CVE-2025-21781

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: fix panic during interface removal

Reference counting is used to ensure that batadvhardifneighnode and batadvhardiface are not freed before/during batadvvelpthroughputmetricupdate work is finished.

But there isn't a guarantee that the hard if will remain associated with a soft interface up until the work is finished.

This fixes a crash triggered by reboot that looks like this:

Call trace: batadvvmeshfree+0xd0/0x4dc [batmanadv] batadvvelpthroughputmetricupdate+0x1c/0xa4 processonework+0x178/0x398 workerthread+0x2e8/0x4d0 kthread+0xd8/0xdc retfromfork+0x10/0x20

(the batadvvmesh_free call is misleading, and does not actually happen)

I was able to make the issue happen more reliably by changing hardifneigh->batv.metric_work work to be delayed work. This allowed me to track down and confirm the fix.

[sven@narfation.org: prevent entering batadvvelpgetthroughput without soft_iface]