| developer | e0a1e0e | 2023-02-24 11:26:12 +0800 | [diff] [blame] | 1 | From: Felix Fietkau <nbd@nbd.name> |
| 2 | Date: Wed, 15 Feb 2023 15:21:37 +0100 |
| 3 | Subject: [PATCH] wifi: mac80211: fix race in mesh sequence number |
| 4 | assignment |
| 5 | |
| 6 | Since the sequence number is shared across different tx queues, it needs |
| 7 | to be atomic in order to avoid accidental duplicate assignment |
| 8 | |
| 9 | Signed-off-by: Felix Fietkau <nbd@nbd.name> |
| 10 | --- |
| 11 | |
| 12 | --- a/net/mac80211/ieee80211_i.h |
| 13 | +++ b/net/mac80211/ieee80211_i.h |
| developer | 08748a4 | 2023-04-21 11:17:26 +0800 | [diff] [blame] | 14 | @@ -696,7 +696,7 @@ struct ieee80211_if_mesh { |
| developer | e0a1e0e | 2023-02-24 11:26:12 +0800 | [diff] [blame] | 15 | struct mesh_stats mshstats; |
| 16 | struct mesh_config mshcfg; |
| 17 | atomic_t estab_plinks; |
| 18 | - u32 mesh_seqnum; |
| 19 | + atomic_t mesh_seqnum; |
| 20 | bool accepting_plinks; |
| 21 | int num_gates; |
| 22 | struct beacon_data __rcu *beacon; |
| 23 | --- a/net/mac80211/mesh.c |
| 24 | +++ b/net/mac80211/mesh.c |
| 25 | @@ -752,10 +752,8 @@ unsigned int ieee80211_new_mesh_header(s |
| 26 | |
| 27 | meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL; |
| 28 | |
| 29 | - /* FIXME: racy -- TX on multiple queues can be concurrent */ |
| 30 | - put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &meshhdr->seqnum); |
| 31 | - sdata->u.mesh.mesh_seqnum++; |
| 32 | - |
| 33 | + put_unaligned_le32(atomic_inc_return(&sdata->u.mesh.mesh_seqnum), |
| 34 | + &meshhdr->seqnum); |
| 35 | if (addr4or5 && !addr6) { |
| 36 | meshhdr->flags |= MESH_FLAGS_AE_A4; |
| 37 | memcpy(meshhdr->eaddr1, addr4or5, ETH_ALEN); |