The Tomato default route cache can create route affinity in a multi-wan environment.
Disparate devices to the same destination may follow the kernel route cache creating a lack of load-balancing
across the multi-wan environment. The proposed resolution is to adjust the route cache garbage collector to prune
the route cache and allow for proper load balancing across multiple WAN circuits.
Based on: https://bitbucket.org/pl_shibby/tomato-arm/issues/193/multiwan-route-cache-creates-route
Note: no change for SDK6 BUT for SDK7 !!!
fix for SDK7 SRC path (SDK6 path was used to build the SDK7 utils for example --> not OK)
OLD: -I/home/tomato/tomato/release/src-rt-6.x.4708/shared/bcmwifi/include
NEW: -I/home/tomato/tomato/release/src-rt-7.x.main/src/shared/bcmwifi/include -I/home/tomato/tomato/release/src-rt-7.x.main/src/wl/olpc/include -I/home/tomato/tomato/release/src-rt-7.x.main/src/wl/ppr/include
Note: sync SDK6 and SDK7
Note: no change for SDK6 BUT for SDK7 !!!
fix for SDK7 SRC path (SDK6 path was used to build the SDK7 utils for example --> not OK)
OLD: -I/home/tomato/tomato/release/src-rt-6.x.4708/shared/bcmwifi/include
NEW: -I/home/tomato/tomato/release/src-rt-7.x.main/src/shared/bcmwifi/include -I/home/tomato/tomato/release/src-rt-7.x.main/src/wl/olpc/include -I/home/tomato/tomato/release/src-rt-7.x.main/src/wl/ppr/include
Note: right now only On/Off at GUI (keep it simple). tested with dual-core arm and apple device (iOS 14)
Control parameter can be adjusted via nvram variables (no GUI yet, tbd.). For basic infos, have a look at https://www.smallnetbuilder.com/wireless/wireless-howto/32653-asus-rt-ac3200-smart-connect-the-missing-manual?start=0
For default config see (or nvram variables) // [Example from SDK6 router]
root@Tomato-ARM:/tmp/home/root# bsd -i
=== Basic info ===
max_ifnum: 2
mode: 2
role: 3
helper: 192.168.1.232[9877]
primary: 192.168.1.231[9878]
status_poll: 5
counter_poll: 0
idle_rate: 10
prefer_5g: 1
scheme: 2[3]
steer_timeout: 15
sta_timeout: 120
maclist_timeout: 3
probe_timeout: 3600
probe_gap: 30
poll_interval: 1
slowest_at_ratio: 40
phyrate_delta: 200
=== intf_info ===
idx: 0
idx=0 band=2 remote=0 enabled=1 steering_flags=0x2
Steer Policy:
max=0 period=5 cnt=3 rssi=-52 phyrate_high=110 phyrate_low=0 flags=0x22 state=3
Rule Logic: OR
RSSI: Greater than
VHT: Allowed
NON VHT: Allowed
NEXT RF: NO
PHYRATE (HIGH): Greater than or Equal to
LOAD BALANCE: NO
STA NUM BALANCE: NO
PHYRATE (LOW): Less than
N ONLY: NO
Interface Qualify Policy:
min_bw=0 rssi=-75 flags=0x0
Rule Logic: OR
VHT: Allowed
NON VHT: Allowed
ifidx=0 bssidx=0 ifnames=eth1 valid=1:
prefix=wl0_ ssid=MM24-Test idx=0x0 bssid=f0:70:60:7f:50:01 rclass=0x4 chanspec=0x1001 prio=0x0 video_idle=0
steer_prefix=wl1_ [1][0]
policy=3[6]
algo=0[2]
Sta Select Policy: defined=YES:
idle_rate=10 rssi=-52 phyrate_high=110 phyrate_low=0 wprio=0 wrssi=1 wphy_rate=1 wtx_failures=0 wtx_rate=0 wrx_rate=0 flags=0x122
Rule Logic: OR
RSSI: Greater than
VHT: Allowed
NON VHT: Allowed
NEXT RF: NO
PHYRATE (HIGH): Greater than or Equal to
LOAD BALANCE: NO
SINGLE BAND: No Preference
DUAL BAND: Prefered
ACTIVE STA: Can't be Selected
PHYRATE (LOW): Less than
N ONLY: NO
bssinfo to list:
ifname=eth1, intf_info->idx=0
ifidx=1 bssidx=0 to_ifidx=1 ifnames=eth2 prefix=wl1_
idx: 1
idx=1 band=1 remote=0 enabled=1 steering_flags=0x0
Steer Policy:
max=80 period=5 cnt=3 rssi=-82 phyrate_high=0 phyrate_low=0 flags=0x20 state=2
Rule Logic: OR
RSSI: Less than or Equal to
VHT: Allowed
NON VHT: Allowed
NEXT RF: NO
PHYRATE (HIGH): Greater than or Equal to
LOAD BALANCE: NO
STA NUM BALANCE: NO
PHYRATE (LOW): Less than
N ONLY: NO
Interface Qualify Policy:
min_bw=60 rssi=-75 flags=0x0
Rule Logic: OR
VHT: Allowed
NON VHT: Allowed
ifidx=1 bssidx=0 ifnames=eth2 valid=1:
prefix=wl1_ ssid=MM24-Test idx=0x0 bssid=f0:70:60:7f:50:04 rclass=0x7 chanspec=0xe06a prio=0x0 video_idle=0
steer_prefix=wl0_ [0][0]
policy=2[6]
algo=0[2]
Sta Select Policy: defined=YES:
idle_rate=10 rssi=-82 phyrate_high=0 phyrate_low=0 wprio=0 wrssi=1 wphy_rate=1 wtx_failures=0 wtx_rate=0 wrx_rate=0 flags=0x20
Rule Logic: OR
RSSI: Less than or Equal to
VHT: Allowed
NON VHT: Allowed
NEXT RF: NO
PHYRATE (HIGH): Greater than or Equal to
LOAD BALANCE: NO
SINGLE BAND: No Preference
DUAL BAND: No Preference
ACTIVE STA: Can't be Selected
PHYRATE (LOW): Less than
N ONLY: NO
bssinfo to list:
ifname=eth2, intf_info->idx=1
ifidx=0 bssidx=0 to_ifidx=0 ifnames=eth1 prefix=wl0_
root@Tomato-ARM:/tmp/home/root#
Further Note: to save nvram space --> feature turned off for dir868l
Note: right now only On/Off at GUI (keep it simple). tested with dual-core arm and apple device (iOS 14)
Control parameter can be adjusted via nvram variables (no GUI yet, tbd.). For basic infos, have a look at https://www.smallnetbuilder.com/wireless/wireless-howto/32653-asus-rt-ac3200-smart-connect-the-missing-manual?start=0
For default config see (or nvram variables)
root@Tomato-ARM:/tmp/home/root# bsd -i
=== Basic info ===
max_ifnum: 2
mode: 2
role: 3
helper: 192.168.1.232[9877]
primary: 192.168.1.231[9878]
status_poll: 5
counter_poll: 0
idle_rate: 10
prefer_5g: 1
scheme: 2[3]
steer_timeout: 15
sta_timeout: 120
maclist_timeout: 3
probe_timeout: 3600
probe_gap: 30
poll_interval: 1
slowest_at_ratio: 40
phyrate_delta: 200
=== intf_info ===
idx: 0
idx=0 band=2 remote=0 enabled=1 steering_flags=0x2
Steer Policy:
max=0 period=5 cnt=3 rssi=-52 phyrate_high=110 phyrate_low=0 flags=0x22 state=3
Rule Logic: OR
RSSI: Greater than
VHT: Allowed
NON VHT: Allowed
NEXT RF: NO
PHYRATE (HIGH): Greater than or Equal to
LOAD BALANCE: NO
STA NUM BALANCE: NO
PHYRATE (LOW): Less than
N ONLY: NO
Interface Qualify Policy:
min_bw=0 rssi=-75 flags=0x0
Rule Logic: OR
VHT: Allowed
NON VHT: Allowed
ifidx=0 bssidx=0 ifnames=eth1 valid=1:
prefix=wl0_ ssid=MM24-Test idx=0x0 bssid=f0:70:60:7f:50:01 rclass=0x4 chanspec=0x1001 prio=0x0 video_idle=0
steer_prefix=wl1_ [1][0]
policy=3[6]
algo=0[2]
Sta Select Policy: defined=YES:
idle_rate=10 rssi=-52 phyrate_high=110 phyrate_low=0 wprio=0 wrssi=1 wphy_rate=1 wtx_failures=0 wtx_rate=0 wrx_rate=0 flags=0x122
Rule Logic: OR
RSSI: Greater than
VHT: Allowed
NON VHT: Allowed
NEXT RF: NO
PHYRATE (HIGH): Greater than or Equal to
LOAD BALANCE: NO
SINGLE BAND: No Preference
DUAL BAND: Prefered
ACTIVE STA: Can't be Selected
PHYRATE (LOW): Less than
N ONLY: NO
bssinfo to list:
ifname=eth1, intf_info->idx=0
ifidx=1 bssidx=0 to_ifidx=1 ifnames=eth2 prefix=wl1_
idx: 1
idx=1 band=1 remote=0 enabled=1 steering_flags=0x0
Steer Policy:
max=80 period=5 cnt=3 rssi=-82 phyrate_high=0 phyrate_low=0 flags=0x20 state=2
Rule Logic: OR
RSSI: Less than or Equal to
VHT: Allowed
NON VHT: Allowed
NEXT RF: NO
PHYRATE (HIGH): Greater than or Equal to
LOAD BALANCE: NO
STA NUM BALANCE: NO
PHYRATE (LOW): Less than
N ONLY: NO
Interface Qualify Policy:
min_bw=60 rssi=-75 flags=0x0
Rule Logic: OR
VHT: Allowed
NON VHT: Allowed
ifidx=1 bssidx=0 ifnames=eth2 valid=1:
prefix=wl1_ ssid=MM24-Test idx=0x0 bssid=f0:70:60:7f:50:04 rclass=0x7 chanspec=0xe06a prio=0x0 video_idle=0
steer_prefix=wl0_ [0][0]
policy=2[6]
algo=0[2]
Sta Select Policy: defined=YES:
idle_rate=10 rssi=-82 phyrate_high=0 phyrate_low=0 wprio=0 wrssi=1 wphy_rate=1 wtx_failures=0 wtx_rate=0 wrx_rate=0 flags=0x20
Rule Logic: OR
RSSI: Less than or Equal to
VHT: Allowed
NON VHT: Allowed
NEXT RF: NO
PHYRATE (HIGH): Greater than or Equal to
LOAD BALANCE: NO
SINGLE BAND: No Preference
DUAL BAND: No Preference
ACTIVE STA: Can't be Selected
PHYRATE (LOW): Less than
N ONLY: NO
bssinfo to list:
ifname=eth2, intf_info->idx=1
ifidx=0 bssidx=0 to_ifidx=0 ifnames=eth1 prefix=wl0_
root@Tomato-ARM:/tmp/home/root#
Further Note: to save nvram space --> feature turned off for dir868l
- Don't use ps because Entware procps and busybox ps give different output.
- Fix inverted check condition causing 'via xxx' to be removed in the checker route.
- the idea depends on inserting an explicit clone of the default route to the target IP
then inserting a 2nd explicit route to the target IP over the desired interface to check
but with a very high metric. Existing traffic will go through the clone of the default route,
while traffic that is forced out of the desired interface to check will use the high metric route
and be sent correctly
- additionally, set the default connection checker back to traceroute
Note: with commit aa605ee3a9 check/validation moved to wlconf (no need to do it twice)
this reverts 5f5431f290 (was only needed/useful for our old wlconf blob)
Note: tomato user can enable it at admin-iptraffic.asp if needed.
In additon disabling cstats avoids the waring/note at basic-network.asp that netmask should have at least 22 bits (255.255.252.0).
(see 5e56835d07)
see arm issue 72
syzbot reported an out-of-bound access in em_nbyte. As initially
analyzed by Eric, this is because em_nbyte sets its own em->datalen
in em_nbyte_change() other than the one specified by user, but this
value gets overwritten later by its caller tcf_em_validate().
We should leave em->datalen untouched to respect their choices.
I audit all the in-tree ematch users, all of those implement
->change() set em->datalen, so we can just avoid setting it twice
in this case.
Reported-and-tested-by: syzbot+5af9a90dad568aa9f611@syzkaller.appspotmail.com
Reported-by: syzbot+2f07903a5b05e7f36410@syzkaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings's avatarBen Hutchings <ben@decadent.org.uk>
Fix from upstream: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=61678d28d4a45ef376f5d02a839cc37509ae9281
In compat_do_replace(), a temporary buffer is allocated through vmalloc()
to hold entries copied from the user space. The buffer address is firstly
saved to 'newinfo->entries', and later on assigned to 'entries_tmp'. Then
the entries in this temporary buffer is copied to the internal kernel
structure through compat_copy_entries(). If this copy process fails,
compat_do_replace() should be terminated. However, the allocated temporary
buffer is not freed on this path, leading to a memory leak.
To fix the bug, free the buffer before returning from compat_do_replace().
Signed-off-by: Wenwen Wang's avatarWenwen Wang <wenwen@cs.uga.edu>
Reviewed-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Fix from upstream: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=15a78ba1844a8e052c1226f930133de4cef4e7ad