FAILED: patch "[PATCH] batman-adv: stop tp_meter sessions during mesh teardown" failed to apply to 5.10-stable tree

The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x 3d3cf6a7314aca4df0a6dde28ce784a2a30d0166
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026051555-germproof-bolt-6720@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^..

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 3d3cf6a7314aca4df0a6dde28ce784a2a30d0166 Mon Sep 17 00:00:00 2001
From: Jiexun Wang <[email protected]>
Date: Mon, 27 Apr 2026 14:43:34 +0800
Subject: [PATCH] batman-adv: stop tp_meter sessions during mesh teardown

TP meter sessions remain linked on bat_priv->tp_list after the netlink request has already finished. When the mesh interface is removed, batadv_mesh_free() currently tears down the mesh without first draining these sessions.

A running sender thread or a late incoming tp_meter packet can then keep processing against a mesh instance which is already shutting down. Synchronize tp_meter with the mesh lifetime by stopping all active sessions from batadv_mesh_free() and waiting for sender threads to exit before teardown continues.

index 3a35aadd8b41..a4d33ee0fda5 100644
@@ -249,6 +249,7 @@ void batadv_mesh_free(struct net_device *mesh_iface)
 	atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
 
 	batadv_purge_outstanding_packets(bat_priv, NULL);
+	batadv_tp_stop_all(bat_priv);
 
 	batadv_gw_node_free(bat_priv);
 

index f0046d366eac..4e97cd10cd02 100644
@@ -17,6 +17,7 @@ void batadv_tp_start(struct batadv_priv *bat_priv, const u8 *dst,
 		     u32 test_length, u32 *cookie);
 void batadv_tp_stop(struct batadv_priv *bat_priv, const u8 *dst,
 		    u8 return_value);
+void batadv_tp_stop_all(struct batadv_priv *bat_priv);
 void batadv_tp_meter_recv(struct batadv_priv *bat_priv, struct sk_buff *skb);
 
 #endif /* _NET_BATMAN_ADV_TP_METER_H_ */

index 8fc5fe0e9b05..daa06f421154 100644
@@ -14,6 +14,7 @@
 #include <linux/average.h>
 #include <linux/bitops.h>
 #include <linux/compiler.h>
+#include <linux/completion.h>
 #include <linux/if.h>
 #include <linux/if_ether.h>
 #include <linux/kref.h>

@@ -1328,6 +1329,9 @@ struct batadv_tp_vars {
 	/** @finish_work: work item for the finishing procedure */
 	struct delayed_work finish_work;
 
+	/** @finished: completion signaled when a sender thread exits */
+	struct completion finished;
+
 	/** @test_length: test length in milliseconds */
 	u32 test_length;
 

I had a look at it but it would need get a backport of timer_shutdown_sync for the original patch. Then the version from 5.15 should work directly.

But when I've looked into the patches. I saw that there is a big gap already between 5.10 and 5.15.

Already backported in 5.15 (and could be used as reference for 5.10)

b0b0aa5d858d ("Documentation: Remove bogus claim about del_timer_sync()")
80b55772d41d ("ARM: spear: Do not use timer namespace for timer_shutdown() function") 5135c7150732 ("clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function") 6e1fc2591f11 ("clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function") 82ed6f7ef58f ("timers: Replace BUG_ON()s")
2249b9ec4232 ("Documentation: Replace del_timer/del_timer_sync()")
d02e382cef06 ("timers: Silently ignore timers with a NULL function")
8553b5f2774a ("timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode") 0cc04e80458a ("timers: Add shutdown mechanism to the internal functions")
f571faf6e443 ("timers: Provide timer_shutdown[_sync]()")
a31323bef2b6 ("timers: Update the documentation to reflect on the new timer_shutdown() API") 20739af07383 ("timers: Fix NULL function pointer race in timer_shutdown_sync()")

But between 5.10 and 5.15 are 134 patches which at least partially should be relevant for the backporting of timer_shutdown_sync.

For the moment, I will skip the backporting of timer_shutdown_sync and switch it to del_timer_sync() - which should work here because the re-arming will only happen by the timer.

Regards,
Sven

Seems reasonable, thanks!

greg k-h

From: Jiexun Wang <[email protected]>

commit 3d3cf6a7314aca4df0a6dde28ce784a2a30d0166 upstream.

TP meter sessions remain linked on bat_priv->tp_list after the netlink request has already finished. When the mesh interface is removed, batadv_mesh_free() currently tears down the mesh without first draining these sessions.

A running sender thread or a late incoming tp_meter packet can then keep processing against a mesh instance which is already shutting down. Synchronize tp_meter with the mesh lifetime by stopping all active sessions from batadv_mesh_free() and waiting for sender threads to exit before teardown continues.

---
 net/batman-adv/main.c     |  1 +
 net/batman-adv/tp_meter.c | 94 +++++++++++++++++++++++++++++++--------
 net/batman-adv/tp_meter.h |  1 +
 net/batman-adv/types.h    |  4 ++
 4 files changed, 82 insertions(+), 18 deletions(-)

index d9719d807d6a..70c373f5572e 100644
@@ -269,6 +269,7 @@ void batadv_mesh_free(struct net_device *soft_iface)
 	atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
 
 	batadv_purge_outstanding_packets(bat_priv, NULL);
+	batadv_tp_stop_all(bat_priv);
 
 	batadv_gw_node_free(bat_priv);
 

index 140105215aa2..76a1a28400cb 100644
@@ -17,6 +17,7 @@ void batadv_tp_start(struct batadv_priv *bat_priv, const u8 *dst,
 		     u32 test_length, u32 *cookie);
 void batadv_tp_stop(struct batadv_priv *bat_priv, const u8 *dst,
 		    u8 return_value);
+void batadv_tp_stop_all(struct batadv_priv *bat_priv);
 void batadv_tp_meter_recv(struct batadv_priv *bat_priv, struct sk_buff *skb);
 
 #endif /* _NET_BATMAN_ADV_TP_METER_H_ */

index cc3334afbdd0..0c34b57e156c 100644
@@ -14,6 +14,7 @@
 #include <linux/average.h>
 #include <linux/bitops.h>
 #include <linux/compiler.h>
+#include <linux/completion.h>
 #include <linux/if.h>
 #include <linux/if_ether.h>
 #include <linux/kref.h>

@@ -1413,6 +1414,9 @@ struct batadv_tp_vars {
 	/** @finish_work: work item for the finishing procedure */
 	struct delayed_work finish_work;
 
+	/** @finished: completion signaled when a sender thread exits */
+	struct completion finished;
+
 	/** @test_length: test length in milliseconds */
 	u32 test_length;
 

2.47.3