Open-Mesh » batman-adv

is there a time-of-check to time-of-use (TOCTOU) race condition when determining whether to free the global translation table entry?

In batadv_tt_global_del(), the list lock is released inside batadv_tt_global_del_orig_node(). Afterward, an unprotected hlist_empty() check occurs:

net/batman-adv/translation-table.c:batadv_tt_global_del() {
        batadv_tt_global_del_orig_node(bat_priv, tt_global_entry,
                                       orig_node, message);
        if (hlist_empty(&tt_global_entry->orig_list))
                batadv_tt_global_free(bat_priv, tt_global_entry,
                                      message);
}

If Thread A releases the lock in batadv_tt_global_del_orig_node() and Thread B concurrently adds a new originator to the same entry via batadv_tt_global_add(), could Thread A evaluate a stale true from hlist_empty() and incorrectly remove the entry from the hash table?

A similar unprotected check occurs in batadv_tt_global_del_orig():

net/batman-adv/translation-table.c:batadv_tt_global_del_orig() {
        batadv_tt_global_del_orig_node(bat_priv, tt_global,
                                       orig_node, message);
        if (hlist_empty(&tt_global->orig_list)) {
                vid = tt_global->common.vid;
                ...
                hlist_del_rcu(&tt_common_entry->hash_entry);
                batadv_tt_global_entry_put(tt_global);
        }
}

See https://sashiko.dev/#/patchset/20260730-tt-fixes-v1-0-64e9e525d555%40narfation.org?part=1