X-Git-Url: http://git.openwrt.org/?a=blobdiff_plain;f=package%2Fkernel%2Fmac80211%2Fpatches%2Fsubsys%2F318-wifi-mac80211-fix-race-in-mesh-sequence-number-assig.patch;fp=package%2Fkernel%2Fmac80211%2Fpatches%2Fsubsys%2F318-wifi-mac80211-fix-race-in-mesh-sequence-number-assig.patch;h=05e368cd2ede96b9a77579e5d4e844fcf80ee1b0;hb=57db2280a2155c39f545ac712766a849cf45f62c;hp=0000000000000000000000000000000000000000;hpb=7ae4716243dda59bcff21ba0ee704322b2db10f4;p=openwrt%2Fstaging%2Faparcar.git

diff --git a/package/kernel/mac80211/patches/subsys/318-wifi-mac80211-fix-race-in-mesh-sequence-number-assig.patch b/package/kernel/mac80211/patches/subsys/318-wifi-mac80211-fix-race-in-mesh-sequence-number-assig.patch
new file mode 100644
index 0000000000..05e368cd2e
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/318-wifi-mac80211-fix-race-in-mesh-sequence-number-assig.patch
@@ -0,0 +1,37 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 15 Feb 2023 15:21:37 +0100
+Subject: [PATCH] wifi: mac80211: fix race in mesh sequence number
+ assignment
+
+Since the sequence number is shared across different tx queues, it needs
+to be atomic in order to avoid accidental duplicate assignment
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -695,7 +695,7 @@ struct ieee80211_if_mesh {
+ 	struct mesh_stats mshstats;
+ 	struct mesh_config mshcfg;
+ 	atomic_t estab_plinks;
+-	u32 mesh_seqnum;
++	atomic_t mesh_seqnum;
+ 	bool accepting_plinks;
+ 	int num_gates;
+ 	struct beacon_data __rcu *beacon;
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -752,10 +752,8 @@ unsigned int ieee80211_new_mesh_header(s
+ 
+ 	meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
+ 
+-	/* FIXME: racy -- TX on multiple queues can be concurrent */
+-	put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &meshhdr->seqnum);
+-	sdata->u.mesh.mesh_seqnum++;
+-
++	put_unaligned_le32(atomic_inc_return(&sdata->u.mesh.mesh_seqnum),
++			   &meshhdr->seqnum);
+ 	if (addr4or5 && !addr6) {
+ 		meshhdr->flags |= MESH_FLAGS_AE_A4;
+ 		memcpy(meshhdr->eaddr1, addr4or5, ETH_ALEN);