From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.simonwunderlich.de (mail.simonwunderlich.de [23.88.38.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4D07A352C2B for ; Fri, 15 May 2026 09:55:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=23.88.38.48 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778838958; cv=none; b=Q3SuIz2rYrvLNneAJIzLnjfpbKgTs0FczqpKkrf/TJCLj9YaeJ4wP6yQIiKk7PP5y3TH1WPHzYdbNiFUcm2OhKTg3pJLH/trE6POM2alolGkrLE/pjTlGwU/k6PdoArt5BTR8JbtM99ICWekWIGp5vT8He3uvfyi8MERmoJ0Fqk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778838958; c=relaxed/simple; bh=2rpbxStSmUYs4SkCbcMQgg/E3MbNsWZBh0GClpsTAQY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=IcA6+YpRGZkCvRKsZduOy/um5pd77wZj+qGtveCfCqNCDTPDD6JeZLMgmZSq3zsdXRUe7hFoSdQ9NnlJcXkB6DCJiBd/WXBTlV+E0ZN62KtMgM2q+zi57H1yjuvdGelDKQLncLKIP3neHR3+t0NGPDQ5/+GoK0knSJPz31fejTc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=simonwunderlich.de; spf=pass smtp.mailfrom=simonwunderlich.de; dkim=pass (2048-bit key) header.d=simonwunderlich.de header.i=@simonwunderlich.de header.b=1oyXdCIh; arc=none smtp.client-ip=23.88.38.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=simonwunderlich.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=simonwunderlich.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=simonwunderlich.de header.i=@simonwunderlich.de header.b="1oyXdCIh" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=simonwunderlich.de; s=09092022; t=1778838947; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=mcS91IanzxL76e2zz0k5ZxQVn0ZNe3ObWJGVremRY+o=; b=1oyXdCIhRmQi168h+T+5pDZ083RAdgAW43w3XyfFexdlnHUyYYMaBzlYp9NHr8vQscqYXn otvj1ib+xDOq5i+6TRiCa8OJXlvqIAe5IOG3nzwaH5zpaMly27WgSIKInv8pFw21wLiAlo PInb0ae9qZEr7nEl/7RMnLL5vywkqeoYv6wT8vpWJ0e5e+AcrKYVl7uI341emWz9PZn++u C+UrBHKEk0K5kGf3LMvhgBhsKsterqlsDusgvp0Rn6meisV3z9o0HIYaiHJttBGrnP9h1H NBOeSDR3CW9QVrUtDf2YSlwOACefjz2BIxZC5hGYVjSyeg4LXs3vE/s9YqO8Cw== From: Simon Wunderlich To: netdev@vger.kernel.org Cc: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , b.a.t.m.a.n@lists.open-mesh.org, Luxiao Xu , stable@kernel.org, Yuan Tan , Yifan Wu , Juefei Pu , Xin Liu , Ren Wei , Sven Eckelmann , Simon Wunderlich Subject: [PATCH net 01/14] batman-adv: fix tp_meter counter underflow during shutdown Date: Fri, 15 May 2026 11:55:26 +0200 Message-ID: <20260515095540.325586-2-sw@simonwunderlich.de> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260515095540.325586-1-sw@simonwunderlich.de> References: <20260515095540.325586-1-sw@simonwunderlich.de> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Luxiao Xu batadv_tp_sender_shutdown() unconditionally decrements the "sending" atomic counter. If multiple paths (e.g. timeout, user cancel, and normal finish) call this function, the counter can underflow to -1. Since the sender logic treats any non-zero value as "still sending", a negative value causes the sender kthread to loop indefinitely. This leads to a use-after-free when the interface is removed while the zombie thread is still active. Fix this by using atomic_xchg() to ensure the counter only transitions from 1 to 0 once. Fixes: 33a3bb4a3345 ("batman-adv: throughput meter implementation") Cc: stable@kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Luxiao Xu Signed-off-by: Ren Wei [sven: added missing change in batadv_tp_send] Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich --- net/batman-adv/tp_meter.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/batman-adv/tp_meter.c b/net/batman-adv/tp_meter.c index 066c76113fc43..a4397aa881dd4 100644 --- a/net/batman-adv/tp_meter.c +++ b/net/batman-adv/tp_meter.c @@ -451,7 +451,7 @@ static void batadv_tp_sender_end(struct batadv_priv *bat_priv, static void batadv_tp_sender_shutdown(struct batadv_tp_vars *tp_vars, enum batadv_tp_meter_reason reason) { - if (!atomic_dec_and_test(&tp_vars->sending)) + if (atomic_xchg(&tp_vars->sending, 0) != 1) return; tp_vars->reason = reason; @@ -885,7 +885,7 @@ static int batadv_tp_send(void *arg) "Meter: %s() cannot send packets (%d)\n", __func__, err); /* ensure nobody else tries to stop the thread now */ - if (atomic_dec_and_test(&tp_vars->sending)) + if (atomic_xchg(&tp_vars->sending, 0) == 1) tp_vars->reason = err; break; } -- 2.47.3