From f89eda5a9ccf82cba06b085b42ebc4886b8dfe9e Mon Sep 17 00:00:00 2001 From: Sven Eckelmann Date: Thu, 8 Oct 2026 18:29:16 +0200 Subject: [PATCH] batman-adv: stop originator purge worker before freeing TT batadv_mesh_free() releases the translation tables via batadv_tt_free() before batadv_originator_free() stops orig_work. The purge worker can therefore still run while the TT is torn down. When an originator times out, batadv_purge_orig_ref() calls batadv_tt_global_del_orig(), which loads tt.global_hash and walks all buckets while taking their locks: CPU0 CPU1 batadv_tt_free() batadv_purge_orig() batadv_tt_global_del_orig() hash = ...tt.global_hash; batadv_tt_global_table_free() batadv_hash_destroy(hash); spin_lock_bh(&hash->list_locks[i]); Disable orig_work at the beginning of batadv_mesh_free(), directly after the mesh was marked as deactivating. The second disable_delayed_work_sync() in batadv_originator_free() is harmless because it is free'd anyway. Cc: stable@vger.kernel.org Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260708091821.314516-1-sw%40simonwunderlich.de?part=3 Fixes: 9d31b3ce8168 ("batman-adv: fix potential TT client + orig-node memory leak") Signed-off-by: Sven Eckelmann --- net/batman-adv/main.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c index ced76942f33c..3b9fa861be7b 100644 --- a/net/batman-adv/main.c +++ b/net/batman-adv/main.c @@ -295,6 +295,11 @@ void batadv_mesh_free(struct net_device *mesh_iface) WRITE_ONCE(bat_priv->mesh_state, BATADV_MESH_DEACTIVATING); + /* the originator purge worker accesses (among others) the TT tables + * and must therefore be stopped before any of them are freed + */ + disable_delayed_work_sync(&bat_priv->orig_work); + batadv_purge_outstanding_packets(bat_priv, NULL); batadv_tp_stop_all(bat_priv);