dropbear: Fix CVE-2020-36254
[openwrt/openwrt.git] / package / kernel / mac80211 / patches / subsys / 372-mac80211-fix-station-rate-table-updates-on-assoc.patch
1 From 1d3a84f92f75bb0c2f981a75f507f55afed12f2c Mon Sep 17 00:00:00 2001
2 From: Felix Fietkau <nbd@nbd.name>
3 Date: Mon, 1 Feb 2021 09:33:24 +0100
4 Subject: [PATCH] mac80211: fix station rate table updates on assoc
5
6 commit 18fe0fae61252b5ae6e26553e2676b5fac555951 upstream.
7
8 If the driver uses .sta_add, station entries are only uploaded after the sta
9 is in assoc state. Fix early station rate table updates by deferring them
10 until the sta has been uploaded.
11
12 Cc: stable@vger.kernel.org
13 Signed-off-by: Felix Fietkau <nbd@nbd.name>
14 Link: https://lore.kernel.org/r/20210201083324.3134-1-nbd@nbd.name
15 [use rcu_access_pointer() instead since we won't dereference here]
16 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
17 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
18 ---
19 net/mac80211/driver-ops.c | 5 ++++-
20 net/mac80211/rate.c | 3 ++-
21 2 files changed, 6 insertions(+), 2 deletions(-)
22
23 --- a/net/mac80211/driver-ops.c
24 +++ b/net/mac80211/driver-ops.c
25 @@ -128,8 +128,11 @@ int drv_sta_state(struct ieee80211_local
26 } else if (old_state == IEEE80211_STA_AUTH &&
27 new_state == IEEE80211_STA_ASSOC) {
28 ret = drv_sta_add(local, sdata, &sta->sta);
29 - if (ret == 0)
30 + if (ret == 0) {
31 sta->uploaded = true;
32 + if (rcu_access_pointer(sta->sta.rates))
33 + drv_sta_rate_tbl_update(local, sdata, &sta->sta);
34 + }
35 } else if (old_state == IEEE80211_STA_ASSOC &&
36 new_state == IEEE80211_STA_AUTH) {
37 drv_sta_remove(local, sdata, &sta->sta);
38 --- a/net/mac80211/rate.c
39 +++ b/net/mac80211/rate.c
40 @@ -941,7 +941,8 @@ int rate_control_set_rates(struct ieee80
41 if (old)
42 kfree_rcu(old, rcu_head);
43
44 - drv_sta_rate_tbl_update(hw_to_local(hw), sta->sdata, pubsta);
45 + if (sta->uploaded)
46 + drv_sta_rate_tbl_update(hw_to_local(hw), sta->sdata, pubsta);
47
48 ieee80211_sta_set_expected_throughput(pubsta, sta_get_expected_throughput(sta));
49