Re: [PATCH] mac80211: protect rx-path with spinlock

[Christian Lamparter <chunkeey@googlemail.com>]

On Friday 08 February 2013 22:36:17 Johannes Berg wrote:
> On Mon, 2013-02-04 at 17:44 +0000, Christian Lamparter wrote:
> > This patch fixes the problem which was discussed in
> > "mac80211: Fix PN corruption in case of multiple
> > virtual interface" [1].
> > 
> > Amit Shakya reported a serious issue with my patch:
> > mac80211: serialize rx path workers" [2]:
> > 
> > In case, ieee80211_rx_handlers processing is going on
> > for skbs received on one vif and at the same time, rx
> > aggregation reorder timer expires on another vif then
> > sta_rx_agg_reorder_timer_expired is invoked and it will
> > push skbs into the single queue (local->rx_skb_queue).
> > 
> > ieee80211_rx_handlers in the while loop assumes that
> > the skbs are for the same sdata and sta. This assumption
> > doesn't hold good in this scenario and the PN gets
> > corrupted by PN received in other vif's skb, causing
> > traffic to stop due to PN mismatch."
> 
> Applied. It's kinda late in the merge window, so I'm not
> pushing it for 3.8 any more, since very few people seem
> to have noticed this issue.
> 
> If needed, somebody else can champion it for stable :-)
That's most likely because BARs should actually take care
of releasing stuck frames anyway. The release timer is there
just in case the BAR which would release the ampdu reorder
buffer is also lost.

Regards,
	Christian