Re: [PATCH] mac80211: protect rx-path with spinlock

[Johannes Berg <johannes@sipsolutions.net>]

On Mon, 2013-02-04 at 17:44 +0000, Christian Lamparter wrote:
> This patch fixes the problem which was discussed in
> "mac80211: Fix PN corruption in case of multiple
> virtual interface" [1].
> 
> Amit Shakya reported a serious issue with my patch:
> mac80211: serialize rx path workers" [2]:
> 
> In case, ieee80211_rx_handlers processing is going on
> for skbs received on one vif and at the same time, rx
> aggregation reorder timer expires on another vif then
> sta_rx_agg_reorder_timer_expired is invoked and it will
> push skbs into the single queue (local->rx_skb_queue).
> 
> ieee80211_rx_handlers in the while loop assumes that
> the skbs are for the same sdata and sta. This assumption
> doesn't hold good in this scenario and the PN gets
> corrupted by PN received in other vif's skb, causing
> traffic to stop due to PN mismatch."

Applied. It's kinda late in the merge window, so I'm not pushing it for
3.8 any more, since very few people seem to have noticed this issue.

If needed, somebody else can champion it for stable :-)

johannes