the broadcast seqno window was reset
++ * @mcast_handler_lock: synchronizes mcast-capability and -flag changes
+  * @mcast_flags: multicast flags announced by the orig node
+  * @mcast_want_all_unsnoop_node: a list node for the
+  *  mcast.want_all_unsnoopables list
+@@ -251,6 +252,8 @@ struct batadv_orig_node {
+ 	unsigned long last_seen;
+ 	unsigned long bcast_seqno_reset;
+ #ifdef CONFIG_BATMAN_ADV_MCAST
++	/* synchronizes mcast tvlv specific orig changes */
++	spinlock_t mcast_handler_lock;
+ 	uint8_t mcast_flags;
+ 	struct hlist_node mcast_want_all_unsnoopables_node;
+ 	struct hlist_node mcast_want_all_ipv4_node;
+-- 
+2.1.4
+

batman-adv/patches/0008-batman-adv-Fix-compile-error-on-deactivated-MCAST-fe.patch

@@ -0,0 +1,58 @@
+From 256776ef8562744f90ac9379364df4cf88291b49 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
+Date: Thu, 18 Jun 2015 06:47:19 +0200
+Subject: [PATCH 08/13] batman-adv: Fix compile error on deactivated MCAST
+ feature
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Some members of "struct batadv_orig_node" are not available if compiling
+without the multicast optimizations feature.
+
+Fix this by moving their initialization into the right #ifdef's.
+
+Fixes: 7f220ed1f063 ("batman-adv: Fix potential synchronization issues in mcast tvlv handler")
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+---
+ originator.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/originator.c b/originator.c
+index a2ba182..a5276db 100644
+--- a/originator.c
++++ b/originator.c
+@@ -658,15 +658,11 @@ struct batadv_orig_node *batadv_orig_node_new(struct batadv_priv *bat_priv,
+ 	INIT_HLIST_HEAD(&orig_node->neigh_list);
+ 	INIT_LIST_HEAD(&orig_node->vlan_list);
+ 	INIT_HLIST_HEAD(&orig_node->ifinfo_list);
+-	INIT_HLIST_NODE(&orig_node->mcast_want_all_unsnoopables_node);
+-	INIT_HLIST_NODE(&orig_node->mcast_want_all_ipv4_node);
+-	INIT_HLIST_NODE(&orig_node->mcast_want_all_ipv6_node);
+ 	spin_lock_init(&orig_node->bcast_seqno_lock);
+ 	spin_lock_init(&orig_node->neigh_list_lock);
+ 	spin_lock_init(&orig_node->tt_buff_lock);
+ 	spin_lock_init(&orig_node->tt_lock);
+ 	spin_lock_init(&orig_node->vlan_list_lock);
+-	spin_lock_init(&orig_node->mcast_handler_lock);
+ 
+ 	batadv_nc_init_orig(orig_node);
+ 
+@@ -682,8 +678,13 @@ struct batadv_orig_node *batadv_orig_node_new(struct batadv_priv *bat_priv,
+ 	orig_node->last_seen = jiffies;
+ 	reset_time = jiffies - 1 - msecs_to_jiffies(BATADV_RESET_PROTECTION_MS);
+ 	orig_node->bcast_seqno_reset = reset_time;
++
+ #ifdef CONFIG_BATMAN_ADV_MCAST
+ 	orig_node->mcast_flags = BATADV_NO_FLAGS;
++	INIT_HLIST_NODE(&orig_node->mcast_want_all_unsnoopables_node);
++	INIT_HLIST_NODE(&orig_node->mcast_want_all_ipv4_node);
++	INIT_HLIST_NODE(&orig_node->mcast_want_all_ipv6_node);
++	spin_lock_init(&orig_node->mcast_handler_lock);
+ #endif
+ 
+ 	/* create a vlan object for the "untagged" LAN */
+-- 
+2.1.4
+

batman-adv/patches/0009-batman-adv-fix-kernel-crash-due-to-missing-NULL-chec.patch

@@ -0,0 +1,93 @@
+From 2c2dfd886a400057ccbc66f1507c94ed909d2a89 Mon Sep 17 00:00:00 2001
+From: Marek Lindner <mareklindner@neomailbox.ch>
+Date: Tue, 9 Jun 2015 21:24:36 +0800
+Subject: [PATCH 09/13] batman-adv: fix kernel crash due to missing NULL checks
+
+batadv_softif_vlan_get() may return NULL which has to be verified
+by the caller.
+
+Fixes: 9729d20 ("batman-adv: fix TT VLAN inconsistency on VLAN re-add")
+
+Reported-by: Ryan Thompson <ryan@eero.com>
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+Acked-by: Antonio Quartulli <antonio@meshcoding.com>
+---
+ soft-interface.c    |  3 +++
+ translation-table.c | 19 +++++++++++++++----
+ 2 files changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/soft-interface.c b/soft-interface.c
+index da89336..7841a4b 100644
+--- a/soft-interface.c
++++ b/soft-interface.c
+@@ -455,6 +455,9 @@ out:
+  */
+ void batadv_softif_vlan_free_ref(struct batadv_softif_vlan *vlan)
+ {
++	if (!vlan)
++		return;
++
+ 	if (atomic_dec_and_test(&vlan->refcount)) {
+ 		spin_lock_bh(&vlan->bat_priv->softif_vlan_list_lock);
+ 		hlist_del_rcu(&vlan->list);
+diff --git a/translation-table.c b/translation-table.c
+index e95a424..807a4e6 100644
+--- a/translation-table.c
++++ b/translation-table.c
+@@ -26,6 +26,7 @@
+ #include "bridge_loop_avoidance.h"
+ #include "multicast.h"
+ 
++#include <linux/bug.h>
+ #include <linux/crc32c.h>
+ 
+ /* hash class keys */
+@@ -575,6 +576,9 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
+ 
+ 	/* increase the refcounter of the related vlan */
+ 	vlan = batadv_softif_vlan_get(bat_priv, vid);
++	if (WARN(!vlan, "adding TT local entry %pM to non-existent VLAN %d",
++		 addr, BATADV_PRINT_VID(vid)))
++		goto out;
+ 
+ 	batadv_dbg(BATADV_DBG_TT, bat_priv,
+ 		   "Creating new local tt entry: %pM (vid: %d, ttvn: %d)\n",
+@@ -1047,6 +1051,9 @@ uint16_t batadv_tt_local_remove(struct batadv_priv *bat_priv,
+ 
+ 	/* decrease the reference held for this vlan */
+ 	vlan = batadv_softif_vlan_get(bat_priv, vid);
++	if (!vlan)
++		goto out;
++
+ 	batadv_softif_vlan_free_ref(vlan);
+ 	batadv_softif_vlan_free_ref(vlan);
+ 
+@@ -1147,8 +1154,10 @@ static void batadv_tt_local_table_free(struct batadv_priv *bat_priv)
+ 			/* decrease the reference held for this vlan */
+ 			vlan = batadv_softif_vlan_get(bat_priv,
+ 						      tt_common_entry->vid);
+-			batadv_softif_vlan_free_ref(vlan);
+-			batadv_softif_vlan_free_ref(vlan);
++			if (vlan) {
++				batadv_softif_vlan_free_ref(vlan);
++				batadv_softif_vlan_free_ref(vlan);
++			}
+ 
+ 			batadv_tt_local_entry_free_ref(tt_local);
+ 		}
+@@ -3188,8 +3197,10 @@ static void batadv_tt_local_purge_pending_clients(struct batadv_priv *bat_priv)
+ 
+ 			/* decrease the reference held for this vlan */
+ 			vlan = batadv_softif_vlan_get(bat_priv, tt_common->vid);
+-			batadv_softif_vlan_free_ref(vlan);
+-			batadv_softif_vlan_free_ref(vlan);
++			if (vlan) {
++				batadv_softif_vlan_free_ref(vlan);
++				batadv_softif_vlan_free_ref(vlan);
++			}
+ 
+ 			batadv_tt_local_entry_free_ref(tt_local);
+ 		}
+-- 
+2.1.4
+

batman-adv/patches/0010-batman-adv-protect-tt_local_entry-from-concurrent-de.patch

@@ -0,0 +1,55 @@
+From af912d77181f252e6fdd324592d006e30bc82909 Mon Sep 17 00:00:00 2001
+From: Marek Lindner <mareklindner@neomailbox.ch>
+Date: Wed, 17 Jun 2015 20:01:36 +0800
+Subject: [PATCH 10/13] batman-adv: protect tt_local_entry from concurrent
+ delete events
+
+The tt_local_entry deletion performed in batadv_tt_local_remove() was neither
+protecting against simultaneous deletes nor checking whether the element was
+still part of the list before calling hlist_del_rcu().
+
+Replacing the hlist_del_rcu() call with batadv_hash_remove() provides adequate
+protection via hash spinlocks as well as an is-element-still-in-hash check to
+avoid 'blind' hash removal.
+
+Fixes: 2443ba3 ("batman-adv: roaming handling mechanism redesign")
+
+Reported-by: alfonsname@web.de
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+Acked-by: Antonio Quartulli <antonio@meshcoding.com>
+---
+ translation-table.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/translation-table.c b/translation-table.c
+index 807a4e6..dfe8896 100644
+--- a/translation-table.c
++++ b/translation-table.c
+@@ -1019,6 +1019,7 @@ uint16_t batadv_tt_local_remove(struct batadv_priv *bat_priv,
+ 	struct batadv_tt_local_entry *tt_local_entry;
+ 	uint16_t flags, curr_flags = BATADV_NO_FLAGS;
+ 	struct batadv_softif_vlan *vlan;
++	void *tt_entry_exists;
+ 
+ 	tt_local_entry = batadv_tt_local_hash_find(bat_priv, addr, vid);
+ 	if (!tt_local_entry)
+@@ -1046,7 +1047,15 @@ uint16_t batadv_tt_local_remove(struct batadv_priv *bat_priv,
+ 	 * immediately purge it
+ 	 */
+ 	batadv_tt_local_event(bat_priv, tt_local_entry, BATADV_TT_CLIENT_DEL);
+-	hlist_del_rcu(&tt_local_entry->common.hash_entry);
++
++	tt_entry_exists = batadv_hash_remove(bat_priv->tt.local_hash,
++					     batadv_compare_tt,
++					     batadv_choose_tt,
++					     &tt_local_entry->common);
++	if (!tt_entry_exists)
++		goto out;
++
++	/* extra call to free the local tt entry */
+ 	batadv_tt_local_entry_free_ref(tt_local_entry);
+ 
+ 	/* decrease the reference held for this vlan */
+-- 
+2.1.4
+

batman-adv/patches/0011-batman-adv-protect-tt-request-from-double-deletion.patch

@@ -0,0 +1,58 @@
+From 9bac35c1e4fab662522371f81147963e19693409 Mon Sep 17 00:00:00 2001
+From: Marek Lindner <mareklindner@neomailbox.ch>
+Date: Mon, 22 Jun 2015 00:36:28 +0800
+Subject: [PATCH 11/13] batman-adv: protect tt request from double deletion
+
+The list_del() calls were changed to list_del_init() to prevent
+an accidental double deletion in batadv_tt_req_node_new().
+
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+Acked-by: Antonio Quartulli <antonio@meshcoding.com>
+---
+ translation-table.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/translation-table.c b/translation-table.c
+index dfe8896..b6c0f52 100644
+--- a/translation-table.c
++++ b/translation-table.c
+@@ -2194,7 +2194,7 @@ static void batadv_tt_req_list_free(struct batadv_priv *bat_priv)
+ 	spin_lock_bh(&bat_priv->tt.req_list_lock);
+ 
+ 	list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
+-		list_del(&node->list);
++		list_del_init(&node->list);
+ 		kfree(node);
+ 	}
+ 
+@@ -2230,7 +2230,7 @@ static void batadv_tt_req_purge(struct batadv_priv *bat_priv)
+ 	list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
+ 		if (batadv_has_timed_out(node->issued_at,
+ 					 BATADV_TT_REQUEST_TIMEOUT)) {
+-			list_del(&node->list);
++			list_del_init(&node->list);
+ 			kfree(node);
+ 		}
+ 	}
+@@ -2512,7 +2512,8 @@ out:
+ 		batadv_hardif_free_ref(primary_if);
+ 	if (ret && tt_req_node) {
+ 		spin_lock_bh(&bat_priv->tt.req_list_lock);
+-		list_del(&tt_req_node->list);
++		/* list_del_init() verifies tt_req_node still is in the list */
++		list_del_init(&tt_req_node->list);
+ 		spin_unlock_bh(&bat_priv->tt.req_list_lock);
+ 		kfree(tt_req_node);
+ 	}
+@@ -2949,7 +2950,7 @@ static void batadv_handle_tt_response(struct batadv_priv *bat_priv,
+ 	list_for_each_entry_safe(node, safe, &bat_priv->tt.req_list, list) {
+ 		if (!batadv_compare_eth(node->addr, resp_src))
+ 			continue;
+-		list_del(&node->list);
++		list_del_init(&node->list);
+ 		kfree(node);
+ 	}
+ 
+-- 
+2.1.4
+

batman-adv/patches/0012-batman-adv-initialize-up-down-values-when-adding-a-g.patch

@@ -0,0 +1,42 @@
+From 3c92b633715b7eca80dc7a2347e0e4dbcce1f018 Mon Sep 17 00:00:00 2001
+From: Simon Wunderlich <simon@open-mesh.com>
+Date: Wed, 24 Jun 2015 14:50:19 +0200
+Subject: [PATCH 12/13] batman-adv: initialize up/down values when adding a
+ gateway
+
+Without this initialization, gateways which actually announce up/down
+bandwidth of 0/0 could be added. If these nodes get purged via
+_batadv_purge_orig() later, the gw_node structure does not get removed
+since batadv_gw_node_delete() updates the gw_node with up/down
+bandwidth of 0/0, and the updating function then discards the change
+and does not free gw_node.
+
+This results in leaking the gw_node structures, which references other
+structures: gw_node -> orig_node -> orig_node_ifinfo -> hardif. When
+removing the interface later, the open reference on the hardif may cause
+hangs with the infamous "unregister_netdevice: waiting for mesh1 to
+become free. Usage count = 1" message.
+
+Signed-off-by: Simon Wunderlich <simon@open-mesh.com>
+Acked-by: Antonio Quartulli <antonio@meshcoding.com>
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+---
+ gateway_client.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/gateway_client.c b/gateway_client.c
+index 3f32357..d8e3ead 100644
+--- a/gateway_client.c
++++ b/gateway_client.c
+@@ -419,6 +419,8 @@ static void batadv_gw_node_add(struct batadv_priv *bat_priv,
+ 
+ 	INIT_HLIST_NODE(&gw_node->list);
+ 	gw_node->orig_node = orig_node;
++	gw_node->bandwidth_down = ntohl(gateway->bandwidth_down);
++	gw_node->bandwidth_up = ntohl(gateway->bandwidth_up);
+ 	atomic_set(&gw_node->refcount, 1);
+ 
+ 	spin_lock_bh(&bat_priv->gw.list_lock);
+-- 
+2.1.4
+

batman-adv/patches/0013-batman-adv-remove-broadcast-packets-scheduled-for-pu.patch

@@ -0,0 +1,32 @@
+From 07bec2d4dec83f024baf166b95cf037be3a7eca5 Mon Sep 17 00:00:00 2001
+From: Simon Wunderlich <simon@open-mesh.com>
+Date: Wed, 24 Jun 2015 14:50:20 +0200
+Subject: [PATCH 13/13] batman-adv: remove broadcast packets scheduled for
+ purged outgoing if
+
+When an interface is purged, the broadcast packets scheduled for this
+interface should get purged as well.
+
+Signed-off-by: Simon Wunderlich <simon@open-mesh.com>
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+---
+ send.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/send.c b/send.c
+index 23635bd..a7e84b2 100644
+--- a/send.c
++++ b/send.c
+@@ -598,7 +598,8 @@ batadv_purge_outstanding_packets(struct batadv_priv *bat_priv,
+ 		 * we delete only packets belonging to the given interface
+ 		 */
+ 		if ((hard_iface) &&
+-		    (forw_packet->if_incoming != hard_iface))
++		    (forw_packet->if_incoming != hard_iface) &&
++		    (forw_packet->if_outgoing != hard_iface))
+ 			continue;
+ 
+ 		spin_unlock_bh(&bat_priv->forw_bcast_list_lock);
+-- 
+2.1.4
+

bmx6/Makefile

@@ -31,8 +31,8 @@ PKG_SOURCE_PROTO:=git
 #PKG_SOURCE_URL:=git://bmx6.net/bmx6.git
 PKG_SOURCE_URL:=git://github.com/axn/bmx6.git
 
-PKG_REV:=b6107880b5460625b7ce9359dbeac0cfe863f58c
+PKG_REV:=8f26909e8808ed7fab0359afc15a3e44563fbd40
-PKG_VERSION:=r2015060501
+PKG_VERSION:=r2015061604
 PKG_RELEASE:=4
 PKG_LICENSE:=GPL-2.0
 
@@ -49,7 +49,7 @@ TARGET_CFLAGS += $(FPIC)
 MAKE_ARGS += \
 	EXTRA_CFLAGS="$(TARGET_CFLAGS) -I. -I$(STAGING_DIR)/usr/include -DNO_DEBUG_ALL -DNO_DEBUG_DUMP" \
 	EXTRA_LDFLAGS="-L$(STAGING_DIR)/usr/lib " \
-	REVISION_VERSION="$(PKG_REV)" \
+	GIT_REV="$(PKG_REV)" \
 	CC="$(TARGET_CC)" \
 	INSTALL_DIR="$(PKG_INSTALL_DIR)" \
 	STRIP="/bin/false" \

cjdns/Makefile

@@ -18,11 +18,11 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=cjdns
 PKG_VERSION:=0.16
-PKG_RELEASE:=14
+PKG_RELEASE:=15
 
 PKG_SOURCE_URL:=https://github.com/hyperboria/cjdns.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=a97c189b9181bf83ed44a9ab0ebc817882c60ffa
+PKG_SOURCE_VERSION:=951581191997db0188b56d8b21c5216f7e6e2ee1
 PKG_LICENSE:=GPL-3.0
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_SOURCE_VERSION).tar.bz2
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_SOURCE_VERSION)
@@ -79,11 +79,14 @@ endif
 define Build/Compile
 	CROSS="true" \
 	CC="$(TARGET_CC)" \
+	AR="$(TARGET_AR)" \
+	RANLIB="$(TARGET_RANLIB)" \
 	CFLAGS="$(TARGET_CFLAGS)" \
 	LDFLAGS="$(TARGET_LDFLAGS)" \
 	SYSTEM="linux" \
 	TARGET_ARCH="$(CONFIG_ARCH)" \
 	SSP_SUPPORT="$(CONFIG_SSP_SUPPORT)" \
+	GYP_ADDITIONAL_ARGS="-f make-linux" \
 	$(PKG_DO_VARS) \
 	$(PKG_BUILD_DIR)/do
 endef

hnetd/Makefile

@@ -7,8 +7,8 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=hnetd
-PKG_SOURCE_VERSION:=86da3551277dc5b21e9382233c3ce66a154ab670
+PKG_SOURCE_VERSION:=18ee17f3d18a4c0159e53e0716831bf2fbe506cd
-PKG_VERSION:=2015-05-28-$(PKG_SOURCE_VERSION)
+PKG_VERSION:=2015-06-17-$(PKG_SOURCE_VERSION)
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git

mcproxy/Makefile

@@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=mcproxy
 PKG_SOURCE_VERSION:=b7bd2d0809a0d1f177181c361b9a6c83e193b79a
 PKG_VERSION:=2014-12-31-$(PKG_SOURCE_VERSION)
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=git://github.com/mcproxy/mcproxy.git

mcproxy/patches/0003-add-sourcefilter.patch

@@ -4,9 +4,9 @@
  #include <numeric>
  #include <unistd.h>
  
-+#ifdef __UCLIBC__
++#ifndef __GLIBC__
 +#include "sourcefilter.cpp"
-+#endif /* __UCLIBC__ */
++#endif /* __GLIBC__ */
 +
  std::string ipAddrResolver(std::string ipAddr)
  {

mcproxy/patches/0004-add-defs.patch

@@ -3,9 +3,9 @@
 @@ -38,6 +38,8 @@
  #include <unistd.h>
  
- #ifdef __UCLIBC__
+ #ifndef __GLIBC__
 +#define IP_MULTICAST_ALL 49
 +
  #include "sourcefilter.cpp"
- #endif /* __UCLIBC__ */
+ #endif /* __GLIBC__ */
  

miniupnpd/Makefile

@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=miniupnpd
-PKG_VERSION:=1.9.20150430
+PKG_VERSION:=1.9.20150609
 PKG_RELEASE:=1
 
 PKG_SOURCE_URL:=http://miniupnp.free.fr/files
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_MD5SUM:=996ccae8aa2535a83ed4618c63080978
+PKG_MD5SUM:=01ee891286683891240a29b7272d790e
 
 PKG_MAINTAINER:=Markus Stenberg <fingon@iki.fi>
 PKG_LICENSE:=BSD-3-Clause

nodogsplash/Makefile

@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2013 OpenWrt.org
+# Copyright (C) 2013-2015 OpenWrt.org
 #
 # This is free software, licensed under the GNU General Public License v2.
 # See /LICENSE for more information.
@@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=nodogsplash
 PKG_FIXUP:=autoreconf
 PKG_VERSION:=0.9_beta9.9.9
-PKG_RELEASE:=5
+PKG_RELEASE:=6
 
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)/
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz

nodogsplash/patches/100-musl-compat.patch

@@ -0,0 +1,43 @@
+--- a/src/client_list.c
++++ b/src/client_list.c
+@@ -36,7 +36,7 @@
+ #include <pthread.h>
+ #include <sys/wait.h>
+ #include <sys/types.h>
+-#include <sys/unistd.h>
++#include <unistd.h>
+ 
+ #include <string.h>
+ 
+--- a/src/firewall.c
++++ b/src/firewall.c
+@@ -37,7 +37,7 @@
+ #include <pthread.h>
+ #include <sys/wait.h>
+ #include <sys/types.h>
+-#include <sys/unistd.h>
++#include <unistd.h>
+ 
+ #include <string.h>
+ 
+--- a/src/util.c
++++ b/src/util.c
+@@ -38,7 +38,7 @@
+ #include <pthread.h>
+ #include <sys/wait.h>
+ #include <sys/types.h>
+-#include <sys/unistd.h>
++#include <unistd.h>
+ #include <netinet/in.h>
+ #include <sys/ioctl.h>
+ #include <arpa/inet.h>
+--- a/libhttpd/protocol.c
++++ b/libhttpd/protocol.c
+@@ -25,6 +25,7 @@
+ #include <sys/types.h>
+ #include <sys/stat.h>
+ #include <time.h>
++#include <fcntl.h>
+ 
+ #if defined(_WIN32) 
+ #else

olsrd/Makefile

@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=olsrd
-PKG_VERSION:=0.9.0
+PKG_VERSION:=0.9.0.1
-PKG_RELEASE:=3
+PKG_RELEASE:=4
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=http://www.olsr.org/releases/0.9
 
-PKG_MD5SUM:=65376afff4fc4963fcaf1aa0ad8185d4
+PKG_MD5SUM:=5dec2c08e7bbec6789af7279e7aafc6c
 PKG_BUILD_PARALLEL:=1
 PKG_LICENSE:=BSD-3-Clause