package/kernel/mac80211/patches/subsys/332-wifi-mac80211-check-clear-fast-rx-for-non-4addr-sta-.patch

   1 From: Felix Fietkau <nbd@nbd.name>
   2 Date: Sat, 16 Mar 2024 08:37:21 +0100
   3 Subject: [PATCH] wifi: mac80211: check/clear fast rx for non-4addr sta VLAN
   4  changes
   5
   6 When moving a station out of a VLAN and deleting the VLAN afterwards, the
   7 fast_rx entry still holds a pointer to the VLAN's netdev, which can cause
   8 use-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx
   9 after the VLAN change.
  10
  11 Cc: stable@vger.kernel.org
  12 Reported-by: ranygh@riseup.net
  13 Signed-off-by: Felix Fietkau <nbd@nbd.name>
  14 ---
  15
  16 --- a/net/mac80211/cfg.c
  17 +++ b/net/mac80211/cfg.c
  18 @@ -2184,15 +2184,14 @@ static int ieee80211_change_station(stru
  19                 }
  20
  21                 if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
  22 -                   sta->sdata->u.vlan.sta) {
  23 -                       ieee80211_clear_fast_rx(sta);
  24 +                   sta->sdata->u.vlan.sta)
  25                         RCU_INIT_POINTER(sta->sdata->u.vlan.sta, NULL);
  26 -               }
  27
  28                 if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
  29                         ieee80211_vif_dec_num_mcast(sta->sdata);
  30
  31                 sta->sdata = vlansdata;
  32 +               ieee80211_check_fast_rx(sta);
  33                 ieee80211_check_fast_xmit(sta);
  34
  35                 if (test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {