* [PATCH batadv 1/1] batman-adv: fix tp_meter counter underflow during shutdown [not found] <cover.1778118303.git.rakukuip@gmail.com> @ 2026-05-07 15:49 ` Ren Wei 2026-05-07 20:56 ` Sven Eckelmann 0 siblings, 1 reply; 2+ messages in thread From: Ren Wei @ 2026-05-07 15:49 UTC (permalink / raw) To: b.a.t.m.a.n, netdev Cc: marek.lindner, sw, antonio, sven, yuantan098, yifanwucs, tomapufckgml, bird, rakukuip, n05ec From: Luxiao Xu <rakukuip@gmail.com> batadv_tp_sender_shutdown() unconditionally decrements the "sending" atomic counter. If multiple paths (e.g. timeout, user cancel, and normal finish) call this function, the counter can underflow to -1. Since the sender logic treats any non-zero value as "still sending", a negative value causes the sender kthread to loop indefinitely. This leads to a use-after-free when the interface is removed while the zombie thread is still active. Fix this by using atomic_xchg() to ensure the counter only transitions from 1 to 0 once. Fixes: 33a3bb4a3345 ("batman-adv: throughput meter implementation") Cc: stable@kernel.org Reported-by: Yuan Tan <yuantan098@gmail.com> Reported-by: Yifan Wu <yifanwucs@gmail.com> Reported-by: Juefei Pu <tomapufckgml@gmail.com> Reported-by: Xin Liu <bird@lzu.edu.cn> Signed-off-by: Luxiao Xu <rakukuip@gmail.com> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn> --- net/batman-adv/tp_meter.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/batman-adv/tp_meter.c b/net/batman-adv/tp_meter.c index 2e42f6b348c8..4c582443f67c 100644 --- a/net/batman-adv/tp_meter.c +++ b/net/batman-adv/tp_meter.c @@ -435,7 +435,7 @@ static void batadv_tp_sender_end(struct batadv_priv *bat_priv, static void batadv_tp_sender_shutdown(struct batadv_tp_vars *tp_vars, enum batadv_tp_meter_reason reason) { - if (!atomic_dec_and_test(&tp_vars->sending)) + if (atomic_xchg(&tp_vars->sending, 0) != 1) return; tp_vars->reason = reason; -- 2.43.0 ^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH batadv 1/1] batman-adv: fix tp_meter counter underflow during shutdown 2026-05-07 15:49 ` [PATCH batadv 1/1] batman-adv: fix tp_meter counter underflow during shutdown Ren Wei @ 2026-05-07 20:56 ` Sven Eckelmann 0 siblings, 0 replies; 2+ messages in thread From: Sven Eckelmann @ 2026-05-07 20:56 UTC (permalink / raw) To: Ren Wei Cc: b.a.t.m.a.n, netdev, marek.lindner, sw, antonio, sven, yuantan098, yifanwucs, tomapufckgml, bird, rakukuip On Thu, 07 May 2026 23:49:46 +0800, Ren Wei <n05ec@lzu.edu.cn> wrote: > diff --git a/net/batman-adv/tp_meter.c b/net/batman-adv/tp_meter.c > index 2e42f6b348c8..4c582443f67c 100644 > --- a/net/batman-adv/tp_meter.c > +++ b/net/batman-adv/tp_meter.c > @@ -435,7 +435,7 @@ static void batadv_tp_sender_end(struct batadv_priv *bat_priv, > static void batadv_tp_sender_shutdown(struct batadv_tp_vars *tp_vars, > enum batadv_tp_meter_reason reason) > { > - if (!atomic_dec_and_test(&tp_vars->sending)) > + if (atomic_xchg(&tp_vars->sending, 0) != 1) > return; > > tp_vars->reason = reason; What about: /* ensure nobody else tries to stop the thread now */ if (atomic_dec_and_test(&tp_vars->sending)) tp_vars->reason = err; break; in batadv_tp_send()? If shutdown is called and then batadv_tp_send reaches this part, isn't this also ending up at -1? Regarding the netdev mail situation: Please don't send it to netdev@vger.kernel.org directly - they want us to first handle it internally before forwarding it later to netdev. This should reduce the patch volume for them. There is already a change to the MAINTAINERS file to remove the batman-adv paths from the NETWORKING section (netdev@....) queued up - but it was not yet forwarded to net-next (and I am just wondering whether I should ask Simon to directly submit it to net). Regards, Sven -- Sven Eckelmann <sven@narfation.org> ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-05-07 20:57 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <cover.1778118303.git.rakukuip@gmail.com>
2026-05-07 15:49 ` [PATCH batadv 1/1] batman-adv: fix tp_meter counter underflow during shutdown Ren Wei
2026-05-07 20:56 ` Sven Eckelmann
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox