Re: [PATCH] fix: net/batman-adv: batadv_interface_kill_vid: extra batadv_meshif_vlan_put after destroy

[WenTao Liang]

> 2026年6月27日 11:46，WenTao Liang <vulab@xxxxxxxxxxx> 写道：
> 
> In batadv_interface_kill_vid(), batadv_meshif_vlan_get() acquires a
> reference on the vlan object. batadv_meshif_destroy_vlan() internally
> calls batadv_meshif_vlan_put() which balances that reference. However, an
> additional batadv_meshif_vlan_put(vlan) is called after
> batadv_meshif_destroy_vlan(), causing a refcount underflow and potential
> use-after-free of the vlan object.
> 
> Remove the extra batadv_meshif_vlan_put(vlan) call.
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: 5d2c05b21337 ("batman-adv: add per VLAN interface attribute framework")
> Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
> ---
> net/batman-adv/mesh-interface.c | 3 ---
> 1 file changed, 3 deletions(-)
> 
> diff --git a/net/batman-adv/mesh-interface.c b/net/batman-adv/mesh-interface.c
> index e7aa45bc6b7a..cc974f243200 100644
> --- a/net/batman-adv/mesh-interface.c
> +++ b/net/batman-adv/mesh-interface.c
> @@ -691,9 +691,6 @@ static int batadv_interface_kill_vid(struct net_device *dev, __be16 proto,
> 
> 	batadv_meshif_destroy_vlan(bat_priv, vlan);
> 
> -	/* finally free the vlan object */
> -	batadv_meshif_vlan_put(vlan);
> -
> 	return 0;
> }
> 
> -- 
> 2.39.5 (Apple Git-154)

Please ignore this patch. I will resend a proper version after
learning the kernel submission process.

Apologies for the noise.

Best regards,
WenTao Liang