1:  2ec32034914c ! 1:  53979cf60fa2 wifi: mac80211: fix mesh fast xmit path deletion UAF
    @@ Commit message
     
         Set MESH_PATH_DELETED before flushing, and skip inserting a cache
         entry if the path or MPP path is already deleted. Check this under
    -    the cache walk lock so it is ordered with the flush.
    +    the cache walk lock so it is ordered with the flush. Use WRITE_ONCE()
    +    for the deletion flag updates because the cache check reads flags
    +    without taking state_lock.
     
         Fixes: d5edb9ae8d56 ("wifi: mac80211: mesh fast xmit support")
         Cc: stable@vger.kernel.org
    @@ net/mac80211/mesh_pathtbl.c: void mesh_fast_tx_cache(struct ieee80211_sub_if_dat
      	prev = rhashtable_lookup_get_insert_fast(&cache->rht,
      						 &entry->rhash,
      						 fast_tx_rht_params);
    +@@ net/mac80211/mesh_pathtbl.c: static void mesh_path_free_rcu(struct mesh_table *tbl,
    + 	struct ieee80211_sub_if_data *sdata = mpath->sdata;
    + 
    + 	spin_lock_bh(&mpath->state_lock);
    +-	mpath->flags |= MESH_PATH_RESOLVING | MESH_PATH_DELETED;
    ++	WRITE_ONCE(mpath->flags,
    ++		   mpath->flags | MESH_PATH_RESOLVING | MESH_PATH_DELETED);
    + 	mesh_gate_del(tbl, mpath);
    + 	spin_unlock_bh(&mpath->state_lock);
    + 	timer_shutdown_sync(&mpath->timer);
     @@ net/mac80211/mesh_pathtbl.c: static void __mesh_path_del(struct mesh_table *tbl, struct mesh_path *mpath)
      {
      	hlist_del_rcu(&mpath->walk_list);
      	rhashtable_remove_fast(&tbl->rhead, &mpath->rhash, mesh_rht_params);
     +	spin_lock_bh(&mpath->state_lock);
    -+	mpath->flags |= MESH_PATH_DELETED;
    ++	WRITE_ONCE(mpath->flags, mpath->flags | MESH_PATH_DELETED);
     +	spin_unlock_bh(&mpath->state_lock);
      	if (tbl == &mpath->sdata->u.mesh.mpp_paths)
      		mesh_fast_tx_flush_addr(mpath->sdata, mpath->dst);