diff options
| author | Catherine <enderaoelyther@gmail.com> | 2026-04-24 16:14:36 +0300 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-04-27 13:41:55 +0300 |
| commit | 7a5b81e0c87a075afd572f659d8eb68c9c4cd2ba (patch) | |
| tree | 8307b45b1dc8fe34318eff63ad812173f9fcf306 | |
| parent | 9b55d5c1f5e481e391957f9096d798ca331c461b (diff) | |
| download | linux-7a5b81e0c87a075afd572f659d8eb68c9c4cd2ba.tar.xz | |
wifi: mac80211: drop stray 'static' from fast-RX rx_result
ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but
its per-invocation rx_result is declared static. Concurrent callers then
share one instance and can overwrite each other's result between
ieee80211_rx_mesh_data() and the switch on res.
That can make a packet that was queued or consumed by
ieee80211_rx_mesh_data() fall through into ieee80211_rx_8023(), or make
a packet that should continue return as queued.
Make res an automatic variable so each invocation keeps its own result.
Fixes: 3468e1e0c639 ("wifi: mac80211: add mesh fast-rx support")
Cc: stable@vger.kernel.org
Signed-off-by: Catherine <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260424131435.83212-2-enderaoelyther@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | net/mac80211/rx.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 5a92413a911f..d18e962126ce 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -4971,7 +4971,7 @@ static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx, struct sk_buff *skb = rx->skb; struct ieee80211_hdr *hdr = (void *)skb->data; struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); - static ieee80211_rx_result res; + ieee80211_rx_result res; int orig_len = skb->len; int hdrlen = ieee80211_hdrlen(hdr->frame_control); int snap_offs = hdrlen; |