Re: [PATCH batadv-next v2] batman-adv: tt: batch BH re-enable during TT hash walks

[Sven Eckelmann <sven@narfation.org>]

[-- Attachment #1: Type: text/plain, Size: 1302 bytes --]

On Saturday, 7 November 2026 16:37:25 CET Ömer Mete Kaya wrote:
> Closes: https://syzkaller.appspot.com/bug\?extid\=61b202fdc410840f0198

This link doesn't seem to work.

On Saturday, 7 November 2026 16:37:25 CET Ömer Mete Kaya wrote:
>         unsigned short vid;
> +       u32 buckets_done = 0;

Breaks the reverse x-mas tree order of variable declarations.

(there are multiple occurrences of this problem)

>   batadv_tt_global_del_orig():
>     Called from workqueue context; yields every 64 buckets. The
>     local_bh_enable() is placed before clear_bit() so that pending
>     softirqs run while no per-bucket lock is held.
> 

Are you sure? It is called from so many different places. Including this one 
(which clearly doesn't allow you to sleep due to the spinlock around the 
call):

void batadv_purge_orig_ref(struct batadv_priv *bat_priv)
{
[...]
	/* for all origins... */
	for (i = 0; i < hash->size; i++) {
		head = &hash->table[i];
		if (hlist_empty(head))
			continue;
		list_lock = &hash->list_locks[i];

		spin_lock_bh(list_lock);
[....]
				batadv_tt_global_del_orig(orig_node->bat_priv,
							  orig_node, -1,
							  "originator timed out");
[...]
		spin_unlock_bh(list_lock);
	}

	batadv_gw_election(bat_priv);
}

Regards,
	Sven

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 228 bytes --]