Re: [PATCH RFC batadv] batman-adv: mcast: fix use-after-free in orig_node RCU release

[Sven Eckelmann <sven@narfation.org>]

[-- Attachment #1: Type: text/plain, Size: 1651 bytes --]

On Sunday, 17 May 2026 19:55:56 CEST Linus Lüssing wrote:
[...]
> Maybe this might make more sense as a fixes line then, though?
> 
> Fixes: 500ea14940f8 ("batman-adv: Add multicast-to-unicast support for multiple targets")
> 
> 
> I think before that commit we only used these atomic counters in
> fast path?

I don't really care about the fast path. I care about things which could be 
called in parallel and is only RCU protected. For example in 1c090349e2f6,
we have the reader:

static struct batadv_orig_node *
batadv_mcast_forw_unsnoop_node_get(struct batadv_priv *bat_priv)
{
	struct batadv_orig_node *orig_node;

	rcu_read_lock();
	hlist_for_each_entry_rcu(orig_node,
				 &bat_priv->mcast.want_all_unsnoopables_list,
				 mcast_want_all_unsnoopables_node) {
		if (atomic_inc_not_zero(&orig_node->refcount))
			goto unlock;
	}

	orig_node = NULL;

unlock:
	rcu_read_unlock();
	return orig_node;
}


And here the cleanup code in 1c090349e2f6

static void batadv_mcast_want_unsnoop_update(struct batadv_priv *bat_priv,
					     struct batadv_orig_node *orig,
					     uint8_t mcast_flags)
{
[...]
		hlist_add_head_rcu(&orig->mcast_want_all_unsnoopables_node,
				   &bat_priv->mcast.want_all_unsnoopables_list);
[...]
		hlist_del_rcu(&orig->mcast_want_all_unsnoopables_node);
[...]
}

/**
 * batadv_mcast_purge_orig - reset originator global mcast state modifications
 * @orig: the originator which is going to get purged
 */
void batadv_mcast_purge_orig(struct batadv_orig_node *orig)
{
[...]
	batadv_mcast_want_unsnoop_update(bat_priv, orig, BATADV_NO_FLAGS);
}


Regards,
	Sven

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 228 bytes --]