In the Linux kernel, the following vulnerability has been resolved:

batman-adv: bla: avoid double decrement of bla.numrequests

The bla.numrequests is increased when no requestsent was in progress. And it is decremented in various places (announcement was received, backbone is purged, periodic work). But the check if the requestsent is actually set to a specific state and the atomicdec/inc are not safe because they are not atomic (TOCTOU) and multiple such code portions can run concurrently.

At the same time, it is necessary to modify requestsent (state) and bla.numrequests atomically. Otherwise batadvblasendrequest() might set requestsent to 1 and is interrupted. batadvhandleannounce() can then set requestsent back to 0 and decrement numrequests before batadvblasendrequest() incremented it.

The two operations must therefore be locked. And since state (requestsent) and waitperiods are only accessed inside this lock, they can be converted to simpler datatypes. And to avoid that the bla.numrequests is touched by a parallel running context with a valid backbonegw reference after batadvblapurgebackbonegw() ran, a third state "stopped" is required to correctly signal that a backbonegw is in the state of being cleaned up.