Hello: This series was applied to netdev/net.git (main) by Sven Eckelmann <[email protected]>:
On Fri, 15 May 2026 11:55:26 +0200 you wrote: > From: Luxiao Xu <[email protected]> > > batadv_tp_sender_shutdown() unconditionally decrements the "sending" > atomic counter. If multiple paths (e.g. timeout, user cancel, and > normal finish) call this function, the counter can underflow to -1. > > Since the sender logic treats any non-zero value as "still sending", > a negative value causes the sender kthread to loop indefinitely. > This leads to a use-after-free when the interface is removed while > the zombie thread is still active. > > [...] Here is the summary with links: - [net,01/14] batman-adv: fix tp_meter counter underflow during shutdown https://git.kernel.org/netdev/net/c/94f3b133168d - [net,02/14] batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown https://git.kernel.org/netdev/net/c/77098e4bea37 - [net,03/14] batman-adv: tt: reject oversized local TVLV buffers https://git.kernel.org/netdev/net/c/1e9fab756f83 - [net,04/14] batman-adv: tt: fix negative tt_buff_len https://git.kernel.org/netdev/net/c/b64963a2ceeb - [net,05/14] batman-adv: tt: fix negative last_changeset_len https://git.kernel.org/netdev/net/c/fc92cdfcb295 - [net,06/14] batman-adv: tt: fix TOCTOU race for reported vlans https://git.kernel.org/netdev/net/c/94d27005016b - [net,07/14] batman-adv: tt: avoid empty VLAN responses https://git.kernel.org/netdev/net/c/fa1bd704940b - [net,08/14] batman-adv: tt: prevent TVLV entry number overflow https://git.kernel.org/netdev/net/c/99d9958fa10f - [net,09/14] batman-adv: fix fragment reassembly length accounting https://git.kernel.org/netdev/net/c/9cd3f16c320b - [net,10/14] batman-adv: clear current gateway during teardown https://git.kernel.org/netdev/net/c/a340a51ed801 - [net,11/14] batman-adv: dat: handle forward allocation error https://git.kernel.org/netdev/net/c/2d8826a2d365 - [net,12/14] batman-adv: tp_meter: avoid use of uninit sender vars https://git.kernel.org/netdev/net/c/6c65cf23d4c6 - [net,13/14] batman-adv: frag: disallow unicast fragment in fragment https://git.kernel.org/netdev/net/c/bc62216dc8e2 - [net,14/14] batman-adv: tp_meter: directly shut down timer on cleanup https://git.kernel.org/netdev/net/c/d5487249a81e You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
