Open-Mesh » batman-adv

We got another Sashiko report which needs to be checked. It is about the order of free calls in the batadv_mesh_free destructor:

Does the order of these free calls create a use-after-free race condition?

batadv_tt_free() frees the translation table hashes (bat_priv->tt.global_hash), but the originator workqueue isn't synced and stopped until batadv_originator_free() is executed.
If the orig_work delayed work runs concurrently, it executes batadv_purge_orig_ref(), which calls batadv_tt_global_del_orig(). This accesses and locks buckets from global_hash:

net/batman-adv/translation-table.c:batadv_tt_global_del_orig() {
    struct batadv_hashtable *hash = bat_priv->tt.global_hash;
    ...
    if (!hash)
        return;
    for (i = 0; i < hash->size; i++) {
        head = &hash->table[i];
        list_lock = &hash->list_locks[i];
        spin_lock_bh(list_lock);
    ...
}

Could this lead to a panic or memory corruption if batadv_tt_global_del_orig() dereferences global_hash while it is being destroyed by batadv_tt_free()?

See https://sashiko.dev/#/patchset/20260708091821.314516-1-sw%40simonwunderlich.de