https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260831135117.574836-1-sw%40simonwunderlich.de?part=9


> Discovered by: gpt-5-6-sol, opus-5 · Missed by: sashiko-gemini
> This isn't a bug introduced by this patch, since it is pure code motion, but
> now that the sequence sits in its own helper it becomes more visible: is the
> check-then-act on tt_global->common.flags in batadv_tt_local_add_roam()
> racy?
> 
> The test and the update are separated by the ROAM_ADV loop, and no lock is
> held around either:
> 
> 	if (tt_global->common.flags & BATADV_TT_CLIENT_ROAM)
> 		return;
> 	...
> 	hlist_for_each_entry_rcu(orig_entry, head, list) {
> 		batadv_send_roam_adv(...);
> 	}
> 	...
> 		tt_global->common.flags |= BATADV_TT_CLIENT_ROAM;
> 
> The rcu_read_lock() here only covers the orig_list walk.
> 
> Meanwhile batadv_tt_global_add() does a non-atomic read-modify-write on the
> same field from TVLV processing:
> 
> 	common->flags |= flags & (~BATADV_TT_SYNC_MASK);
> 
> and batadv_tt_global_del_roaming() also sets BATADV_TT_CLIENT_ROAM. There is
> no common lock between those paths at this commit.
[...]

Please look at the next patches to see how locks are introduced.

Regards,
	Sven