--- /dev/null
+From: Felix Fietkau <nbd@nbd.name>
+Date: Wed, 15 Feb 2023 15:21:37 +0100
+Subject: [PATCH] wifi: mac80211: fix race in mesh sequence number
+ assignment
+
+Since the sequence number is shared across different tx queues, it needs
+to be atomic in order to avoid accidental duplicate assignment
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -695,7 +695,7 @@ struct ieee80211_if_mesh {
+ struct mesh_stats mshstats;
+ struct mesh_config mshcfg;
+ atomic_t estab_plinks;
+- u32 mesh_seqnum;
++ atomic_t mesh_seqnum;
+ bool accepting_plinks;
+ int num_gates;
+ struct beacon_data __rcu *beacon;
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -752,10 +752,8 @@ unsigned int ieee80211_new_mesh_header(s
+
+ meshhdr->ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
+
+- /* FIXME: racy -- TX on multiple queues can be concurrent */
+- put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &meshhdr->seqnum);
+- sdata->u.mesh.mesh_seqnum++;
+-
++ put_unaligned_le32(atomic_inc_return(&sdata->u.mesh.mesh_seqnum),
++ &meshhdr->seqnum);
+ if (addr4or5 && !addr6) {
+ meshhdr->flags |= MESH_FLAGS_AE_A4;
+ memcpy(meshhdr->eaddr1, addr4or5, ETH_ALEN);