| From: Felix Fietkau <nbd@nbd.name> |
| Date: Wed, 15 Feb 2023 15:21:37 +0100 |
| Subject: [PATCH] wifi: mac80211: fix race in mesh sequence number |
| assignment |
| |
| Since the sequence number is shared across different tx queues, it needs |
| to be atomic in order to avoid accidental duplicate assignment |
| |
| Signed-off-by: Felix Fietkau <nbd@nbd.name> |
| --- |
| |
| --- a/net/mac80211/ieee80211_i.h |
| +++ b/net/mac80211/ieee80211_i.h |
| @@ -696,7 +696,7 @@ struct ieee80211_if_mesh { |
| struct mesh_stats mshstats; |
| struct mesh_config mshcfg; |
| atomic_t estab_plinks; |
| - u32 mesh_seqnum; |
| + atomic_t mesh_seqnum; |
| bool accepting_plinks; |
| int num_gates; |
| struct beacon_data __rcu *beacon; |
| --- a/net/mac80211/mesh.c |
| +++ b/net/mac80211/mesh.c |
| @@ -752,10 +752,8 @@ unsigned int ieee80211_new_mesh_header(s |
| |
| meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL; |
| |
| - /* FIXME: racy -- TX on multiple queues can be concurrent */ |
| - put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &meshhdr->seqnum); |
| - sdata->u.mesh.mesh_seqnum++; |
| - |
| + put_unaligned_le32(atomic_inc_return(&sdata->u.mesh.mesh_seqnum), |
| + &meshhdr->seqnum); |
| if (addr4or5 && !addr6) { |
| meshhdr->flags |= MESH_FLAGS_AE_A4; |
| memcpy(meshhdr->eaddr1, addr4or5, ETH_ALEN); |