Re: [PATCH wireless 1/1] wifi: mac80211: fix mesh fast xmit path deletion UAF

[Johannes Berg <johannes@sipsolutions.net>]

On Tue, 2026-09-08 at 06:28 +0000, Zihan Xi wrote:
> mesh_fast_tx_cache() stores raw mesh_path pointers in a persistent
> fast-xmit cache entry. Path deletion flushes currently visible cache
> entries and then schedules the path for RCU freeing, but a sender that
> already holds the path in an RCU read-side section can insert a new
> entry after that flush. Once the lookup RCU section ends, the path is
> freed while the new cache entry still points at it. A later
> mesh_fast_tx_get() then dereferences the freed flags, expiry, or
> next_hop fields.
> 
> Mark the path MESH_PATH_DELETED before flushing the cache, and reject
> cache insertion if the mesh path or optional MPP path was deleted while
> the entry was being built. The cache walk lock orders this check with
> deletion flush, so entries inserted before the flush are removed and
> later entries are not cached.
> 
> The crash path is ieee80211_mesh_xmit_fast() -> mesh_fast_tx_get().
> The same cache is also consumed by ieee80211_rx_mesh_fast_forward(),
> so the deletion tombstone covers both consumers.

What? You need to start writing your own commit messages.

johannes