Bug #440
opentt: potential update of common.flags by multiple callers
0%
Description
Does the code in batadv_tt_local_add allow concurrent unprotected updates to tt_local->common.flags and tt_global->common.flags?
Because batadv_interface_tx (the ndo_start_xmit handler) is configured with lltx = true, it executes without the netdev tx lock. This could allow multiple CPUs processing outgoing packets from the same client MAC to call batadv_tt_local_add() concurrently.
A concurrent execution could cause one CPU to overwrite the flag updates of another via non-atomic read-modify-write operations (|= and &=). For example, if CPU A clears the BATADV_TT_CLIENT_ROAM flag while CPU B simultaneously sets the BATADV_TT_CLIENT_WIFI flag, could the ROAM flag clearance be permanently lost, leaving the client stuck in an incorrect roaming state?
See https://sashiko.dev/#/patchset/20260603072527.174487-1-sw@simonwunderlich.de?part=15
Updated by Sven Eckelmann 4 months ago
- Is duplicate of Bug #404: KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_add added
Updated by Sven Eckelmann 4 months ago
RFC can be found at https://patchwork.open-mesh.org/project/b.a.t.m.a.n./list/?series=763
Updated by Sven Eckelmann 3 months ago
- Status changed from New to Resolved
- Target version set to 2026.3
Updated by Sven Eckelmann 2 months ago
- Status changed from Resolved to In Progress
- Assignee changed from Antonio Quartulli to batman-adv developers
- Target version deleted (
2026.3)
Was rejected by the netdev maintainers because they want it implemented using spinlocks.
Updated by Sven Eckelmann 2 months ago
A new approach (with spinlocks) was posted here: https://patchwork.open-mesh.org/project/b.a.t.m.a.n./list/?series=851