Commit e626dad9 authored Mar 14, 2023 by Felix Fietkau Committed by Johannes Berg Mar 22, 2023

wifi: mac80211: fix race in mesh sequence number assignment



Since the sequence number is shared across different tx queues, it needs
to be atomic in order to avoid accidental duplicate assignment

Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/20230314095956.62085-2-nbd@nbd.name


Signed-off-by: Johannes Berg <johannes.berg@intel.com>

parent 61587f15

net/mac80211/ieee80211_i.h

+1 −1

Original line number	Diff line number	Diff line
		@@ -696,7 +696,7 @@ struct ieee80211_if_mesh {
		struct mesh_stats mshstats;
		struct mesh_config mshcfg;
		atomic_t estab_plinks;
		u32 mesh_seqnum;
		atomic_t mesh_seqnum;
		bool accepting_plinks;
		int num_gates;
		struct beacon_data __rcu *beacon;

net/mac80211/mesh.c

+2 −4

Original line number	Diff line number	Diff line
		@@ -752,10 +752,8 @@ unsigned int ieee80211_new_mesh_header(struct ieee80211_sub_if_data *sdata,

		meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;

		/* FIXME: racy -- TX on multiple queues can be concurrent */
		put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &meshhdr->seqnum);
		sdata->u.mesh.mesh_seqnum++;

		put_unaligned_le32(atomic_inc_return(&sdata->u.mesh.mesh_seqnum),
		&meshhdr->seqnum);
		if (addr4or5 && !addr6) {
		meshhdr->flags \|= MESH_FLAGS_AE_A4;
		memcpy(meshhdr->eaddr1, addr4or5, ETH_ALEN);