Open-Mesh » batman-adv

tp_vars->last_recv is read without synchronization. If duplicate or reordered packets are processed concurrently on multiple CPU cores, both cores might bypass the out-of-order check and concurrently execute:

tp_vars->last_recv += packet_size;

Could this double-count payload bytes and permanently corrupt the receiver state machine? Note that while a later patch introduces locking for sender variables, receiver-side variables like last_recv appear to remain unguarded.

See https://sashiko.dev/#/patchset/20260603072527.174487-1-sw@simonwunderlich.de?part=3